---
title: "A new signing secret, shown once. The old one keeps signing for the overlap."
method: POST
path: "/v1/webhooks/endpoints/{endpointId}/rotate-secret"
tags: ["webhooks"]
---

# A new signing secret, shown once. The old one keeps signing for the overlap.

`POST /v1/webhooks/endpoints/{endpointId}/rotate-secret`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/webhooks/endpoints/{endpointId}/rotate-secret`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://auth.50heads.com/authorize`, token URL `https://auth.50heads.com/token`; client credentials, token URL `https://auth.50heads.com/token`, scopes: `webhooks:write`)

`overlapHours` defaults to 24 (0 to 168). During the overlap every delivery carries a signature from each secret; `previousSecret.expiresAt` says when the old one stops. 0 cuts over at once.

## Path parameters

- `endpointId` string, required

## Request body

- WebhooksRotateSecretRequest
  - `overlapHours` integer

## Response `200`

OK

- WebhooksRotateSecretResponse
  - `endpoint` WebhookEndpoint, required
    - `id` string, required
    - `url` string, uri, required
    - `events` string[], required
    - `secret` string, required
    - `createdAt` string, required
    - `lastDeliveryAt` string, nullable, required
    - `lastStatus` integer, nullable, required
    - `description` string, nullable
    - `enabled` boolean
    - `disabledReason` string, nullable
    - `disabledAt` string, nullable
    - `lastSuccessAt` string, nullable
    - `teamId` string, nullable
    - `apiVersion` '2026-10-10'
    - `filter` object, nullable
      - `projectIds` string[]
      - `labels` string[]
    - `previousSecret` object, nullable
      - `secret` string, required
      - `expiresAt` string, required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `404`: No such question, endpoint or delivery on this account.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/20175e8b00e3?raw)