---
title: "Rotate the signing secret"
method: POST
path: "/v1/webhook_endpoints/{id}/rotate_secret"
tags: ["Webhook endpoints"]
---

# Rotate the signing secret

`POST /v1/webhook_endpoints/{id}/rotate_secret`

## Request

- Base URL: `https://api.affiliaterail.com`
- URL: `https://api.affiliaterail.com/v1/webhook_endpoints/{id}/rotate_secret`
- Auth: HTTP bearer

Deliveries after this call are signed with the new secret, and with the old one as well for 24 hours (two `v1=` entries in `Rail-Signature`), so you can swap at your own pace.

**Scope:** `webhooks:write` (or `write`)

## Path parameters

- `id` string, required: Prefixed id (`whe_…`)

## Response `200`

The endpoint, with its new secret

- WebhookEndpoint
  - `id` string, required: Prefixed id (`whe_…`)
  - `object` 'webhook_endpoint', required
  - `program_id` string, required: Prefixed id (`prg_…`)
  - `partner_id` string, nullable, required: Prefixed id (`part_…`)
  - `url` string, required
  - `event_types` string[], required
  - `enabled` boolean, required
  - `secret` string: Shown once, on creation
  - `created_at` string, date-time, required: ISO-8601, UTC
  - `updated_at` string, date-time, required: ISO-8601, UTC

## Other responses

- `400`: Invalid request
- `401`: Missing or unknown API key
- `403`: Key lacks the required scope
- `404`: No such object in your organization
- `422`: The request was understood and refused
- `429`: Rate limited: see Retry-After

---

[API](https://skmtc.dev/affiliaterail/apis/affiliaterail-api.md) · [All operations](https://skmtc.dev/affiliaterail/apis/affiliaterail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/affiliaterail/apis/affiliaterail-api/revisions/ea41f345c092?raw)