---
title: "rotate_webhook_secret"
method: POST
path: "/v1/webhooks/{endpointId}/secrets"
---

# rotate_webhook_secret

`POST /v1/webhooks/{endpointId}/secrets`

## Request

- Base URL: `https://app.agentlinkops.com`
- URL: `https://app.agentlinkops.com/v1/webhooks/{endpointId}/secrets`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Remaining arguments go in a JSON object body. Empty or unreadable body is treated as {} by this resource handler; use {retire:true} to retire the older secret.

## Path parameters

- `endpointId` string, required: endpoint ID from create/list.

## Headers

- `X-Workspace-ID` string

## Request body

- object
  - `retire` boolean: First call with false to issue a new secret, save it and update the receiver. Then call with true to retire the older secret; true alone never rotates.

## Response `201`

Remaining arguments go in a JSON object body. Empty or unreadable body is treated as {} by this resource handler; use {retire:true} to retire the older secret.

- object
  - `id` string, required: Resource identifier returned by the operation.
  - `active_secrets` number, required
  - `retired` boolean, required
  - `secret` string: Webhook signing secret returned only when created or rotated. Store it securely.

## Other responses

- `429`: Request-rate or usage refusal. Inspect error.code and recovery details before retrying.
- `default`: Error envelope. Non-configuration 5xx messages are masked and details omitted; allowlisted configuration errors retain static operator recovery.

---

[API](https://skmtc.dev/agentlinkops/apis/agentlinkops-http-api.md) · [All operations](https://skmtc.dev/agentlinkops/apis/agentlinkops-http-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentlinkops/apis/agentlinkops-http-api/revisions/2a712a1dcfa7?raw)