---
title: "Rotate destination signing secret"
method: POST
path: "/api/v1/apps/{slug}/destinations/{index}/rotate-secret"
---

# Rotate destination signing secret

`POST /api/v1/apps/{slug}/destinations/{index}/rotate-secret`

## Request

- Base URL: `https://anyhook.net`
- URL: `https://anyhook.net/api/v1/apps/{slug}/destinations/{index}/rotate-secret`
- Auth: HTTP bearer

Rotates the HMAC signing secret for a specific destination. If no secret is provided in the request body, a new random secret is generated. Returns the new signing secret.

## Path parameters

- `slug` string, required
- `index` integer, required

## Request body

- object
  - `secret` string: Custom signing secret. If omitted, a random secret is generated.

## Response `200`

Secret rotated

- object
  - `destination_index` integer
  - `signing_secret` string

## Other responses

- `400`: Invalid request (e.g. index out of range)
- `401`: Unauthorized
- `404`: App not found
- `429`: Rate limit exceeded. Check Retry-After header.

---

[API](https://skmtc.dev/anyhook/apis/anyhook-api.md) · [All operations](https://skmtc.dev/anyhook/apis/anyhook-api/llms.txt) · [OpenAPI document](https://skmtc.dev/anyhook/apis/anyhook-api/revisions/ddf038fb32fc?raw)