---
title: "Rotate a webhook secret"
method: POST
path: "/webhook/rotate-secret"
tags: ["Webhooks"]
---

# Rotate a webhook secret

`POST /webhook/rotate-secret`

## Request

- Base URL: `https://apisign.io/api`
- URL: `https://apisign.io/api/webhook/rotate-secret`
- Auth: API key in header `x-api-key`

Generate a new signing secret. The old secret stops working immediately; the new one is shown only in this response.

## Request body

- object
  - `id` string, required: Webhook ID

## Response `200`

Secret rotated

- object
  - `secret` string
  - `message` string

## Other responses

- `400`: Invalid request, or the action is not allowed in the resource's current state
- `401`: Missing, invalid, expired or deleted API key. Body: `{ "error": "Unauthorized" }`
- `404`: Resource not found in this organization
- `500`: Internal server error (also returned for a request body that is not valid JSON)

---

[API](https://skmtc.dev/apisign/apis/api-sign-api.md) · [All operations](https://skmtc.dev/apisign/apis/api-sign-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apisign/apis/api-sign-api/revisions/fa21d8adbc69?raw)