---
title: "Rotate the URL token and/or the verification secret"
method: POST
path: "/agents/{agentId}/webhooks/{endpointId}/rotate"
tags: ["Agent Webhooks"]
---

# Rotate the URL token and/or the verification secret

`POST /agents/{agentId}/webhooks/{endpointId}/rotate`

## Request

- Base URL: `https://api.atako.ai`
- URL: `https://api.atako.ai/agents/{agentId}/webhooks/{endpointId}/rotate`
- Auth: HTTP bearer

`url` and `token` are returned only when `rotateToken` is true.

## Path parameters

- `agentId` string, uuid, required
- `endpointId` string, uuid, required

## Request body

- object
  - `rotateToken` boolean
  - `verificationSecret` string

## Response `200`

- object
  - `endpoint` AgentWebhookEndpoint, required: Never carries the full URL token nor the verification secret.
    - `id` string, uuid, required
    - `name` string, required
    - `status` 'active' | 'paused' | 'disabled', required
    - `provider` 'none' | 'shared_secret' | 'hmac_generic' | 'standard_webhooks' | 'stripe' | 'github' | 'custom', required
    - `tokenPrefix` string, required
    - `hasVerificationSecret` boolean
    - `signatureConfig` object, nullable
    - `filters` WebhookFilter[]
      - `field` string, required
      - `op` 'eq' | 'neq' | 'in' | 'exists' | 'contains', required
      - `value` union
        - string
        - string[]
    - `maxPayloadBytes` integer, nullable
    - `rateLimitPerMinute` integer, nullable
    - `dailyTurnQuota` integer, nullable
    - `totalEventsCount` integer
    - `rejectedRequestsCount` integer
    - `lastRejectedAt` string, date-time, nullable
    - `lastRejectedCode` integer, nullable
    - `lastEventAt` string, date-time, nullable
    - `createdAt` string, date-time
  - `url` string
  - `token` string

## Other responses

- `400`: VALIDATION_FAILED / PROVIDER_NOT_AVAILABLE / PROVIDER_HAS_NO_SECRET / EVENT_NOT_REQUEUEABLE
- `401`: Missing, malformed, or invalid bearer token / API key, or revoked session (SESSION_REVOKED).
- `403`: FORBIDDEN / PLAN_WEBHOOK_DISABLED
- `404`: AGENT_NOT_FOUND / ENDPOINT_NOT_FOUND / EVENT_NOT_FOUND
- `409`: AGENT_INACTIVE

---

[API](https://skmtc.dev/atako/apis/atako-api.md) · [All operations](https://skmtc.dev/atako/apis/atako-api/llms.txt) · [OpenAPI document](https://skmtc.dev/atako/apis/atako-api/revisions/aa555c56fbd7?raw)