---
title: "Rotate the signing secret"
method: POST
path: "/webhooks/subscriptions/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate the signing secret

`POST /webhooks/subscriptions/{id}/rotate-secret`

## Request

- Base URL: `https://services.certseal.com/api/v1`
- URL: `https://services.certseal.com/api/v1/webhooks/subscriptions/{id}/rotate-secret`
- Auth: HTTP bearer

Generates a new HMAC signing secret for this subscription and
returns it. Update your verifier immediately — events posted
AFTER this call are signed with the new secret. The old secret
is invalidated atomically.

## Path parameters

- `id` string, required

## Response `200`

Rotated. `signingSecret` is shown ONCE.

- object
  - `subscription` WebhookSubscription, required
    - `id` string, required
    - `url` string, uri, required: The customer-supplied URL that receives signed POSTs. Always uses `https` in production.
    - `events` WebhookEventType[], required
    - `status` 'active' | 'suspended', required: `suspended` once 20 consecutive deliveries have failed. Re-activate from the web app after fixing your endpoint.
    - `secretTail` string, required: Last 4 chars of the signing secret for UI rendering ("wh_sec_xxxx...wxyz"). The full secret is only returned by `createWebhookSubscription` / `rotateWebhookSubscriptionSecret`.
    - `failureCount` integer, required: Consecutive failed deliveries since the last success.
    - `lastFiredAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `signingSecret` string, required

## Other responses

- `401`: Missing, malformed, expired, or revoked API key.
- `404`: The requested resource was not found in this workspace.
- `429`: Too many requests for this API key. Honour the `Retry-After` response header (seconds) or the `detail.retryAfter` field.

---

[API](https://skmtc.dev/certseal/apis/certseal-com-api.md) · [All operations](https://skmtc.dev/certseal/apis/certseal-com-api/llms.txt) · [OpenAPI document](https://skmtc.dev/certseal/apis/certseal-com-api/revisions/9097f49f49f5?raw)