---
title: "Regenerates the secret for a webhook"
method: POST
path: "/accounts/{account_id}/webhooks/{webhook_id}/regenerate-secret"
tags: ["Notifications Webhooks"]
---

# Regenerates the secret for a webhook

`POST /accounts/{account_id}/webhooks/{webhook_id}/regenerate-secret`

## Request

- Base URL: `https://api.cint.com/v1`
- URL: `https://api.cint.com/v1/accounts/{account_id}/webhooks/{webhook_id}/regenerate-secret`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/cint/apis/demand-api/docs/accounts/:account_id/webhooks/:webhook_id/regenerate-secret/post.ts> (a function with typed inputs; its response is checked against the schema)

Immediately invalidates the old secret and generates a new one for a webhook.

**Important:** After regenerating, you must update your webhook handler with the new secret to continue verifying payloads. The old secret will no longer work.

## Response `200`

The new webhook secret was generated successfully.

**Important:** The new `secret` is only returned at this time. You must store it securely, as you will need it to verify the signature of incoming webhook requests.

- WebhookSecretRegenerated: The response object returned when a webhook secret is successfully regenerated.
  - `id` string, ulid: The ID of the webhook.
  - `url` string, url: The HTTPS endpoint where webhook notifications will be sent.
  - `events` WebhookEventType[]: An array of webhook event type names.
  - `compression` 'gzip' | 'null', nullable: The compression applied to the body of every webhook request for this subscription. To receive compressed request bodies, set this field to `gzip`. Each request then carries the `Content-Encoding: gzip` header. The `Content-Type` header remains `application/json`, because compression changes only how the body is encoded, not its media type. Compression is not enabled by default. To receive uncompressed request bodies, omit this field, or set it to `null` or an empty string. Updating a webhook replaces the subscription, so an update that omits `compression` disables it. To keep compression enabled, include the field in every update.
  - `secret` string, base64: This is your webhook's secret signing key. You must use it to verify the authenticity and integrity of incoming webhook requests. Each webhook request includes a `Cint-Signature` header with two components: - `t` (timestamp): A Unix timestamp representing the time of the webhook call. - `v1` (signature v1): An HMAC SHA256 hash of the payload, generated by signing it with the secret key. The payload used to create the signature is the concatenation of the timestamp (`t`) and the request body, separated by a period (`.`). For example: - Payload: `1732526080.{"foo":"bar"}` - Example of `Cint-Signature` header: ```text Cint-Signature: t=1732526080,v1=6532d4777122acc32cd388763fc0c0ba8732698d09cf99eea086e5a86f8d3ebe ``` To verify the signature, you can use the following CLI command: ```bash $ export PAYLOAD='1732526080.{"foo":"bar"}' $ export SECRET=FP7UPZpATKBcYJj4va95PYud+a3gCidRERiLO+9MoFE= $ echo -n $PAYLOAD | openssl dgst -sha256 -hmac $SECRET # => (stdin)= 6532d4777122acc32cd388763fc0c0ba8732698d09cf99eea086e5a86f8d3ebe ``` If the subscription sets `compression`, the request body is compressed on the wire, but the signature still covers the uncompressed JSON, so this verification is unchanged.
  - `created_at` string, date-time: The timestamp when the webhook was created, in RFC3339 UTC format.
  - `updated_at` string, date-time: The timestamp when the webhook was last updated, in RFC3339 UTC format.

## Other responses

- `400`: A request is not valid and can't be processed.
- `401`: A request is unauthorized.
- `403`: A requested is forbidden.
- `500`: A request failed due to an internal error.

---

[API](https://skmtc.dev/cint/apis/demand-api.md) - [All operations](https://skmtc.dev/cint/apis/demand-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cint/apis/demand-api/revisions/077a4bdda5cb?raw)