---
title: "Rotate a webhook signing secret"
method: POST
path: "/api/v1/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate a webhook signing secret

`POST /api/v1/webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://cooperemail.com`
- URL: `https://cooperemail.com/api/v1/webhooks/{id}/rotate-secret`
- Auth: HTTP bearer

Mints a new whsec_ secret and returns it once, the same as create. The previous secret stays valid for 24 hours. The response includes previous_secret_expires_at and previous_secret_active true, and does not return the previous secret. Rotating again replaces the previous secret and resets the window. A hook with no secret just stores the new one. Same permission as PATCH (webhook_write). During the window x-cooper-signature is sha256=<hex>,sha256=<hex> and x-cooper-signature-v2 is v1=<hex>,v1=<hex>, current secret first. Accept the delivery when any comma-separated segment matches. Another account's id is 404 webhook_not_found.

## Path parameters

- `id` string, required

## Response `200`

Webhook with the new secret revealed once

## Other responses

- `404`: webhook_not_found

---

[API](https://skmtc.dev/cooperemail/apis/cooper-email-api.md) · [All operations](https://skmtc.dev/cooperemail/apis/cooper-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cooperemail/apis/cooper-email-api/revisions/6d800a7b3e33?raw)