---
title: "Rotate event source credentials"
method: POST
path: "/event_sources/{id}/rotate"
tags: ["EventSources"]
---

# Rotate event source credentials

`POST /event_sources/{id}/rotate`

## Request

- Base URL: `https://api.crevio.co/v1`
- URL: `https://api.crevio.co/v1/event_sources/{id}/rotate`
- Auth: API key in header `Authorization`

Issues a new `inbound_url` token and signing secret for an inbound webhook source. The old URL answers 404 immediately, so update the sending service with the new `inbound_url`. 422 for sources that are not inbound webhooks.

## Path parameters

- `id` string, required

## Headers

- `Idempotency-Key` string

## Response `200`

Rotated event source

- EventSource
  - `id` string, required
  - `object` string, required
  - `vendor` 'pipedream' | 'webhook', required
  - `vendor_trigger_id` string, nullable, required
  - `vendor_component_id` string, nullable, required
  - `event_name` string, required
  - `configured_props` object, required
  - `description` string, nullable, required
  - `signature_required` boolean, required
  - `active` boolean, required
  - `last_delivered_at` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `qualified_event_name` string, required
  - `inbound_url` string, nullable, required

## Other responses

- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `422`: Validation error
- `429`: Rate limit exceeded — 600 requests per minute per credential. Retry after the number of seconds in `Retry-After`.
- `500`: Internal server error

---

[API](https://skmtc.dev/crevio/apis/crevio-api-v1.md) · [All operations](https://skmtc.dev/crevio/apis/crevio-api-v1/llms.txt) · [OpenAPI document](https://skmtc.dev/crevio/apis/crevio-api-v1/revisions/2219f18ad651?raw)