---
title: "Rotate Signing Secret"
method: POST
path: "/v1/alerts/subscriptions/{subscription_id}/rotate-signing-secret"
tags: ["alerts"]
---

# Rotate Signing Secret

`POST /v1/alerts/subscriptions/{subscription_id}/rotate-signing-secret`

## Request

- Base URL: `https://api.ctindex.io`
- URL: `https://api.ctindex.io/v1/alerts/subscriptions/{subscription_id}/rotate-signing-secret`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Mint a new HMAC signing secret for an alert subscription (task #76).

Moves the current secret into the ``previous`` slot for a 24-hour
overlap window (``signing_secret_previous_expires_at = NOW() + 24h``)
so customers can deploy the new secret without losing in-flight
deliveries — the worker accepts either secret while the overlap is
open, then drops the previous one once the timestamp has passed.

The new plaintext secret is returned **exactly once**; subsequent
reads of the subscription never expose it again.

## Path parameters

- `subscription_id` string, uuid, required

## Cookies

- `ctix_session` string, nullable

## Response `200`

Successful Response

- AlertSigningSecretRotateResponse: Response for ``POST /v1/alerts/subscriptions/{id}/rotate-signing-secret``. Returns the new plaintext signing secret along with the timestamp at which the previous secret stops being accepted (24-hour overlap so callers can roll over without dropped deliveries).
  - `id` string, uuid, required
  - `signing_secret` string, required
  - `previous_secret_valid_until` string, date-time, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ctindex/apis/certindex-api.md) · [All operations](https://skmtc.dev/ctindex/apis/certindex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ctindex/apis/certindex-api/revisions/d5bc0ec85bc9?raw)