---
title: "Rotate the agent merchant webhook secret"
method: POST
path: "/api/agents/webhook-secret"
tags: ["agents"]
---

# Rotate the agent merchant webhook secret

`POST /api/agents/webhook-secret`

## Request

- Base URL: `https://api.depixapp.com`
- URL: `https://api.depixapp.com/api/agents/webhook-secret`
- Auth: none required

Rotates the merchant webhook signing secret and returns the new one ONCE. The previous secret is invalidated immediately. Auth: agent keypair signature; rejected when suspended.

## Response `200`

New secret — store it now; it is never shown again.

- AgentWebhookSecretResponse: Rotated webhook secret — returned ONCE; the previous secret is invalidated immediately.
  - `response` object, required: Envelope.
    - `webhook_secret` string, required: The new whsec_… secret (one-time).

## Other responses

- `401`: Signature chain failed or unknown agent key.
- `403`: Blocked or suspended.
- `429`: Rate limited (per-IP, per-key or per-merchant window). Retry after `retry_after` seconds (also in the Retry-After header).
- `503`: Nonce store unavailable (fail-CLOSED) OR the agent program is globally disabled (agents_disabled).

---

[API](https://skmtc.dev/depixapp/apis/depix-api.md) · [All operations](https://skmtc.dev/depixapp/apis/depix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/depixapp/apis/depix-api/revisions/04094536dd0f?raw)