---
title: "Rotate a monitor webhook signing secret"
method: POST
path: "/monitors/{monitorId}/rotate-secret"
tags: ["Monitors"]
---

# Rotate a monitor webhook signing secret

`POST /monitors/{monitorId}/rotate-secret`

## Request

- Base URL: `https://api.domscout.io`
- URL: `https://api.domscout.io/monitors/{monitorId}/rotate-secret`
- Auth: API key in header `x-api-key`

Replaces the signing secret for an owned monitor that has notifyWebhookUrl configured. The response is the only disclosure of the replacement: monitor reads and lists never include it. Store it on receipt.

Every accepted call creates a new secret; this operation is not idempotent. Deliveries already queued retain the secret snapshotted when they were accepted, so a receiver should accept both the previous and replacement secrets until those attempts drain.

A missing, foreign, or notification-less monitor answers the same 404 MONITOR_NOT_FOUND. Never billed and never launches a browser.

## Path parameters

- `monitorId` string, uuid, required

## Response `200`

Rotated. The replacement secret is shown only in this response.

- object
  - `monitorId` string, uuid, required
  - `notifyWebhookSecret` string, required: The replacement signing secret. No API read returns it; the account owner can reveal it in the dashboard.
  - `notifyWebhookSecretNote` string, required

## Other responses

- `404`: The monitor is missing, foreign, or has no notification URL.
- `503`: A dependency this request needs is unavailable or not configured for this deployment. Codes: SUPABASE_TIMEOUT and SUPABASE_INVALID_RESPONSE (a storage operation did not answer, or answered unreadably — the write may have committed, so any retry must be idempotent), CAPTURE_ARTIFACT_UNAVAILABLE and CAPTURE_ARTIFACT_CORRUPT (a stored artifact could not be read or parsed), ASYNC_JOBS_NOT_CONFIGURED and CAPTURE_RETRIEVAL_NOT_CONFIGURED (the capability is not configured here, on any plan). Retryable unless the code names a deployment configuration.

---

[API](https://skmtc.dev/domscout/apis/domscout-api.md) · [All operations](https://skmtc.dev/domscout/apis/domscout-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domscout/apis/domscout-api/revisions/20562d5b5d94?raw)