---
title: "Rotate a webhook secret"
method: POST
path: "/api/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate a webhook secret

`POST /api/webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://api.donebear.com`
- URL: `https://api.donebear.com/api/webhooks/{id}/rotate-secret`
- Auth: HTTP bearer

Issue a new signing secret. Deliveries carry signatures under both secrets for 24 hours so consumers can switch without a gap.

## Path parameters

- `id` string, uuid, required

## Headers

- `Api-Version` '1'

## Response `200`

The endpoint and its new secret.

- object
  - `endpoint` WebhookEndpoint, required
    - `consecutiveFailures` integer, required
    - `createdAt` string, date-time, required
    - `description` string, required
    - `disabledAt` string, date-time, nullable
    - `disabledReason` string, nullable
    - `enabled` boolean, required
    - `eventTypes` string[], required: Empty means every event type.
    - `id` string, uuid, required
    - `updatedAt` string, date-time, required
    - `url` string, uri, required
    - `workspaceId` string, uuid, required
  - `ok` boolean, required
  - `secret` string, required

---

[API](https://skmtc.dev/donebear/apis/done-bear-api.md) · [All operations](https://skmtc.dev/donebear/apis/done-bear-api/llms.txt) · [OpenAPI document](https://skmtc.dev/donebear/apis/done-bear-api/revisions/91de7e02be0d?raw)