---
title: "Ingest Webhook Secret Rotate"
method: POST
path: "/v2/ingest/webhook-secret/rotate"
tags: ["v2", "v2-ingest"]
---

# Ingest Webhook Secret Rotate

`POST /v2/ingest/webhook-secret/rotate`

## Request

- Base URL: `https://api.enconvert.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.enconvert.com/v2/ingest/webhook-secret/rotate`
- Auth: none declared

Rotate the project's webhook signing secret.

Every signature computed with the previous secret stops verifying the moment
this commits — use after a suspected leak, then update the consumer.

## Headers

- `X-API-Key` string, nullable
- `authorization` string, nullable

## Response `200`

Successful Response

- WebhookSecretResponse: A project's webhook signing secret plus the headers a consumer verifies. SENSITIVE: returned only over the authenticated dashboard channel so a customer can configure signature verification on their endpoint. ``rotated`` is True when this response just replaced the previous secret (signatures computed with the old secret stop verifying immediately).
  - `secret` string, required
  - `signature_header` string
  - `timestamp_header` string
  - `signature_scheme` string
  - `replay_tolerance_seconds` integer
  - `rotated` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/enconvert/apis/conversion-api.md) · [All operations](https://skmtc.dev/enconvert/apis/conversion-api/llms.txt) · [OpenAPI document](https://skmtc.dev/enconvert/apis/conversion-api/revisions/b8c820393569?raw)