---
title: "Rotate webhook signing secret"
method: POST
path: "/webhooks/rotate-secret"
tags: ["Webhooks"]
---

# Rotate webhook signing secret

`POST /webhooks/rotate-secret`

Generates a new webhook signing secret for the company. The old secret remains valid for 7 days to allow graceful migration. Rate limited to 1 request per minute.

## Response `200`

Secret rotated successfully

- RotateSecretResponse — Secret rotation result with grace period
  - `message` string, required
  - `new_secret` string, required — The new webhook signing secret (64 character hex string)
  - `grace_period_hours` integer, required — Hours the old secret remains valid alongside the new one
  - `warning` string — Reminder to update webhook signature verification

## Other responses

- `401` — Unauthorized - Invalid or missing API key
- `429` — Rate limit exceeded (1 rotation per minute)

---

[API](https://skmtc.dev/firma/apis/firma-partner-api.md) · [All operations](https://skmtc.dev/firma/apis/firma-partner-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/firma/firma-partner-api/revisions/5c03d6a9d080/schema)