---
title: "Rotate workspace webhook secret"
method: POST
path: "/workspaces/{id}/webhooks/rotate-secret"
tags: ["Webhooks"]
---

# Rotate workspace webhook secret

`POST /workspaces/{id}/webhooks/rotate-secret`

Generates a new webhook signing secret for the workspace. The old secret remains valid for 7 days.

## Path parameters

- `id` string, uuid, required

## Response `200`

Secret rotated successfully

- RotateSecretResponse — Secret rotation result with grace period
  - `message` string, required
  - `new_secret` string, required — The new webhook signing secret (64 character hex string)
  - `grace_period_hours` integer, required — Hours the old secret remains valid alongside the new one
  - `warning` string — Reminder to update webhook signature verification

## Other responses

- `429` — Cooldown active — secret was recently rotated

---

[API](https://skmtc.dev/firma/apis/firma-partner-api.md) · [All operations](https://skmtc.dev/firma/apis/firma-partner-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/firma/firma-partner-api/revisions/5c03d6a9d080/schema)