---
title: "Rotate the webhook signing secret"
method: POST
path: "/api/users/secret/rotate"
tags: ["Users"]
---

# Rotate the webhook signing secret

`POST /api/users/secret/rotate`

## Request

- Base URL: `https://app.herondata.io`
- URL: `https://app.herondata.io/api/users/secret/rotate`
- Auth: API key in header `x-api-key`

Invalidates the old secret immediately. New, pending, and retried webhook deliveries use the new secret. Update every receiver before rotating or new webhook sends will fail until receivers use the new secret.

## Response `200`

Webhook signing secret rotated

- object
  - `secret` string, required

## Other responses

- `429`: Rotation rate limit exceeded

## Changes

- **2026-11-03** `bd8008e49534`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/herondata/apis/heron-data-api/changes/api/users/secret/rotate/post.md)

---

[API](https://skmtc.dev/herondata/apis/heron-data-api.md) - [All operations](https://skmtc.dev/herondata/apis/heron-data-api/llms.txt) - [OpenAPI document](https://skmtc.dev/herondata/apis/heron-data-api/revisions/1ec936e17fef?raw)