---
title: "Rotate site webhook signing secret"
method: POST
path: "/api/sites/{id}/webhooks/{webhookID}/rotate"
tags: ["Webhooks"]
---

# Rotate site webhook signing secret

`POST /api/sites/{id}/webhooks/{webhookID}/rotate`

## Request

- Base URL: `https://demo.hitkeep.com`
- URL: `https://demo.hitkeep.com/api/sites/{id}/webhooks/{webhookID}/rotate`
- Auth: API key in cookie `hk_token`

Re-signs pending deliveries, replaces the configured secret, and returns the new value exactly once. A request already in flight may still use the previous secret.

## Path parameters

- `id` string, uuid, required
- `webhookID` string, uuid, required

## Response `200`

Webhook and new one-time secret

- WebhookSecretResponse
  - `secret` string, required: One-time signing secret. It is returned only on creation or rotation.
  - `webhook` Webhook, required
    - `created_at` string, date-time, required
    - `description` string, required
    - `enabled` boolean, required
    - `events` string[], required
    - `id` string, uuid, required
    - `name` string, required
    - `scope` 'instance' | 'site', required
    - `site_id` string, uuid, nullable
    - `updated_at` string, date-time, required
    - `url` string, uri, required

---

[API](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api.md) · [All operations](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/revisions/bb2df36ab2a4?raw)