---
title: "Rotate a managed webhook signing secret"
method: POST
path: "/webhooks/subscriptions/{id}/rotate-secret"
tags: ["Managed webhooks"]
---

# Rotate a managed webhook signing secret

`POST /webhooks/subscriptions/{id}/rotate-secret`

## Request

- Base URL: `https://platform-api.homejourney.sg/v1`
- URL: `https://platform-api.homejourney.sg/v1/webhooks/subscriptions/{id}/rotate-secret`
- Auth: HTTP bearer

Creates and atomically activates the next external secret version with `webhooks.write`. The caller-supplied secret is write-only and never returned; the prior version is scheduled for deletion after seven days.

## Path parameters

- `id` string, uuid, required

## Headers

- `X-Correlation-Id` string
- `Idempotency-Key` string, required

## Request body

- RotatePlatformManagedWebhookSecretRequest
  - `secret` string, required: Caller-supplied signing secret. It is write-only and never appears in responses, idempotency evidence, logs, Terraform state, or OpenAPI examples.

## Response `200`

Managed webhook response with redacted secret and delivery evidence.

- PlatformManagedWebhookSubscriptionResponse
  - `subscription` PlatformManagedWebhookSubscription, required
    - `id` string, uuid, required
    - `name` string, required
    - `environment` 'sandbox' | 'live', required
    - `url` string, uri, required
    - `description` string, nullable, required
    - `event_types` PlatformManagedWebhookEventType[], required
    - `status` 'active' | 'paused', required
    - `secret_version` integer, required
    - `secret_prefix` string, required: Redacted operator-matching prefix only; never the secret or its digest.
    - `secret_returned` false, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - `livemode` boolean, required
  - `request_id` string, required

## Other responses

- `400`: Request validation failed.
- `401`: Missing or invalid platform API key.
- `403`: Credential, environment, or scope is not allowed.
- `404`: Platform API feature or resource is not available.
- `409`: Idempotency key is in progress or conflicts with an earlier request body.
- `429`: Rate limit exceeded.
- `500`: Unexpected platform API failure.
- `503`: A required managed platform dependency is unavailable.

---

[API](https://skmtc.dev/homejourney/apis/homejourney-platform-api.md) · [All operations](https://skmtc.dev/homejourney/apis/homejourney-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/homejourney/apis/homejourney-platform-api/revisions/a2c6fe063db1?raw)