---
title: "Replace the signing secret (shown once); the previous one signs for 24 more hours"
method: POST
path: "/api/v1/webhooks/{subscription_id}/rotate-secret"
tags: ["Webhooks"]
---

# Replace the signing secret (shown once); the previous one signs for 24 more hours

`POST /api/v1/webhooks/{subscription_id}/rotate-secret`

## Request

- Base URL: `https://api.hub-equity.com`
- URL: `https://api.hub-equity.com/api/v1/webhooks/{subscription_id}/rotate-secret`
- Auth: HTTP bearer

Answers the new `whsec_...` secret, shown only here. Until 24 hours from now every delivery carries two signatures, `v1=<new>,v1=<old>`, and a receiver that accepts any match (the published recipe) keeps verifying with either secret while you switch. A receiver that compares the whole header fails during the window: make it split on the comma before rotating. The previous secret stays valid for those 24 hours; if it leaked, rotate a second time right away, that ends it at once.

## Path parameters

- `subscription_id` string, required

## Response `200`

Successful Response

- ApiResponseWebhookCreatedResponse
  - `success` boolean, required
  - `data` WebhookCreatedResponse
    - `id` string, uuid, required
    - `name` string, required
    - `url` string, required
    - `events` string[], required
    - `entity_ids` string[], nullable
    - `is_active` boolean, required
    - `disabled_reason` string, nullable
    - `consecutive_failures` integer
    - `last_delivery_at` string, date-time, nullable
    - `last_delivery_status` integer, nullable
    - `created_at` string, date-time, required
    - `secret` string, required: The signing secret (`whsec_...`). Shown ONCE, at creation or rotation: store it now. `POST /webhooks/{id}/rotate-secret` replaces it; the previous one keeps signing for 24 hours.
  - `error` ApiError: API error details.
    - `code` string, required
    - `message` string, required
    - `details` object, nullable
  - `meta` ApiMeta: API response metadata. Pagination fields (``page`` / ``per_page`` / ``total``) are populated on collection endpoints only. They are omitted from the payload on single-resource endpoints.
    - `timestamp` string, date-time
    - `request_id` string, nullable
    - `page` integer, nullable
    - `per_page` integer, nullable
    - `total` integer, nullable
  - `links` ApiLinks: HATEOAS-style pagination cursors. Host-relative path + query links for a collection page. Present on collection endpoints, ``null`` fields where a page doesn't exist (``next`` on the last page, ``prev`` on the first). The whole ``links`` object is omitted from single-resource responses (see ``ApiResponse`` serializer).
    - `self` string, nullable
    - `first` string, nullable
    - `prev` string, nullable
    - `next` string, nullable
    - `last` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/hub-equity/apis/hub-equity-api.md) · [All operations](https://skmtc.dev/hub-equity/apis/hub-equity-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hub-equity/apis/hub-equity-api/revisions/e8eeda5dc13e?raw)