---
title: "Make a new secret link for an unlisted site"
method: POST
path: "/sites/{id}/rotate-secret-url"
tags: ["Sites"]
---

# Make a new secret link for an unlisted site

`POST /sites/{id}/rotate-secret-url`

## Request

- Base URL: `https://api.hypamoon.com/api/v1`
- URL: `https://api.hypamoon.com/api/v1/sites/{id}/rotate-secret-url`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.hypamoon.com/oauth/authorize`, token URL `https://api.hypamoon.com/oauth/token`, scopes: `sites:write`)

Gives an unlisted site a new secret link; the old one stops working within seconds, everywhere. Use it when the link reached the wrong people. Takes effect immediately, even when four-eyes approval is on.

## Path parameters

- `id` string, uuid, required

## Response `200`

The site with its new secret link in url.

- object: A static site on hypamoon.app, with its visibility.
  - `id` string, uuid, required: The id of the site. Use it to update or delete the site.
  - `slug` string, required: The first part of the address: https://<slug>.hypamoon.app.
  - `name` string, required: Your name for the site.
  - `url` string, required: Where the site lives: https://<slug>.hypamoon.app, or the secret link when visibility is unlisted.
  - `files` SiteFile[], required: The files of the site, sorted by path, without their content.
    - `path` string, required: The path of the file on the site, like /index.html.
    - `content_type` string, required: The type it is served with, like text/html.
    - `bytes` integer, required: The size of the file in bytes.
    - `updated_at` string, date-time, required: When the file was last written.
  - `created_at` string, date-time, required: When the site was created.
  - `updated_at` string, date-time, required: When the site or its files last changed.
  - `version` string, required: The version that is live now. Changes on every update; every file on the site carries it as its ETag, so you can check that a page shows this version.
  - `password_protected` boolean, required: true when visitors have to enter the site's password first (set with password on POST /sites or PUT /sites/{id}). The password itself is never returned.
  - `test` boolean, required: true for a site of a test project. It is public all the same.
  - `taken_offline` object, nullable, required: null while the site is live. Set when Hypamoon took the site offline because of abuse: visitors get a page that says it is unavailable, the files are kept, and PUT and DELETE return 403 site_offline. To object, the owner replies to the email or writes to hello@hypamoon.com.
    - `at` string, date-time, required: When Hypamoon took the site offline.
    - `reason` string, required: Why, in the words the owner also received by email.
  - `warnings` union[]: Only in the answer of a deploy, and only when there is something to tell: files a deploy without keep_existing removed, and build hints. Warnings never block a deploy.
    - union
      - object
        - `code` 'files_removed', required: A deploy without keep_existing removed files that were on the site.
        - `message` string, required: What happened and what to do if it was not intended.
        - `paths` string[], required: The paths that are gone.
      - object
        - `code` 'build_hint', required: Something on the site looks like it works but does not: a form that saves nowhere, localStorage used as a database, a password checked in JavaScript, a button to # or javascript:, a cart without a checkout, test wording on the live project, or a map from a service that needs a key the site does not have. Advice only: the deploy succeeded.
        - `hint` string, required: Which hint, like form_no_target, local_storage_db or cart_without_checkout.
        - `message` string, required: What does not work, in plain words.
        - `paths` string[], required: The files the hint is about.
        - `next_step` string, required: What to do next, with the tool to use.
  - `visibility` 'public' | 'unlisted', required: public: the site lives at https://<slug>.hypamoon.app. unlisted: url is the secret link (https://<random>.hypamoon.app) and the readable address gives 404.

## Other responses

- `401`: Unauthorized: unauthorized, missing_api_key, invalid_api_key, api_key_revoked, project_deleted.
- `403`: Forbidden: project_not_enabled, key_mode_mismatch, missing_scope, verification_required, site_offline.
- `404`: Not Found: not_found.
- `409`: Conflict: conflict.
- `429`: Too Many Requests: rate_limited, deploy_limit_reached.
- `500`: Internal Server Error: internal_error.
- `503`: Service Unavailable: service_unavailable.

---

[API](https://skmtc.dev/hypamoon/apis/hypamoon-api.md) · [All operations](https://skmtc.dev/hypamoon/apis/hypamoon-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hypamoon/apis/hypamoon-api/revisions/9f0b90004c06?raw)