---
title: "Rotate the signing secret"
method: POST
path: "/api/v1/webhook-endpoints/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate the signing secret

`POST /api/v1/webhook-endpoints/{id}/rotate-secret`

## Request

- Base URL: `https://api.imagestep.dev`
- URL: `https://api.imagestep.dev/api/v1/webhook-endpoints/{id}/rotate-secret`
- Auth: API key in header `Authorization`

Replaces the signing secret and returns the new one in the clear, once (`secret`). The old secret stops verifying immediately: every attempt from now on — retries of events queued before the rotation included — is signed with the new one. A delivery your receiver refuses in the switch-over is retried on the normal schedule, so a receiver that answers non-`2xx` to a bad signature and picks up the new secret within minutes loses nothing.

## Path parameters

- `id` string, required

## Headers

- `Idempotency-Key` string

## Response `200`

The endpoint, with the new `secret` in the clear

## Other responses

- `404`: `not_found` — no webhook endpoint with this id on your account
- `409`: Conflict — `error.code` is `idempotency_key_reuse` (the key already means a different request) or `request_in_progress` (the first request under this key has not settled yet; retryable).
- `429`: Rate limited — `error.code` is `rate_limited` and `retryable` is true. `Retry-After` says how many seconds to wait.

---

[API](https://skmtc.dev/imagestep/apis/imagestep-api.md) · [All operations](https://skmtc.dev/imagestep/apis/imagestep-api/llms.txt) · [OpenAPI document](https://skmtc.dev/imagestep/apis/imagestep-api/revisions/5e8e922a3085?raw)