---
title: "Reveal or rotate your webhook signing secret"
method: POST
path: "/v2/webhooks/secret"
tags: ["Webhooks"]
---

# Reveal or rotate your webhook signing secret

`POST /v2/webhooks/secret`

## Request

- Base URL: `https://api.imentiv.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.imentiv.ai/v2/webhooks/secret`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Return your signing secret, in full, in this response only.

Every delivery is signed from your first event. If you have not read your secret yet, this call
returns it without changing it, so you can verify deliveries you have already received. If you
have, this call creates a new secret; the previous one keeps signing for 24 hours, and during
that time each delivery carries two `v1` signatures so you can switch over without dropping
events.

## Response `200`

Successful Response

- WebhookSecret: A signing secret. This is the only response that contains it.
  - `secret` string, required: The signing secret, `whsec_...`. Store it now; it is not shown again.
  - `secret_last4` string, required
  - `rotated` boolean, required: True if this call replaced a secret you had already read. The previous secret keeps signing deliveries alongside the new one for 24 hours. False if it returned the secret created for your account, which is not rotated so that you can verify deliveries already sent.
  - `previous_secret_expires_at` string, date-time, nullable

## Changes

- **2026-10-01** `72330e2229c7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/imentiv/apis/welcome-to-imentiv-ai/changes/v2/webhooks/secret/post.md)

---

[API](https://skmtc.dev/imentiv/apis/welcome-to-imentiv-ai.md) - [All operations](https://skmtc.dev/imentiv/apis/welcome-to-imentiv-ai/llms.txt) - [OpenAPI document](https://skmtc.dev/imentiv/apis/welcome-to-imentiv-ai/revisions/bc15cec7e794?raw)