---
title: "Rotate the signing secret"
method: POST
path: "/api/v3/webhook_endpoints/{id}/regenerate_secret/"
tags: ["Webhooks"]
---

# Rotate the signing secret

`POST /api/v3/webhook_endpoints/{id}/regenerate_secret/`

## Request

- Base URL: `https://embedded.improvado.io`
- URL: `https://embedded.improvado.io/api/v3/webhook_endpoints/{id}/regenerate_secret/`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `dts_session_id`
- TypeScript: <https://skmtc.dev/improvado/apis/improvado-embedded-api-v3/docs/api/v3/webhook_endpoints/:id/regenerate_secret/post.ts> (a function with typed inputs; its response is checked against the schema)

Generate a new signing secret for the endpoint. The previous secret is invalidated immediately and
the endpoint is reset to `unverified` status, so the endpoint must be re-verified before it will
receive further events. Update your receiver to use the new secret before re-verification.

## Path parameters

- `id` integer, required

## Response `200`

Secret rotated; the new secret is in the response body.

- WebhookEndpointDetail: Full webhook endpoint representation, including the signing secret and the list of subscriptions. The `secret` is used to compute the `X-Improvado-Signature` header (HMAC-SHA256) on every event delivery and as the verification token during the verify flow. Treat it as sensitive and store it securely.
  - `id` integer
  - `url` string, uri
  - `secret` string: 64-character hex signing secret
  - `status` 'unverified' | 'active'
  - `consecutive_failures` integer
  - `subscriptions` WebhookSubscription[]
    - `id` integer: Subscription ID
    - `event_type_name` string: Name of the event type this subscription receives
    - `is_active` boolean: Whether the subscription is active
    - `created_at` string, date-time: When the subscription was created
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401`: Authentication credentials were not provided.
- `404`: Webhook endpoint not found

---

[API](https://skmtc.dev/improvado/apis/improvado-embedded-api-v3.md) - [All operations](https://skmtc.dev/improvado/apis/improvado-embedded-api-v3/llms.txt) - [OpenAPI document](https://skmtc.dev/improvado/apis/improvado-embedded-api-v3/revisions/a881099bd6c4?raw)