---
title: "Revoke the previous webhook endpoint secret"
method: POST
path: "/v4/webhook_endpoints/{id}/revoke_previous_secret"
tags: ["Webhooks"]
---

# Revoke the previous webhook endpoint secret

`POST /v4/webhook_endpoints/{id}/revoke_previous_secret`

## Request

- Base URL: `https://api.kit.com`
- URL: `https://api.kit.com/v4/webhook_endpoints/{id}/revoke_previous_secret`
- Auth: one of:
  - API key in header `X-Kit-Api-Key`
  - OAuth 2
    - Authorization code: `https://api.kit.com/v4/oauth/authorize`
    - Token URL: `https://api.kit.com/v4/oauth/token`

Closes a [rotation's](/api-reference/webhooks/rotate-a-webhook-endpoint-secret) overlap window early: the previous secret stops verifying immediately, leaving only the current secret valid. Call this once you've fully switched to the new secret, rather than waiting for `previous_secret_expires_at` to pass.

Subsequent deliveries are signed with the current secret only, so the `X-Kit-Signature` header goes back to carrying a single `v1` entry.

## Path parameters

- `id` integer, required

## Response `200`

Revokes the previous secret, closing the rotation overlap window

- object
  - `webhook_endpoint` object, required
    - `id` integer, required
    - `name` string, required
    - `url` string, required
    - `events` string[], required
    - `status` string, required
    - `source` string, required
    - `description` string, required
    - `created_by_app` unknown, required
    - `created_at` string, required
    - `previous_secret_expires_at` unknown, required

## Other responses

- `404`: Returns a 404 when the provided id does not exist

## Changes

- **2026-11-03** `f04308f83b63`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/kit/apis/kit-api/changes/v4/webhook_endpoints/:id/revoke_previous_secret/post.md)

---

[API](https://skmtc.dev/kit/apis/kit-api.md) - [All operations](https://skmtc.dev/kit/apis/kit-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kit/apis/kit-api/revisions/f04308f83b63?raw)