---
title: "Rotate a webhook secret"
method: POST
path: "/v1/channels/{id}/rotate-secret"
tags: ["Alerts"]
---

# Rotate a webhook secret

`POST /v1/channels/{id}/rotate-secret`

## Request

- Base URL: `https://api.mentio.dev`
- URL: `https://api.mentio.dev/v1/channels/{id}/rotate-secret`
- Auth: HTTP bearer

## Path parameters

- `id` string, required: Channel id (dest_...).

## Response `200`

A new signing secret, shown once. The previous one stops verifying immediately.

- union
  - SlackChannel
    - `id` string, required: Channel id (dest_...).
    - `label` string, required
    - `stats` object, required: Computed over this workspace's deliveries.
      - `alerts` integer, required: Alerts sending to this channel.
      - `activeAlerts` integer, required: Of those, enabled ones; 0 means the channel receives nothing right now.
      - `lastDeliveryAt` string, nullable, required: Newest delivery attempt, successful or not.
      - `last7d` object, required: Deliveries in the last 7 days.
        - `total` integer, required
        - `failed` integer, required
    - `createdAt` string, required: ISO 8601 timestamp, UTC.
    - `kind` 'slack', required
    - `config` object, required
      - `channelId` string, required: Slack channel id.
      - `channelName` string, required: Slack channel name, without the #.
      - `events` string[], required: The attention events this channel receives on its own, no rule involved: one short message when an item opens (GET /v1/attention). Empty when it receives none.
  - EmailChannel
    - `id` string, required: Channel id (dest_...).
    - `label` string, required
    - `stats` object, required: Computed over this workspace's deliveries.
      - `alerts` integer, required: Alerts sending to this channel.
      - `activeAlerts` integer, required: Of those, enabled ones; 0 means the channel receives nothing right now.
      - `lastDeliveryAt` string, nullable, required: Newest delivery attempt, successful or not.
      - `last7d` object, required: Deliveries in the last 7 days.
        - `total` integer, required
        - `failed` integer, required
    - `createdAt` string, required: ISO 8601 timestamp, UTC.
    - `kind` 'email', required
    - `config` object, required
      - `recipients` object[], required: Every address on the list and whether it confirmed.
        - `email` string, required
        - `confirmedAt` string, nullable, required: Null until the address confirmed through its link; unconfirmed addresses receive nothing.
      - `events` string[], required: The attention events this channel receives on its own, no rule involved: one short message when an item opens (GET /v1/attention). Empty when it receives none.
  - WebhookChannel
    - `id` string, required: Channel id (dest_...).
    - `label` string, required
    - `stats` object, required: Computed over this workspace's deliveries.
      - `alerts` integer, required: Alerts sending to this channel.
      - `activeAlerts` integer, required: Of those, enabled ones; 0 means the channel receives nothing right now.
      - `lastDeliveryAt` string, nullable, required: Newest delivery attempt, successful or not.
      - `last7d` object, required: Deliveries in the last 7 days.
        - `total` integer, required
        - `failed` integer, required
    - `createdAt` string, required: ISO 8601 timestamp, UTC.
    - `kind` 'webhook', required
    - `config` object, required
      - `url` string, required: Where the signed POSTs go.
      - `headers` object, required: Extra request headers you configured.
      - `events` string[], required: The account events this endpoint receives on its own, no rule involved: keyword and wallet state changes and the attention events. Empty when it receives none; mention and digest deliveries come through rules as before.
      - `secret` string: Only on creation and rotation. Signs every request: X-Mentions-Signature-V2 is v2= plus the hex HMAC-SHA256 of "<X-Mentions-Timestamp>.<raw body>" (reject a timestamp older than a few minutes); X-Mentions-Signature, the hex HMAC-SHA256 of the raw body alone, stays for older verifiers.
  - TelegramChannel
    - `id` string, required: Channel id (dest_...).
    - `label` string, required
    - `stats` object, required: Computed over this workspace's deliveries.
      - `alerts` integer, required: Alerts sending to this channel.
      - `activeAlerts` integer, required: Of those, enabled ones; 0 means the channel receives nothing right now.
      - `lastDeliveryAt` string, nullable, required: Newest delivery attempt, successful or not.
      - `last7d` object, required: Deliveries in the last 7 days.
        - `total` integer, required
        - `failed` integer, required
    - `createdAt` string, required: ISO 8601 timestamp, UTC.
    - `kind` 'telegram', required
    - `config` object, required
      - `chatId` string, required: Telegram chat id.
      - `chatType` 'private' | 'group' | 'supergroup' | 'channel', required
      - `events` string[], required: The attention events this channel receives on its own, no rule involved: one short message when an item opens (GET /v1/attention). Empty when it receives none.

## Other responses

- `401`: Missing or invalid API key
- `404`: Webhook channel not found

---

[API](https://skmtc.dev/mentio/apis/mentio-api.md) · [All operations](https://skmtc.dev/mentio/apis/mentio-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mentio/apis/mentio-api/revisions/b16a21d0ed02?raw)