---
title: "Rotate a webhook's signing secret"
method: POST
path: "/webhooks/{id}/rotate"
tags: ["Webhooks"]
---

# Rotate a webhook's signing secret

`POST /webhooks/{id}/rotate`

## Request

- Base URL: `https://api.mepmail.dev`
- URL: `https://api.mepmail.dev/webhooks/{id}/rotate`
- Auth: HTTP bearer

MepMail extension. Mints a new signing secret (or takes the one in signing_secret) and returns it. For overlap_hours the previous secret keeps signing too: every delivery in that window carries both signatures, space-separated in webhook-signature, so the receiver can switch at any point without a gap. A second rotation inside the window replaces the previous secret.

## Path parameters

- `id` string, uuid, required

## Request body

- RotateWebhookSecretRequest
  - `signing_secret` string: New secret to sign with: whsec_ followed by base64 of 24-64 bytes. Omit to mint one.
  - `overlap_hours` integer: Hours the previous secret keeps signing alongside the new one (default 24, max 72). Every delivery in the window carries both signatures, so a receiver holding either verifies; 0 drops the old secret at once.

## Response `200`

The new secret and when the previous one stops signing

- RotateWebhookSecretResponse
  - `object` 'webhook', required
  - `id` string, uuid, required
  - `signing_secret` string, required
  - `previous_secret_expires_at` string, nullable, required

## Other responses

- `401`: Missing, malformed or invalid API key
- `404`: Not found
- `422`: Validation error
- `429`: Rate limit exceeded: 600 requests per minute per API key and 3,000 per team; wait for Retry-After

---

[API](https://skmtc.dev/mepmail/apis/mepmail-api.md) · [All operations](https://skmtc.dev/mepmail/apis/mepmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mepmail/apis/mepmail-api/revisions/262a89f73730?raw)