---
title: "Rotate webhook signing secret"
method: POST
path: "/v1/webhooks/{webhook_id}/rotate-secret"
tags: ["webhooks"]
---

# Rotate webhook signing secret

`POST /v1/webhooks/{webhook_id}/rotate-secret`

## Request

- Base URL: `https://us1.platform.bird.com`
- URL: `https://us1.platform.bird.com/v1/webhooks/{webhook_id}/rotate-secret`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `bird_session`

Generates a new signing secret for the endpoint and returns it exactly once: store it
immediately, it cannot be retrieved after this response. For 24 hours every delivery
is signed with both the old and the new secret, so a receiver verifying with either
keeps working while you roll the new one out. After the window the old secret stops
signing. Verification details are in the [webhooks guide](/docs/guides/webhooks).

An endpoint holds at most 5 concurrently valid secrets, so rotating repeatedly within
the overlap window fails with `WebhookTooManySecrets` until an older secret expires.

## Headers

- `Idempotency-Key` string
- `X-Workspace-Id` string
- `X-Organization-Id` string

## Response `200`

New signing secret.

- WebhookRotateSecretResponse
  - `secret` string, required: The new signing secret (`whsec_` prefix). Shown only in this response: store it immediately, it cannot be retrieved again. Deliveries are signed with both this and the previous secret for 24 hours after rotation, then the previous secret stops signing.

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Insufficient permissions
- `404`: Resource not found
- `422`: The request has invalid field values, violates a business rule, or carries a query parameter the endpoint does not declare. Field validation errors use `type: validation_error` and include the affected fields in `details`. Business-rule errors identify the failed rule in `type`.
- `429`: Rate limit exceeded
- `500`: Internal server error
- `503`: The service is temporarily unavailable. If `Retry-After` is present, wait for that delay before retrying; otherwise, retry with exponential backoff. Reuse the same idempotency key and request when retrying a mutation.

---

[API](https://skmtc.dev/messagebird/apis/bird-api.md) · [All operations](https://skmtc.dev/messagebird/apis/bird-api/llms.txt) · [OpenAPI document](https://skmtc.dev/messagebird/apis/bird-api/revisions/6dfce1179799?raw)