---
title: "Rotate Webhook Secret"
method: POST
path: "/v1/inboxes/{inbox_id}/webhook-secret/rotate"
---

# Rotate Webhook Secret

`POST /v1/inboxes/{inbox_id}/webhook-secret/rotate`

## Request

- Base URL: `https://api.namailu.cz` (the document declares no server; this is the origin it was published from)
- URL: `https://api.namailu.cz/v1/inboxes/{inbox_id}/webhook-secret/rotate`
- Auth: HTTP bearer

Explicitní rotace pro stejný target.

Policy row se zamkne. Worker si event i generaci atomicky vyzvedne před síťovým
voláním; již rozběhnutý HTTPS požadavek ovšem po rotaci nelze vzít zpět.

## Path parameters

- `inbox_id` string, required

## Request body

- WebhookSecretRotate
  - `overlap_seconds` integer: How long queued retries may still use the previous secret; 0 is atomic cutover.

## Response `200`

Successful Response

- WebhookSecretRotateResponse
  - `inbox_id` string, required
  - `webhook_secret` string, required: New secret, returned by this response only.
  - `generation` integer, required
  - `previous_valid_until` string, date-time, nullable, required

## Other responses

- `401`: Missing, invalid or unproved API credential.
- `403`: Credential lacks the required scope or policy permission.
- `422`: Stable validation or policy rejection.
- `500`: Sanitized internal error.

---

[API](https://skmtc.dev/namailu/apis/domovnik-agent-api.md) · [All operations](https://skmtc.dev/namailu/apis/domovnik-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/namailu/apis/domovnik-agent-api/revisions/6342d1e31643?raw)