---
title: "Configure webhook secret"
method: POST
path: "/webhook/{webhook_uuid}/rotate-secret"
tags: ["Org Level Webhooks"]
---

# Configure webhook secret

`POST /webhook/{webhook_uuid}/rotate-secret`

## Request

- Base URL: `https://api.ocrolus.com/v1/account/settings`
- URL: `https://api.ocrolus.com/v1/account/settings/webhook/{webhook_uuid}/rotate-secret`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://auth.ocrolus.com/oauth/token`

This API configures the secret key for a specific org-level webhook. Use this endpoint to add a new secret or update an existing one. The secret is used to sign webhook payloads using HMAC SHA256, allowing you to verify that requests originate from Ocrolus.

## Path parameters

- `webhook_uuid` string, uuid, required

## Request body

- object
  - `secret_key` string, required: The new webhook secret key. Must be between 16 and 128 characters long.

## Response `200`

Success

- object: Schema for the successful response of new secret key.
  - `response` object
    - `status` string: Indicates the request status.
    - `message` string: Confirmation message.

## Other responses

- `404`: Webhook Not Found

---

[API](https://skmtc.dev/ocrolus/apis/org-level-webhooks.md) - [All operations](https://skmtc.dev/ocrolus/apis/org-level-webhooks/llms.txt) - [OpenAPI document](https://skmtc.dev/ocrolus/apis/org-level-webhooks/revisions/ef603756da38?raw)