---
title: "Rotate Webhook Endpoint Signing Secret"
method: POST
path: "/webhook_endpoints/{webhook_endpoint_id}/rotate_secret"
---

# Rotate Webhook Endpoint Signing Secret

`POST /webhook_endpoints/{webhook_endpoint_id}/rotate_secret`

Rotates the signing secret for a webhook endpoint in the authenticated project.

## Path parameters

- `webhook_endpoint_id` string, required

## Request body

- PublicRotateSecretBody
  - `keep_old_secret_active_for_24_hours` boolean — Whether to keep the previous signing secret valid for 24 hours after rotation. Defaults to false, which invalidates the previous secret immediately.

## Response `200`

Success

- WebhookEndpointWithSecretResource
  - `id` string, required — The unique ID of the webhook endpoint.
  - `object` 'webhook_endpoint', required — The object type, which is always webhook_endpoint.
  - `created_at` integer, required — The Unix timestamp when the endpoint was created.
  - `updated_at` integer — The Unix timestamp of the last endpoint configuration or signing-secret change. Initialized at creation; tests and unchanged updates do not advance it.
  - `name` string, required — The human-readable name of the endpoint.
  - `url` string, required — The HTTPS URL that receives webhook deliveries.
  - `event_types` string[], required — The event types that trigger deliveries to this endpoint.
  - `signing_secret_hint` string, nullable, required — A masked hint for the endpoint's signing secret.
  - `signing_secret` string, required — The endpoint's signing secret. This is returned only when the endpoint is created or the secret is rotated.

## Changes

- **2026-09-16** `c8bd56db4095` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/openai/apis/openapi/changes/webhook_endpoints/:webhook_endpoint_id/rotate_secret/post.md)

---

[API](https://skmtc.dev/openai/apis/openapi.md) · [All operations](https://skmtc.dev/openai/apis/openapi/llms.txt) · [OpenAPI document](https://skmtc.dev/openai/apis/openapi/revisions/ee7bbed1af46?raw)