---
title: "Issues a new signing secret for the endpoint and returns it once. The previous secret keeps signing alongside it until it expires."
method: POST
path: "/api/v1/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Issues a new signing secret for the endpoint and returns it once. The previous secret keeps signing alongside it until it expires.

`POST /api/v1/webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://api.owlsinsight.com`
- URL: `https://api.owlsinsight.com/api/v1/webhooks/{id}/rotate-secret`
- Auth: HTTP bearer

Issues a new signing secret for the endpoint and returns it once. The previous secret keeps signing alongside it until it expires.

While the previous secret is live, Owls-Signature carries two v1 values, one per secret. Accept either, then switch your receiver to the new secret.

## Path parameters

- `id` string, required

## Request body

- RotateWebhookSecretParams
  - `expire_previous_after_hours` number, double: How long the previous secret keeps signing beside the new one: 0 to 168 hours (default 24). 0 retires it at once.

## Response `200`

OK

- WebhookRotateSecretResponse
  - `data` WebhookRotatedSecret
    - `id` string
    - `previous_secret_expires_at` string, nullable: Until when the previous secret keeps signing (ISO 8601), or null when it was retired at once.
    - `secret` string: The new signing secret, `whsec_...`. Returned once: store it now.
    - `secret_hint` string
  - `success` boolean

---

[API](https://skmtc.dev/owlsinsight/apis/owls-insight-api.md) · [All operations](https://skmtc.dev/owlsinsight/apis/owls-insight-api/llms.txt) · [OpenAPI document](https://skmtc.dev/owlsinsight/apis/owls-insight-api/revisions/76c1ea016ff1?raw)