---
title: "Store the event source's signing secret"
method: PUT
path: "/v1/event-sources/{source}/signing-secret"
tags: ["event-sources"]
---

# Store the event source's signing secret

`PUT /v1/event-sources/{source}/signing-secret`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/event-sources/{source}/signing-secret`
- Auth: HTTP bearer

Saves the signing secret from the outside system's dashboard, encrypted at rest. Until it is set, the endpoint refuses every event: a payload we cannot verify is one we must not act on. The secret is never returned by any endpoint.

## Path parameters

- `source` string, required

## Headers

- `X-Tenant-Id` string, nullable

## Request body

- EventSourceSecretUpdate: The signing secret from the vendor's dashboard. Write-only.
  - `signing_secret` string, required

## Response `200`

Successful Response

- EventSourceView: One connected system, as the dashboard sees it.
  - `source` string, required
  - `label` string, required
  - `status` string, required
  - `secret_configured` boolean, required
  - `last_event_at` string, date-time, nullable, required

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden. Inspect response body `code` for the specific reason (for example: PERMISSION_DENIED, EMAIL_NOT_VERIFIED, TENANT_ACCESS_REQUIRED, ROLE_UNRESOLVED)
- `404`: Not found
- `409`: Conflict
- `422`: Validation error

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)