---
title: "Rotate signing secret"
method: POST
path: "/v2/organizations/{organizationId}/webhooks/{endpointId}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate signing secret

`POST /v2/organizations/{organizationId}/webhooks/{endpointId}/rotate-secret`

## Request

- Base URL: `https://api.pdfs.build`
- URL: `https://api.pdfs.build/v2/organizations/{organizationId}/webhooks/{endpointId}/rotate-secret`
- Auth: HTTP bearer

Replaces the endpoint's secret. The new secret is returned exactly once. Requires a paid plan.

## Response `200`

The endpoint and its new secret.

- WebhookEndpointWithSecret
  - `endpoint` WebhookEndpoint, required
    - `id` string, required
    - `organizationId` string, required
    - `url` string, uri, required
    - `enabled` boolean, required
    - `description` string, nullable, required
    - `createdAt` string, required: UTC, ISO 8601 without a timezone suffix.
    - `updatedAt` string, required: UTC, ISO 8601 without a timezone suffix.
  - `secret` string, required: Standard Webhooks signing secret (`whsec_` + base64). Shown once; store it now.

## Other responses

- `401`: Missing, invalid or expired API key.
- `403`: `plan_gated` (webhooks need a paid plan) or `organization_scope_mismatch`.
- `404`: `not_found` — no such endpoint in this organization.

---

[API](https://skmtc.dev/pdfs/apis/pdfs-build-api.md) · [All operations](https://skmtc.dev/pdfs/apis/pdfs-build-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pdfs/apis/pdfs-build-api/revisions/1c7340b9521d?raw)