---
title: "Rotate a webhook secret"
method: POST
path: "/v1/webhooks/{id}/rotate-secret"
tags: ["webhooks"]
---

# Rotate a webhook secret

`POST /v1/webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://api.pomerado.ai`
- URL: `https://api.pomerado.ai/v1/webhooks/{id}/rotate-secret`
- Auth: HTTP bearer

Replace one of your webhooks' signing secret and return the new one once.

For 24 hours each delivery is signed with both secrets (two webhook-signature entries), so your receiver can switch without missing an event.

## Path parameters

- `id` string, required

## Response `200`

The webhook and its new one-time secret

- WebhookWithSecret
  - `id` string, required: a webhook ID: wh_ and 32 lowercase hex digits
  - `created_by` WebhookCreator, required: The member who made the webhook. Only they can change, test or rotate it, and it carries events for the jobs they can see
    - `user_id` string, required: The member's user ID
    - `email` string, nullable, required: The email they sign in with, or null when the account no longer has it
  - `url` string, required
  - `events` string[], required
  - `status` 'active' | 'disabled', required
  - `disabled_reason` 'manual' | 'gone' | 'unreachable' | 'secret_unreadable', nullable, required: Why a disabled webhook sends nothing: manual (turned off), gone (its receiver answered 410), unreachable (20 failed deliveries in a row) or secret_unreadable (rotate its secret)
  - `created_at` string, required: a string to be decoded into a Date
  - `last_delivery_at` string, required: a string to be decoded into a Date
  - `secret` string, required: The Standard Webhooks signing secret (whsec_…), shown only in this response. Verify each delivery's webhook-signature with it.

## Other responses

- `400`: invalid_request
- `401`: unauthorized, reauthentication_required
- `403`: webhooks_unavailable, forbidden
- `404`: not_found
- `500`: internal_error
- `503`: temporarily_unavailable

---

[API](https://skmtc.dev/pomerado/apis/pomerado-api.md) · [All operations](https://skmtc.dev/pomerado/apis/pomerado-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pomerado/apis/pomerado-api/revisions/48dac2a3143e?raw)