---
title: "Rotate a webhook signing secret"
method: POST
path: "/v1/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate a webhook signing secret

`POST /v1/webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://www.postquick.ai/api`
- URL: `https://www.postquick.ai/api/v1/webhooks/{id}/rotate-secret`
- Auth: HTTP bearer

Generate a new signing secret for an endpoint. Returns plaintext EXACTLY ONCE. The old secret is invalidated immediately — in-flight deliveries signed with it will fail signature verification on the receiver. For zero-downtime rotation, register a second endpoint with a new secret, migrate traffic, then delete the original.

## Path parameters

- `id` string, uuid, required

## Response `200`

Rotated. Response includes the new plaintext signing secret.

- object
  - `success` true, required
  - `data` object, required
    - `endpoint` object, required: A registered webhook endpoint.
      - `id` string, uuid, required
      - `app_id` string, uuid, required
      - `url` string, uri, required
      - `events` string[], required: Subscribed events (e.g. ["post.partial"]) or ["*"] for all.
      - `active` boolean, required
      - `secret_preview` string, required: First 8 chars of the signing secret. Useful for identifying which secret an endpoint uses without exposing it.
      - `consecutive_failures` integer, required: Count of consecutive failed deliveries. Auto-disables the endpoint at 50; resets to 0 on the first 2xx response.
      - `created_at` string, date-time, required
      - `updated_at` string, date-time, required
    - `secret` string, required
    - `secret_notice` string, required

---

[API](https://skmtc.dev/postquick/apis/postquickai-api.md) · [All operations](https://skmtc.dev/postquick/apis/postquickai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postquick/apis/postquickai-api/revisions/d9bc2bcf3042?raw)