---
title: "Rotate Webhook Secret"
method: POST
path: "/v1/webhooks/{webhook_id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate Webhook Secret

`POST /v1/webhooks/{webhook_id}/rotate-secret`

## Request

- Base URL: `https://api.puntersedge.online`
- URL: `https://api.puntersedge.online/v1/webhooks/{webhook_id}/rotate-secret`
- Auth: API key in header `X-API-Key`

Issue a new signing secret. The old one keeps working for 24 hours.

The new secret is returned once, here. For the next 24 hours every delivery is signed with
both: the new secret in `X-Webhook-Signature` / `X-PuntersEdge-Signature`, the previous one
in `X-Webhook-Signature-Previous` / `X-PuntersEdge-Signature-Previous`, so you can deploy the
new secret to your receiver without missing a delivery.

Delivery is at-least-once: the same event can arrive more than once, so deduplicate on `event_id` (in the body, and sent as the `X-PuntersEdge-Id` and `Idempotency-Key` headers). There is no ordering guarantee between events. Each delivery carries `X-PuntersEdge-Timestamp`, `X-PuntersEdge-Attempt` and two signatures: `X-Webhook-Signature: sha256=<hex>` (HMAC-SHA256 of the raw body with your secret) and `X-PuntersEdge-Signature: t=<unix seconds>,v1=<hex>` (HMAC-SHA256 of `<t>.<raw body>`; refuse a `t` more than 5 minutes from now to block replays). Any 2xx answer is success. A 5xx, 408, 429, timeout or connection failure is retried after 1 min, 5 min, 30 min, 2 h, 6 h (6 tries in all, about 8.5 hours), honouring `Retry-After` up to the next step; any other answer is final. After 10 consecutive undeliverable events, or a day of continuous failure, the subscription is paused and the owner is emailed; POST /v1/webhooks/{id}/resume restarts it with the same secret, and POST /v1/webhooks/{id}/replay re-sends what was missed. The delivery log returns the newest 50 rows unless `limit` says otherwise.

## Path parameters

- `webhook_id` string, required

## Headers

- `X-API-Key` string
- `X-RapidAPI-Proxy-Secret` string

## Response `200`

Successful Response

- WebhookRotateResponse
  - `id` string, required
  - `secret` string, required
  - `previous_secret_expires_at` string, required: Until then every delivery is also signed with the previous secret.

## Other responses

- `401`: Missing or invalid API key. Send `X-API-Key`. See https://puntersedge.online/developers/errors
- `402`: Monthly credit allowance exhausted for this plan. Upgrade at https://puntersedge.online/api/pricing
- `403`: Webhook subscriptions are available on Plus, Business, Platform, Scale and Enterprise plans only. Legacy Growth and Pro keys also qualify.
- `422`: Validation Error
- `429`: Rate limit exceeded for this plan. Honour the `Retry-After` header (seconds) before retrying. See https://puntersedge.online/developers/rate-limits
- `500`: Unexpected server error. Safe to retry with backoff.

---

[API](https://skmtc.dev/puntersedge/apis/puntersedge-odds-api.md) · [All operations](https://skmtc.dev/puntersedge/apis/puntersedge-odds-api/llms.txt) · [OpenAPI document](https://skmtc.dev/puntersedge/apis/puntersedge-odds-api/revisions/f35b6aab1946?raw)