---
title: "Rotate a webhook endpoint’s signing secret"
method: POST
path: "/api/v1/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate a webhook endpoint’s signing secret

`POST /api/v1/webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://app.reachium.io`
- URL: `https://app.reachium.io/api/v1/webhooks/{id}/rotate-secret`
- Auth: HTTP bearer

Invalidates the old secret. The new plaintext secret is returned exactly once, here.

## Path parameters

- `id` string, required

## Response `200`

Rotated.

- object
  - `data` object, required
    - `secret` string, required
  - `error` unknown, required

## Other responses

- `401`: Missing or invalid API key. Send `Authorization: Bearer rmcp_...` (code unauthorized).
- `402`: Workspace billing is blocked; mutating requests are refused (code billing_blocked).
- `403`: The key's granted scopes do not satisfy this endpoint's minimum required scope (code insufficient_scope).
- `404`: No such webhook endpoint in this workspace (code not_found).
- `429`: Rate limited: shared `mcp:ip:{ip}` (600/60s) or `mcp:key:{keyId}` (120/60s) bucket, the SAME buckets the MCP endpoint uses (code rate_limited).
- `500`: Rotate failed (code internal_error).
- `503`: The billing-status check itself failed (DB error): fails closed rather than letting a blocked workspace through; safe to retry (code billing_check_failed).

---

[API](https://skmtc.dev/reachium/apis/reachium-api.md) · [All operations](https://skmtc.dev/reachium/apis/reachium-api/llms.txt) · [OpenAPI document](https://skmtc.dev/reachium/apis/reachium-api/revisions/30c16b30b499?raw)