---
title: "Rotate the calling application's webhook signing secret"
method: POST
path: "/v1/applications/webhook-secret/rotate"
tags: ["Authentication", "Encryption"]
---

# Rotate the calling application's webhook signing secret

`POST /v1/applications/webhook-secret/rotate`

## Request

- Base URL: `https://idaas.yourflexpay.com/api`
- URL: `https://idaas.yourflexpay.com/api/v1/applications/webhook-secret/rotate`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/reflexpay/apis/idaas-identity-as-a-service-api/docs/v1/applications/webhook-secret/rotate/post.ts> (a function with typed inputs; its response is checked against the schema)

Generates a new webhook signing secret for the authenticated application,
stores only its hash, and returns the raw secret once.

Use the returned `webhookSecret` to verify `X-IDaaS-Signature` on inbound webhooks.
The previous webhook secret becomes invalid immediately.

## Response `200`

Webhook secret rotated - new secret returned once

- ApiResponseApplicationResponse
  - `success` boolean
  - `message` string
  - `errorCode` string
  - `data` ApplicationResponse: Registered application (tenant) details
    - `id` string, uuid: Application UUID
    - `name` string: Human-readable application name
    - `appHandle` string: Short unique slug used as the tag namespace for this application (e.g. 'walletapp'). Tags are addressed as 'localTag@appHandle' across the platform. Immutable once set.
    - `clientId` string: OAuth2-style client identifier (public)
    - `clientSecret` string: Raw client secret – returned ONLY on first registration; never stored in plaintext
    - `active` boolean: Whether this application can still use IDaaS
    - `redirectUris` string: Space-separated list of allowed redirect URIs
    - `transactionWebhookUrl` string: URL that IDaaS POSTs transaction notifications to
    - `webhookSecret` string: Raw webhook signing secret – returned ONLY on first registration. Used to verify X-IDaaS-Signature headers on inbound webhooks via HMAC-SHA256.
    - `metadata` object: Optional free-form metadata (JSON string)
    - `logoUrl` string: Optional URL of the application logo image
    - `appPublicKeyJwk` JwkDto: EC P-256 private key in JWK format (includes 'd'). Returned ONLY on registration and on key rotation. Store securely – this can decrypt payloads encrypted for your application.
      - `kty` string
      - `crv` string
      - `x` string
      - `y` string
      - `use` string
      - `alg` string
      - `d` string
    - `appPrivateJwk` JwkDto: EC P-256 private key in JWK format (includes 'd'). Returned ONLY on registration and on key rotation. Store securely – this can decrypt payloads encrypted for your application.
      - `kty` string
      - `crv` string
      - `x` string
      - `y` string
      - `use` string
      - `alg` string
      - `d` string
    - `encryptionEnabled` boolean: Whether JWE payload encryption is enabled for this application. When true, IDaaS requires encrypted inbound request bodies and encrypts outbound webhooks.
    - `keyVersion` integer: Current keypair version. Incremented on each rotation.
    - `createdAt` string, date-time: ISO-8601 creation timestamp
  - `errors` string[]
  - `timestamp` string, date-time

## Other responses

- `401`: Missing or invalid bearer token
- `404`: Application not found

## Changes

- **2026-04-17** `db1f954badfb`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/reflexpay/apis/idaas-identity-as-a-service-api/changes/v1/applications/webhook-secret/rotate/post.md)

---

[API](https://skmtc.dev/reflexpay/apis/idaas-identity-as-a-service-api.md) - [All operations](https://skmtc.dev/reflexpay/apis/idaas-identity-as-a-service-api/llms.txt) - [OpenAPI document](https://skmtc.dev/reflexpay/apis/idaas-identity-as-a-service-api/revisions/db1f954badfb?raw)