---
title: "Rotate a webhook signing secret"
method: POST
path: "/api/projects/tunnels/{projectId}/webhooks/{webhookId}/secret/rotate"
tags: ["webhooks"]
---

# Rotate a webhook signing secret

`POST /api/projects/tunnels/{projectId}/webhooks/{webhookId}/secret/rotate`

## Request

- Base URL: `https://rstream.io`
- URL: `https://rstream.io/api/projects/tunnels/{projectId}/webhooks/{webhookId}/secret/rotate`
- Auth: HTTP bearer

## Path parameters

- `projectId` string, required
- `webhookId` string, required

## Response `200`

Successful response.

- RotateTunnelsWebhookSecretResponse
  - `id` string, required
  - `workspaceId` string, required
  - `projectId` string, required
  - `name` string, required
  - `description` string, nullable, required
  - `destinationType` 'webhook_endpoint' | 'amazon_eventbridge' | 'azure_event_grid', required
  - `status` 'enabled' | 'disabled', required
  - `events` string[], required
  - `config` union, required
    - object
      - `url` string, uri, required
    - object
      - `eventBusArn` string
      - `region` string
    - object
      - `topicEndpoint` string
  - `secretLastRotatedAt` string, date-time, nullable, required
  - `previousSecretExpiresAt` string, date-time, nullable, required
  - `createdByUserId` string, nullable, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `deletedAt` string, date-time, nullable, required
  - `signingSecret` string, required

## Other responses

- `401`: Authentication is required.
- `403`: The token is not authorized.
- `404`: Webhook not found.

---

[API](https://skmtc.dev/rstream/apis/rstream-api.md) · [All operations](https://skmtc.dev/rstream/apis/rstream-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rstream/apis/rstream-api/revisions/a840a2c91f22?raw)