---
title: "Rotate the signing secret"
method: POST
path: "/v1/channels/{id}/rotate-secret"
tags: ["Alerts"]
---

# Rotate the signing secret

`POST /v1/channels/{id}/rotate-secret`

## Request

- Base URL: `https://api.rumoro.dev`
- URL: `https://api.rumoro.dev/v1/channels/{id}/rotate-secret`
- Auth: HTTP bearer

Gives a webhook channel a new signing secret, shown only in this response. The old secret stops working at once.

## Path parameters

- `id` string, required: The channel's id (dest_...).

## Response `200`

The new signing secret, shown only now. The old one stops working right away.

- union
  - SlackChannel
    - `id` string, required: The channel's id (dest_...).
    - `label` string, required
    - `stats` object, required: Counted from this workspace's deliveries.
      - `alerts` integer, required: Number of alerts using this channel.
      - `activeAlerts` integer, required: How many of them are enabled. At 0 the channel currently gets nothing.
      - `lastDeliveryAt` string, nullable, required: Time of the latest delivery attempt, whether it worked or not.
      - `last7d` object, required: Deliveries over the past 7 days.
        - `total` integer, required
        - `failed` integer, required
    - `createdAt` string, required: UTC time in ISO 8601.
    - `kind` 'slack', required
    - `config` object, required
      - `channelId` string, required: The Slack channel's id.
      - `channelName` string, required: The Slack channel's name, without #.
      - `events` string[], required: Attention events this channel gets directly, without a rule. Each sends one short message when an item opens (see GET /v1/attention). Empty when there are none.
  - EmailChannel
    - `id` string, required: The channel's id (dest_...).
    - `label` string, required
    - `stats` object, required: Counted from this workspace's deliveries.
      - `alerts` integer, required: Number of alerts using this channel.
      - `activeAlerts` integer, required: How many of them are enabled. At 0 the channel currently gets nothing.
      - `lastDeliveryAt` string, nullable, required: Time of the latest delivery attempt, whether it worked or not.
      - `last7d` object, required: Deliveries over the past 7 days.
        - `total` integer, required
        - `failed` integer, required
    - `createdAt` string, required: UTC time in ISO 8601.
    - `kind` 'email', required
    - `config` object, required
      - `recipients` object[], required: All addresses on the list, each with its confirmation.
        - `email` string, required
        - `confirmedAt` string, nullable, required: Null until the address is confirmed with its link. Addresses that are not confirmed get nothing.
      - `events` string[], required: Attention events this channel gets directly, without a rule. Each sends one short message when an item opens (see GET /v1/attention). Empty when there are none.
  - WebhookChannel
    - `id` string, required: The channel's id (dest_...).
    - `label` string, required
    - `stats` object, required: Counted from this workspace's deliveries.
      - `alerts` integer, required: Number of alerts using this channel.
      - `activeAlerts` integer, required: How many of them are enabled. At 0 the channel currently gets nothing.
      - `lastDeliveryAt` string, nullable, required: Time of the latest delivery attempt, whether it worked or not.
      - `last7d` object, required: Deliveries over the past 7 days.
        - `total` integer, required
        - `failed` integer, required
    - `createdAt` string, required: UTC time in ISO 8601.
    - `kind` 'webhook', required
    - `config` object, required
      - `url` string, required: The URL that receives the signed POST requests.
      - `headers` object, required: Additional headers you set for each request.
      - `events` string[], required: Account events this endpoint gets directly, without a rule. These are keyword and wallet changes and the attention events. Empty when there are none. Mentions and digests still arrive through rules.
      - `secret` string: Returned only when the channel is created or the secret rotated. It signs each request. X-Mentions-Signature-V2 holds v2= followed by the hex HMAC-SHA256 of "<X-Mentions-Timestamp>.<raw body>". Reject timestamps more than a few minutes old. X-Mentions-Signature, the hex HMAC-SHA256 of the raw body only, is still sent for older verifiers.
  - TelegramChannel
    - `id` string, required: The channel's id (dest_...).
    - `label` string, required
    - `stats` object, required: Counted from this workspace's deliveries.
      - `alerts` integer, required: Number of alerts using this channel.
      - `activeAlerts` integer, required: How many of them are enabled. At 0 the channel currently gets nothing.
      - `lastDeliveryAt` string, nullable, required: Time of the latest delivery attempt, whether it worked or not.
      - `last7d` object, required: Deliveries over the past 7 days.
        - `total` integer, required
        - `failed` integer, required
    - `createdAt` string, required: UTC time in ISO 8601.
    - `kind` 'telegram', required
    - `config` object, required
      - `chatId` string, required: The Telegram chat's id.
      - `chatType` 'private' | 'group' | 'supergroup' | 'channel', required
      - `events` string[], required: Attention events this channel gets directly, without a rule. Each sends one short message when an item opens (see GET /v1/attention). Empty when there are none.

## Other responses

- `401`: The API key is missing or not valid
- `404`: No webhook channel with this id

---

[API](https://skmtc.dev/rumoro/apis/rumoro-api.md) · [All operations](https://skmtc.dev/rumoro/apis/rumoro-api/llms.txt) · [OpenAPI document](https://skmtc.dev/rumoro/apis/rumoro-api/revisions/9ef63ea894d1?raw)