---
title: "Rotate webhook signing secret"
method: POST
path: "/agent/v1/webhook-secret/rotate"
tags: ["Agent"]
---

# Rotate webhook signing secret

`POST /agent/v1/webhook-secret/rotate`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/webhook-secret/rotate`
- Auth: API key in header `SIGN-IN-WITH-X`

Generates a fresh HMAC signing secret. Returned EXACTLY once in webhook_signing_secret. Previous secret remains valid for 24 hours (dual-secret grace). Requires operator_passkey assurance.

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `201`

Secret rotated

- object
  - `webhook_signing_secret` string: Plaintext — store immediately, will not be shown again
  - `rotated_at` string, date-time
  - `grace_window_hours` integer
  - `note` string

## Other responses

- `403`: operator_passkey assurance required
- `404`: Agent contact not found

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)