---
title: "Rotate the signing secret"
method: POST
path: "/api/webhook/rotate"
tags: ["Webhooks"]
---

# Rotate the signing secret

`POST /api/webhook/rotate`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/api/webhook/rotate`
- Auth: HTTP bearer

Deliberately separate from repointing the URL. Rotation breaks every receiver that has not been
updated, so it must be an explicit act rather than a side effect of editing a field. There is
no overlap window: the new secret applies to the next delivery.

## Response `200`

The new secret.

- object
  - `secret` string

## Other responses

- `401`: No valid session
- `404`: Resource absent or belongs to another workspace

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)