---
title: "Rotate the signing secret"
method: POST
path: "/v0/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate the signing secret

`POST /v0/webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://api.schedulin.app`
- URL: `https://api.schedulin.app/v0/webhooks/{id}/rotate-secret`
- Auth: one of:
  - API key in header `x-api-key`
  - OAuth 2 (authorization code, authorization URL `https://api.schedulin.app/oauth/authorize`, token URL `https://api.schedulin.app/oauth/token`, scopes: `webhooks:write`)

Generate a new signing secret for the endpoint and return it ONCE. The old secret stops signing immediately.

## Path parameters

- `id` string, required

## Request body

- object

## Response `200`

OK

- WebhookEndpoint
  - `id` string, required
  - `url` string, required
  - `secret` string, required
  - `events` string[], required
  - `description` string, nullable, required
  - `enabled` boolean, required
  - `consecutiveFailures` integer, required
  - `lastSuccessAt` string, date-time, nullable, required
  - `lastFailureAt` string, date-time, nullable, required
  - `disabledAt` string, date-time, nullable, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: Bad Request — the request isn't allowed in the resource's current state (e.g. editing a published post).
- `401`: Unauthorized — missing or invalid API key / access token.
- `403`: Forbidden — the credential lacks the required scope or access.
- `404`: Not Found
- `409`: Conflict
- `422`: Unprocessable request. Schema validation failures have `code: "INPUT_VALIDATION_FAILED"` and `data.fieldErrors` mapping each invalid field to its messages (nested issues name their full path, e.g. `media[0].url: ...`). Business-rule rejections (e.g. a `scheduledAt` in the past) have `code: "UNPROCESSABLE_CONTENT"` and carry the reason in `data.message` and `data.formErrors`.
- `429`: Rate limit exceeded. Wait `Retry-After` seconds before retrying.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/schedulin/apis/schedulin-api.md) · [All operations](https://skmtc.dev/schedulin/apis/schedulin-api/llms.txt) · [OpenAPI document](https://skmtc.dev/schedulin/apis/schedulin-api/revisions/17e886f3bcf3?raw)