---
title: "New signing secret"
method: POST
path: "/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# New signing secret

`POST /webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://mcp.senders.ai/api/v1`
- URL: `https://mcp.senders.ai/api/v1/webhooks/{id}/rotate-secret`
- Auth: HTTP bearer

Scope: webhooks:manage. Returned once. The old secret keeps signing X-Senders-Signature-Previous for 24 hours.

## Path parameters

- `id` integer, required

## Headers

- `Idempotency-Key` string, required

## Response `200`

OK

- object
  - `data` object
    - `id` integer
    - `secret` string
    - `previous_secret_valid_until` string, date-time
  - `note` string

## Other responses

- `400`: Invalid body or missing Idempotency-Key (bad_request, idempotency_key_required)
- `401`: Missing, wrong or revoked token
- `403`: Missing write permission, inactive account, or feature not enabled
- `404`: No such webhook on this account
- `409`: busy, conflict, idempotency_in_progress (retry) or a final conflict such as campaign_closed
- `413`: Body over 1 MB
- `415`: Body not JSON
- `422`: Idempotency-Key reused for a different request
- `429`: Rate or daily limit
- `503`: Writes paused because rate limiting is unavailable; retry after Retry-After

---

[API](https://skmtc.dev/senders/apis/senders-rest-api.md) · [All operations](https://skmtc.dev/senders/apis/senders-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/senders/apis/senders-rest-api/revisions/3cd9960bc0af?raw)