---
title: "Rotate webhook secret"
method: POST
path: "/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate webhook secret

`POST /webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://shipmail.to/api/v1`
- URL: `https://shipmail.to/api/v1/webhooks/{id}/rotate-secret`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://shipmail.to/api/auth/oauth2/authorize`, token URL `https://shipmail.to/api/auth/oauth2/token`)

Generate a new signing secret. The previous secret remains valid for 24 hours.

## Headers

- `X-Shipmail-Organization` string

## Response `200`

New secret generated.

- RotateSecretResponse
  - `secret` string, required: New HMAC signing secret.
  - `previous_secret_expires_at` string, date-time, required: When the previous secret stops being accepted (24-hour grace period).

## Other responses

- `404`: Resource not found.
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/shipmail/apis/shipmail-api.md) · [All operations](https://skmtc.dev/shipmail/apis/shipmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shipmail/apis/shipmail-api/revisions/2c23e59d7e30?raw)