---
title: "Generate a new HMAC signature secret for a destination"
method: POST
path: "/api/me/destinations/{id}/rotate-secret"
tags: ["me"]
---

# Generate a new HMAC signature secret for a destination

`POST /api/me/destinations/{id}/rotate-secret`

## Request

- Base URL: `https://api.signalraven.ai`
- URL: `https://api.signalraven.ai/api/me/destinations/{id}/rotate-secret`
- Auth: none declared

One-time-reveal rotation. The old secret stops working immediately; customers must re-paste the returned value into their webhook verifier.

## Path parameters

- `id` string, uuid, required

## Response `200`

New secret generated

- object
  - `signatureSecret` string, required

## Other responses

- `404`: Destination not found or not owned by customer

---

[API](https://skmtc.dev/signalraven/apis/zygnal-api.md) · [All operations](https://skmtc.dev/signalraven/apis/zygnal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/signalraven/apis/zygnal-api/revisions/36e1d9b9d604?raw)