---
title: "Rotate the source's URL"
method: POST
path: "/alert-sources/{source}/rotate-token"
tags: ["Alert sources"]
---

# Rotate the source's URL

`POST /alert-sources/{source}/rotate-token`

## Request

- Base URL: `https://api.spectate.net/v1`
- URL: `https://api.spectate.net/v1/alert-sources/{source}/rotate-token`
- Auth: HTTP bearer

Gives the source a new secret `webhook_url` (and `email_address`); the old ones stop working
at once, so update the tool right after.

## Path parameters

- `source` string, uuid, required

## Response `200`

The source with its new URL.

- AlertSource: An alert source: an external tool (Prometheus Alertmanager, Grafana, Sentry, a script…) whose requests to `webhook_url`, or mails to `email_address`, fire and resolve alerts. The URL and address contain the source's secret token: whoever has them can fire alerts.
  - `id` string, uuid, required: Alert source ID
  - `name` string, required: Name shown on its alerts
  - `type` 'webhook' | 'email' | 'alertmanager' | 'grafana' | 'sentry', required: The external tool behind an alert source; decides how its requests are read. | | |---| | `webhook` <br/> Spectate's own JSON format, for scripts, CI and anything that can call a URL. | | `email` <br/> Emails to the source's own address (subject becomes the alert). | | `alertmanager` <br/> Prometheus Alertmanager `webhook_configs`. | | `grafana` <br/> Grafana Alerting webhook contact point (Alertmanager format plus Grafana links). | | `sentry` <br/> Sentry internal integration webhooks (SaaS and self-hosted), or the legacy WebHooks plugin. |
  - `enabled` boolean, required: Whether requests fire alerts; a disabled source rejects them
  - `webhook_url` string, uri, required: Where the tool sends its webhooks. Secret: rotate it with `rotateAlertSourceToken` if it leaks
  - `email_address` string, email, nullable, required: `email` sources: the address to send mails to. Secret like the URL
  - `has_secret` boolean, required: Whether a signing secret is set (Sentry client secret, Grafana HMAC secret, Alertmanager bearer token); it's never returned
  - `default_severity` 'critical' | 'high' | 'medium' | 'low', required: How urgent an alert or incident is. Escalation paths can branch on it. | | |---| | `critical` <br/> Customers are affected right now. | | `high` <br/> Serious, needs attention soon. | | `medium` <br/> Should be looked at. | | `low` <br/> Informational. |
  - `auto_resolve_minutes` integer, nullable, required: Minutes after which an alert the tool stopped repeating resolves; `null` keeps it until the tool resolves it
  - `settings` AlertSourceSettings, required: Settings of some source types; the others ignore them.
    - `alert_on_new_issues` boolean, nullable, required: Sentry: also alert on every new issue (issue `created` webhooks), not only on alert rules
    - `signature_header` string, nullable, required: Grafana: the header carrying the HMAC signature; `null` means `X-Grafana-Alerting-Signature`
    - `timestamp_header` string, nullable, required: Grafana: the timestamp header, when the contact point signs `{timestamp}:{body}`
  - `project_id` string, uuid, nullable, required: The project whose escalation paths apply when the source has none of its own; `null` for none
  - `escalation_paths` EscalationPathReference[], required: Escalation paths the source's alerts follow. Empty: the project's paths, else the team's default path
    - `id` string, uuid, required: Escalation path ID
    - `name` string, required: Escalation path name
  - `last_event_at` string, date-time, nullable, required: When the source last received a request
  - `events_count` integer, required: Requests the source has received in total
  - `firing_alerts_count` integer, required: Alerts of the source that are firing now
  - `created_at` string, date-time, required: When the source was created

## Other responses

- `401`: `UNAUTHENTICATED`: no token was sent. `INVALID_TOKEN`: the token is unknown or revoked. `TOKEN_EXPIRED`: the token has expired.
- `403`: `FORBIDDEN`: the token lacks an ability this endpoint requires (listed in `details.required_abilities`). `TEAM_PENDING_DELETION`: the team is scheduled for deletion. `TEAM_SUSPENDED`: Spectate suspended the team.
- `404`: `RESOURCE_NOT_FOUND`: there is no such resource in this team.
- `429`: `RATE_LIMITED`: too many requests for this token. Wait for the number of seconds in `Retry-After`.

---

[API](https://skmtc.dev/spectate/apis/spectate-api.md) - [All operations](https://skmtc.dev/spectate/apis/spectate-api/llms.txt) - [OpenAPI document](https://skmtc.dev/spectate/apis/spectate-api/revisions/9b1a233997de?raw)