---
title: "Rotate the signing secret"
method: POST
path: "/v0/webhook-configurations/{webhookConfigurationId}/rotate-secret"
tags: ["Webhook Configurations"]
---

# Rotate the signing secret

`POST /v0/webhook-configurations/{webhookConfigurationId}/rotate-secret`

## Request

- Base URL: `https://distributor-api.spiko.io`
- URL: `https://distributor-api.spiko.io/v0/webhook-configurations/{webhookConfigurationId}/rotate-secret`
- Auth: HTTP basic
- TypeScript: <https://skmtc.dev/spiko/apis/spiko-distributor-api/docs/v0/webhook-configurations/:webhookConfigurationId/rotate-secret/post.ts> (a function with typed inputs; its response is checked against the schema)

Generate a new signing secret for an **active** webhook configuration. Both the old and the new secret are accepted for 24 hours, and the new one is returned only in this response. A `disabled` or `circuit-broken` configuration is rejected with `InvalidWebhookConfigurationStateError`: enable it first.

## Path parameters

- `webhookConfigurationId` string, uuid, required: a Universally Unique Identifier

## Response `200`

Success

- object
  - `id` string, uuid, required: a Universally Unique Identifier
  - `distributorId` string, uuid, required: a Universally Unique Identifier
  - `url` string, required
  - `topics` string[], required
  - `signingSecret` string, required
  - `previousSigningSecret` string, nullable, required
  - `secretRotatedAt` string, nullable, required: A valid date within the range 2020-2100
  - `status` 'active' | 'disabled' | 'circuit-broken', required
  - `consecutiveFailures` integer, required
  - `createdAt` string, required: A valid date within the range 2020-2100
  - `updatedAt` string, required: A valid date within the range 2020-2100

## Other responses

- `400`: The webhook configuration is not in a status that allows this transition. `update`, `disable` and `rotate-secret` require an `active` configuration; `enable` requires a `disabled` or `circuit-broken` one. Recovering a `circuit-broken` configuration is therefore `enable` first, then `PUT`. | The request did not match the expected schema
- `401`: Authentication failed. Two bodies are possible: the schema below when the API rejects the credentials, and `{ "error": { "code", "status", "request", "message" } }` when the API gateway rejects them first. Only the former carries a `_tag`.
- `403`: Forbidden
- `404`: NotFound
- `503`: The investor is undergoing a scheduled upgrade, access is temporarily paused to ensure data safety.

---

[API](https://skmtc.dev/spiko/apis/spiko-distributor-api.md) - [All operations](https://skmtc.dev/spiko/apis/spiko-distributor-api/llms.txt) - [OpenAPI document](https://skmtc.dev/spiko/apis/spiko-distributor-api/revisions/ad85137fd00b?raw)