---
title: "Rotate signing secret"
method: POST
path: "/v1/communities/{communityId}/webhooks/{webhookId}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate signing secret

`POST /v1/communities/{communityId}/webhooks/{webhookId}/rotate-secret`

## Request

- Base URL: `https://api.subo.ai`
- URL: `https://api.subo.ai/v1/communities/{communityId}/webhooks/{webhookId}/rotate-secret`
- Auth: API key in header `X-API-Key`

Issue a new signing secret for this webhook. The old secret stops working immediately — update your endpoint to verify with the new secret before rotating.

Returns the new secret once. It cannot be retrieved again.

## Path parameters

- `communityId` string, required
- `webhookId` string, required

## Response `200`

New signing secret (shown once)

- object
  - `data` object
    - `webhook_id` integer
    - `secret_prefix` string
    - `signing_secret` string: Full signing secret — store immediately, not recoverable

## Other responses

- `401`: Invalid or missing API key
- `403`: Forbidden — the key or user lacks permission for this resource or operation
- `404`: Resource not found
- `429`: Rate limit exceeded — wait `retry_after` seconds before retrying. The same value appears in the `Retry-After` header.

---

[API](https://skmtc.dev/subo/apis/subo-api.md) · [All operations](https://skmtc.dev/subo/apis/subo-api/llms.txt) · [OpenAPI document](https://skmtc.dev/subo/apis/subo-api/revisions/12eab2ae4505?raw)