---
title: "Rotate the signing secret"
method: POST
path: "/api/v1/webhook-endpoints/{endpoint_id}/rotate-secret"
tags: ["Webhook endpoints"]
---

# Rotate the signing secret

`POST /api/v1/webhook-endpoints/{endpoint_id}/rotate-secret`

## Request

- Base URL: `https://api.sudomock.com`
- URL: `https://api.sudomock.com/api/v1/webhook-endpoints/{endpoint_id}/rotate-secret`
- Auth: API key in header `x-api-key`

Generate a new secret, returned in FULL once.

## Path parameters

- `endpoint_id` string, required: Id of the endpoint whose signing secret is replaced.

## Response `200`

Successful Response

- WebhookEndpointSecretResponse: Returned ONLY by create + rotate-secret: the FULL plaintext secret. Overrides the masked `secret` field with the real value (shown once).
  - `id` string, required: Unique identifier for the webhook endpoint.
  - `url` string, required: The https URL that receives this endpoint's events.
  - `secret` string, required: FULL signing secret. Shown only once.
  - `description` string, nullable: Your label for this endpoint.
  - `event_types` string[]: Event types this endpoint receives; an empty list means every event.
  - `enabled` boolean, required: Whether this endpoint currently receives events.
  - `event_naming` string: The event-name spelling this endpoint is pinned to: 'legacy' or 'current'.
  - `created_at` string, date-time, required: Time the endpoint was created.
  - `updated_at` string, date-time, nullable: Time the endpoint was last updated.

---

[API](https://skmtc.dev/sudomock/apis/sudomock-api.md) · [All operations](https://skmtc.dev/sudomock/apis/sudomock-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sudomock/apis/sudomock-api/revisions/c1cc24006c60?raw)