---
title: "Rotate Operational Webhook Endpoint Secret"
method: POST
path: "/api/v1/operational-webhook/endpoint/{endpoint_id}/secret/rotate"
tags: ["Webhook Endpoint"]
---

# Rotate Operational Webhook Endpoint Secret

`POST /api/v1/operational-webhook/endpoint/{endpoint_id}/secret/rotate`

## Request

- Base URL: `https://api.eu.svix.com`
- URL: `https://api.eu.svix.com/api/v1/operational-webhook/endpoint/{endpoint_id}/secret/rotate`
- Auth: HTTP bearer

Rotates an operational webhook endpoint's signing secret.

The previous secret will remain valid for the specified grace period (default 24 hours).

## Path parameters

- `endpoint_id` string, required: The Endpoint's ID or UID.

## Headers

- `idempotency-key` string

## Request body

- OperationalWebhookEndpointSecretIn
  - `gracePeriodSeconds` integer, nullable: How long the old secret will be valid for, in seconds. Valid values are between 0 (immediate expiry) and 7 days. The default is 24 hours.
  - `key` string, nullable: The endpoint's verification secret. Format: `base64` encoded random bytes optionally prefixed with `whsec_`. It is recommended to not set this and let the server generate the secret.

## Response `204`

no content

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict
- `422`: Validation Error
- `429`: Too Many Requests

## Changes

- **2026-10-19** `cca56e67e5a4`: 1 info
  - added the required property `code` to the response with the `422` status
- **2026-08-19** `dc130bd1b074`: 1 info
  - added the new optional request property `gracePeriodSeconds`

[Operation history](https://skmtc.dev/svix/apis/svix-api/changes/api/v1/operational-webhook/endpoint/:endpoint_id/secret/rotate/post.md)

---

[API](https://skmtc.dev/svix/apis/svix-api.md) - [All operations](https://skmtc.dev/svix/apis/svix-api/llms.txt) - [OpenAPI document](https://skmtc.dev/svix/apis/svix-api/revisions/21bb0f86a732?raw)