---
title: "Rotate a webhook signing secret"
method: POST
path: "/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate a webhook signing secret

`POST /webhooks/{id}/rotate-secret`

Rotates the endpoint's signing secret. The previous secret keeps signing for a 24h grace window so consumers can update without missing deliveries. Returns the new secret ONCE. Requires the webhooks.manage permission; league-scoped endpoints additionally require current league ADMIN membership and the webhooks feature on the league owner's plan.

## Path parameters

- `id` string, required — Webhook endpoint id.

## Response `200`

The new one-time signing secret.

- WebhookSecret — One-time signing-secret reveal (create/rotate).
  - `id` string, required — The endpoint id the secret belongs to.
  - `signingSecret` string, required — Plaintext signing secret. Shown ONCE - store it now.
  - `secretPrefix` string, required — First 8 chars of the new signing secret.

## Other responses

- `400` — Bad request (invalid body, cursor, limit, or date).
- `401` — Missing or invalid API key.
- `403` — API key lacks the required permission.
- `404` — Resource not found.
- `429` — Rate limited.

## Changes

- **2026-06-05** `0795b89c0172` — 1 info
  - endpoint added
- **2026-06-04** `f22bd61fd595` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/teambattles/apis/teambattles-api/changes/webhooks/:id/rotate-secret/post.md)

---

[API](https://skmtc.dev/teambattles/apis/teambattles-api.md) · [All operations](https://skmtc.dev/teambattles/apis/teambattles-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/teambattles/teambattles-api/revisions/2ffe8fb53b7d/schema)