---
title: "Rotate the signing secret for a webhook endpoint"
method: POST
path: "/webhooks/{id}/rotate"
tags: ["Webhooks"]
---

# Rotate the signing secret for a webhook endpoint

`POST /webhooks/{id}/rotate`

## Request

- Base URL: `https://thesignup.app/api/v1`
- URL: `https://thesignup.app/api/v1/webhooks/{id}/rotate`
- Auth: HTTP bearer

Issues a new signing secret. The previous secret stays valid for 24 hours so receivers can roll over without dropped deliveries.

## Path parameters

- `id` string, uuid, required

## Response `200`

Rotated signing secret

- CreateOrRotateWebhookResponse
  - `endpoint` WebhookEndpoint, required
    - `id` string, uuid, required
    - `url` string, uri, required
    - `description` string, nullable, required
    - `eventTypes` string[], required: Subscription filter. Empty array = subscribe to every event type the platform emits today and in the future.
    - `paused` boolean, required
    - `pausedReason` string, nullable, required
    - `pausedAt` string, date-time, nullable, required
    - `consecutiveFailures` integer, required
    - `lastSuccessAt` string, date-time, nullable, required
    - `lastFailureAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `signingSecret` string, required: Plaintext signing secret. Surfaced exactly once — store it immediately. Subsequent reads only return the endpoint metadata; rotate via `POST /v1/webhooks/{id}/rotate`.

## Other responses

- `401`: Unauthenticated — credentials missing, malformed, invalid, or revoked
- `404`: Not found
- `429`: Rate limited or daily ceiling exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/thesignup/apis/thesignup-api.md) · [All operations](https://skmtc.dev/thesignup/apis/thesignup-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thesignup/apis/thesignup-api/revisions/c6da7cf92172?raw)