---
title: "Rotate signing secret"
method: POST
path: "/v1/webhooks/rotate-secret"
tags: ["Webhooks"]
---

# Rotate signing secret

`POST /v1/webhooks/rotate-secret`

## Request

- Base URL: `https://api.totalis.trade`
- URL: `https://api.totalis.trade/v1/webhooks/rotate-secret`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`
- TypeScript: <https://skmtc.dev/totalistrading/apis/totalis-rfq-api/docs/v1/webhooks/rotate-secret/post.ts> (a function with typed inputs; its response is checked against the schema)

Mint a fresh HMAC signing secret, returned ONCE (stored encrypted, never retrievable again). Requires an existing endpoint (set a URL first). Deliveries signed with the old secret stop verifying immediately.

## Query parameters

- `owner_kind` 'user' | 'mm'

## Response `200`

OK

- object
  - `data` object
    - `signing_secret` string: The new secret (`whsec_...`). Shown only once.

## Other responses

- `404`: Resource not found

## Changes

- **2026-06-30** `3957e92c7732`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/totalistrading/apis/totalis-rfq-api/changes/v1/webhooks/rotate-secret/post.md)

---

[API](https://skmtc.dev/totalistrading/apis/totalis-rfq-api.md) - [All operations](https://skmtc.dev/totalistrading/apis/totalis-rfq-api/llms.txt) - [OpenAPI document](https://skmtc.dev/totalistrading/apis/totalis-rfq-api/revisions/bd5823107170?raw)