---
title: "Rotate the HMAC signing secret for a webhook endpoint"
method: POST
path: "/v2/webhooks/{endpoint_id}/rotate-secret"
tags: ["webhooks-v2"]
---

# Rotate the HMAC signing secret for a webhook endpoint

`POST /v2/webhooks/{endpoint_id}/rotate-secret`

## Request

- Base URL: `https://api.tracklysms.com/api`
- URL: `https://api.tracklysms.com/api/v2/webhooks/{endpoint_id}/rotate-secret`
- Auth: API key in header `X-Api-Key`

Rotate the HMAC signing secret. The old secret remains accepted for 24h via X-Trackly-Signature-Prev so receivers can swap over.

## Response `200`

Success

---

[API](https://skmtc.dev/tracklysms/apis/trackly-sms-api.md) · [All operations](https://skmtc.dev/tracklysms/apis/trackly-sms-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tracklysms/apis/trackly-sms-api/revisions/ac1ad22cb2a9?raw)