---
title: "Rotate your webhook's signing secret"
method: POST
path: "/webhook/secret/rotate"
tags: ["Webhooks"]
---

# Rotate your webhook's signing secret

`POST /webhook/secret/rotate`

## Request

- Base URL: `https://api.treasuryspring.com/api/v1`
- URL: `https://api.treasuryspring.com/api/v1/webhook/secret/rotate`
- Auth: HTTP bearer

Replace your webhook's signing secret, without missing an event or failing a delivery.

The new secret is returned, once. For the next 24 hours each delivery is signed with both the new and
the previous secret, so you can switch at your own pace; after that, only with the new one. Rotating
again within those 24 hours stops the oldest secret being used straight away.

## Response `200`

The webhook, with its new signing secret

- RotatedWebhookSecret
  - `previousSecretExpiresAt` string, date-time, nullable: While a secret rotation is in progress, when deliveries stop also being signed with the previous secret; null otherwise.
  - `secret` string, required: The new signing secret, returned only this once; store it securely. For the next 24 hours each delivery is signed with both this and the previous secret.
  - `status` WebhookStatus[], required: Delivery status for each type.
    - `disabledReason` 'FAILING' | 'GONE' | 'UNRESTRICTED_VISIBILITY': Why delivery stopped. FAILING: the endpoint failed every attempt for 24 hours. GONE: the endpoint answered 410 Gone. UNRESTRICTED_VISIBILITY: the account can now see every client's data, which webhooks do not serve.
    - `state` 'ACTIVE' | 'DISABLED', required
    - `type` 'EVENT', required: What a webhook delivers. Each type is delivered as its own ordered stream.
  - `types` WebhookDataType[], required: What is delivered.
  - `url` string, required: HTTPS endpoint deliveries are POSTed to.

## Other responses

- `404`: You have no webhook

## Changes

- **2026-10-20** `46eb173a4710`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/treasuryspring/apis/treasuryspring-public-api/changes/webhook/secret/rotate/post.md)

---

[API](https://skmtc.dev/treasuryspring/apis/treasuryspring-public-api.md) - [All operations](https://skmtc.dev/treasuryspring/apis/treasuryspring-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/treasuryspring/apis/treasuryspring-public-api/revisions/ca7be51b723d?raw)