---
title: "Rotate a webhook secret"
method: POST
path: "/v1/webhook_endpoints/{id}/rotate_secret"
tags: ["Webhooks"]
---

# Rotate a webhook secret

`POST /v1/webhook_endpoints/{id}/rotate_secret`

## Request

- Base URL: `https://api.tryleap.ai`
- URL: `https://api.tryleap.ai/v1/webhook_endpoints/{id}/rotate_secret`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer

Makes a new signing secret and returns it, shown only here. For 24 hours the old secret signs too, as a second signature in `webhook-signature`, so you can deploy the new one without dropping events. Rotating again within those 24 hours drops the oldest.

Needs an API key with the `generations:write` scope.

## Path parameters

- `id` string, required: The endpoint's ID, `we_...`.

## Response `200`

The endpoint, with its new signing secret.

- WebhookEndpointWithSecret: An endpoint with its signing secret, as create and rotate_secret return it.
  - `id` string, required: The endpoint's ID, `we_...`.
  - `object` 'webhook_endpoint', required
  - `url` string, required: Where Leap POSTs events.
  - `description` string, nullable, required: Your note, if any.
  - `events` string[], required: The event types it gets; ["*"] for every type, including types added later.
  - `disabled` boolean, required: Whether deliveries to it are stopped.
  - `disabled_reason` string, nullable, required: Why Leap disabled the endpoint, such as every delivery failing for 72 hours; null when it is on or you turned it off.
  - `created_at` string, date-time, required: When it was created.
  - `updated_at` string, date-time, required: When it last changed.
  - `secret` string, required: The signing secret, whsec_ and base64. Shown only here: keep it in your server's environment.

## Other responses

- `400`: `conflicting_credentials`
- `401`: `authentication_required`
- `403`: `permission_denied`
- `404`: `resource_not_found`
- `429`: `rate_limit_exceeded`

---

[API](https://skmtc.dev/tryleap/apis/leap-api.md) · [All operations](https://skmtc.dev/tryleap/apis/leap-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tryleap/apis/leap-api/revisions/c01f98d3e835?raw)