---
title: "Rotate an endpoint signing secret"
method: POST
path: "/v1/webhook-endpoints/{id}/rotate-secret"
tags: ["Account"]
---

# Rotate an endpoint signing secret

`POST /v1/webhook-endpoints/{id}/rotate-secret`

## Request

- Base URL: `https://api.ufcalendar.com`
- URL: `https://api.ufcalendar.com/v1/webhook-endpoints/{id}/rotate-secret`
- Auth: HTTP bearer

Pro and above. Issues a fresh `whsec_` secret for the endpoint and returns it ONCE, keeping the endpoint id and its delivery history. The previous secret stops verifying the moment this returns, so deploy the new one to your receiver first (or accept both during the cutover). Use this instead of delete-and-recreate when a secret leaks.

## Path parameters

- `id` integer, required

## Response `200`

Rotated — includes the new one-time secret

- WebhookEndpointCreatedResponse
  - `data` WebhookEndpointCreated, required
    - `id` integer, required
    - `url` string, required
    - `events` WebhookKind[], required
    - `secret` string, required: `whsec_…` — shown ONCE. HMAC-SHA256 key for `X-UFCalendar-Signature`.
  - `meta` EmptyMeta, required: `meta` is always present; `{}` when the endpoint has nothing to add.
    - `ignored_params` string[]: Present only when the request carried query parameters this endpoint does not take — they were ignored. Same list as the `X-UFCalendar-Ignored-Params` header. Sorted, unique.

## Other responses

- `400`: Invalid input (`invalid_id`).
- `401`: Missing/invalid API key (`unauthorized`).
- `403`: Requires Pro or above (`tier_required`), or a plan bought directly rather than through RapidAPI (`direct_plan_required`).
- `404`: No such endpoint on this account (`not_found`).
- `429`: Rate limited (`rate_limited`) or monthly quota reached (`quota_exceeded`). Honor `Retry-After`.
- `500`: Something broke on our side (`internal_error`). It has been logged under the `request_id`.

---

[API](https://skmtc.dev/ufcalendar/apis/ufcalendar-fight-api.md) · [All operations](https://skmtc.dev/ufcalendar/apis/ufcalendar-fight-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ufcalendar/apis/ufcalendar-fight-api/revisions/9623cc8fb70b?raw)