---
title: "Rotate a webhook signing secret"
method: POST
path: "/admin/webhooks/{webhookId}/rotate-secret"
tags: ["Admin"]
---

# Rotate a webhook signing secret

`POST /admin/webhooks/{webhookId}/rotate-secret`

## Request

- Base URL: `https://cloud.kaneo.app/api`
- URL: `https://cloud.kaneo.app/api/admin/webhooks/{webhookId}/rotate-secret`
- Auth: HTTP bearer

Returns the new secret once. Queued deliveries use the new secret. Requires the instance:settings instance permission and a user session. API keys are rejected.

## Path parameters

- `webhookId` string, required

## Response `200`

Webhook and one-time secret

- InstanceWebhookSecret
  - `webhook` InstanceWebhook, required
    - `url` string, uri, required
    - `categories` string[], required
    - `enabled` boolean, required
    - `id` string, required
    - `createdAt` string, date-time, required
  - `secret` string, required

## Other responses

- `401`: Authentication required
- `403`: The caller lacks instance:settings or used an API key
- `404`: Webhook not found
- `409`: Set NOTIFICATION_SECRET_ENCRYPTION_KEY first
- `429`: The API key exceeded its rate limit or usage quota. Wait the number of seconds in Retry-After before retrying. The X-RateLimit headers are sent only when the rate limit was hit.

## Changes

- **2026-10-27** `741a49dfb347`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/usekaneo/apis/kaneo-api/changes/admin/webhooks/:webhookId/rotate-secret/post.md)

---

[API](https://skmtc.dev/usekaneo/apis/kaneo-api.md) - [All operations](https://skmtc.dev/usekaneo/apis/kaneo-api/llms.txt) - [OpenAPI document](https://skmtc.dev/usekaneo/apis/kaneo-api/revisions/741a49dfb347?raw)