---
title: "Rotate the signing secret"
method: POST
path: "/api/v1/webhooks/{endpointId}/rotate-secret"
tags: ["Public API v1"]
---

# Rotate the signing secret

`POST /api/v1/webhooks/{endpointId}/rotate-secret`

## Request

- Base URL: `https://api.vieneu.io`
- URL: `https://api.vieneu.io/api/v1/webhooks/{endpointId}/rotate-secret`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Issues a new signing secret and returns it **once**. The previous secret keeps verifying for 24 hours, and during that window every event carries one `v1=` signature per live secret — so you can deploy the new secret without dropping events signed with the old one.

## Path parameters

- `endpointId` string, required

## Response `200`

Rotated. `secret` is the new secret, shown only here.

- WebhookEndpointCreatedDto
  - `id` string, required
  - `url` string, required
  - `description` string, required
  - `events` string[], required
  - `status` 'ENABLED' | 'DISABLED', required
  - `apiKeyId` string, nullable: Null when the endpoint receives events for every key.
  - `secretPrefix` string, required: First characters of the signing secret, so you can tell two secrets apart. The secret itself is returned ONCE, at creation and rotation.
  - `secretRotatedAt` string, date-time, nullable
  - `lastDeliveryAt` string, date-time, nullable
  - `lastDeadLetterAt` string, date-time, nullable: When an event to this endpoint last gave up permanently.
  - `createdAt` string, date-time, required
  - `secret` string, required: Signing secret. Shown ONCE — store it now, it cannot be retrieved again. Use it to verify the Vieneu-Signature header on every event.

## Other responses

- `404`: No such endpoint on this account.

## Changes

- **2026-09-16** `98838c7c0e72`: 1 info
  - added the optional property `retryAfterSeconds` to the response with the `404` status
- **2026-09-08** `633d63e717b8`: 2 breaking, 5 info
  - the response property `statusCode` became optional for the status `404`
  - response property `message` list-of-types was widened by adding types `array` to media type `application/json` of response `404`
  - added the optional property `code` to the response with the `404` status
  - added the optional property `error` to the response with the `404` status
  - …3 more
- **2026-09-05** `c9d346918371`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/vieneu/apis/vieneu-api/changes/api/v1/webhooks/:endpointId/rotate-secret/post.md)

---

[API](https://skmtc.dev/vieneu/apis/vieneu-api.md) - [All operations](https://skmtc.dev/vieneu/apis/vieneu-api/llms.txt) - [OpenAPI document](https://skmtc.dev/vieneu/apis/vieneu-api/revisions/9518b716e16d?raw)