---
title: "Rotate a webhook secret"
method: POST
path: "/api/v1/webhook_endpoints/{endpoint_id}/rotate_secret"
tags: ["Webhooks"]
---

# Rotate a webhook secret

`POST /api/v1/webhook_endpoints/{endpoint_id}/rotate_secret`

## Request

- Base URL: `https://app.voicepanel.com`
- URL: `https://app.voicepanel.com/api/v1/webhook_endpoints/{endpoint_id}/rotate_secret`
- Auth: HTTP bearer

Generate a new signing secret for the endpoint. For 24 hours, each delivery carries two signatures in `webhook-signature`: one from the new secret and one from the previous secret. Deploy the new secret to your verifier before `previous_secret_expires_at`. After that time, deliveries carry only the new signature.

## Path parameters

- `endpoint_id` string, required

## Response `200`

Successful response

- WebhookSecretRotation: The result of a secret rotation
  - `id` string, required: The webhook endpoint ID
  - `secret` string, required: Signing secret, prefixed `whsec_`. Shown once; store it to verify deliveries.
  - `previous_secret_expires_at` string, date-time, nullable, required: When deliveries stop carrying the previous signature
  - `warning` string, required: Reminder that the secret is not shown again

## Other responses

- `400`: Bad request. `code` is `validation_error` when a field is invalid or a query parameter is unknown, with the field paths in `details`, or `bad_request` otherwise.
- `401`: Unauthorized. The token is missing, invalid, or has no user.
- `403`: Forbidden. The token has no access to this resource.
- `404`: Not found. The resource does not exist or belongs to another account.
- `409`: Conflict. The write disagrees with the current state of the resource.
- `429`: Too many requests. The account used its API rate limit. `code` is `too_many_requests`. Wait for the number of seconds in `Retry-After`, then retry.
- `500`: Internal error. Quote `request_id` when you contact support.
- `503`: Service unavailable. A dependency did not answer and nothing was saved. Retry later.

---

[API](https://skmtc.dev/voicepanel/apis/voicepanel-api.md) - [All operations](https://skmtc.dev/voicepanel/apis/voicepanel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/voicepanel/apis/voicepanel-api/revisions/ee41535c5694?raw)