---
title: "Generate or rotate webhook secret"
method: POST
path: "/webhooks/secret"
tags: ["webhooks"]
---

# Generate or rotate webhook secret

`POST /webhooks/secret`

## Request

- Base URL: `https://api.whoisgeni.us` (the document declares no server; this is the origin it was published from)
- URL: `https://api.whoisgeni.us/webhooks/secret`
- Auth: none declared

Generate a new webhook secret for HMAC-SHA256 signing.

This serves as both 'create' (first time) and 'rotate' (subsequent calls).
The previous secret is immediately invalidated.

## Headers

- `X-API-Key` string, nullable

## Response `200`

New webhook secret

- ApiResponseWebhookSecretResponse
  - `data` WebhookSecretResponse: Response after generating or retrieving a webhook secret.
    - `webhook_secret` string, required
    - `message` string, required
  - `error` ErrorDetail: Structured error information for API error responses. Attributes: code: Machine-readable error code (e.g. "JOB_NOT_FOUND"). message: Human-readable error description. details: Optional additional context for debugging.
    - `code` string, required
    - `message` string, required
    - `details` object, nullable
  - `meta` object, nullable

## Other responses

- `401`: Unauthorized — missing or invalid API key/JWT.
- `422`: Validation Error

---

[API](https://skmtc.dev/whoisgeni/apis/whoisgenius.md) · [All operations](https://skmtc.dev/whoisgeni/apis/whoisgenius/llms.txt) · [OpenAPI document](https://skmtc.dev/whoisgeni/apis/whoisgenius/revisions/707f1c34f6b3?raw)