---
title: "Rotate signing secret"
method: POST
path: "/v1/webhooks/{webhook_id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate signing secret

`POST /v1/webhooks/{webhook_id}/rotate-secret`

## Request

- Base URL: `https://api.winnr.app`
- URL: `https://api.winnr.app/v1/webhooks/{webhook_id}/rotate-secret`
- Auth: HTTP bearer

Generate a new signing secret for the endpoint. The previous secret
remains valid for 24 hours: during the grace window every delivery is
signed with BOTH secrets (two comma-separated `v1=` values in
`X-Winnr-Signature`), so you can roll the new secret out to your
consumers without dropping deliveries.

## Path parameters

- `webhook_id` string, required

## Response `200`

New signing secret

- object
  - `data` object
    - `webhook_id` string
    - `secret` string: The new signing secret (`whsec_...`)
    - `previous_expires_at` string, date-time: When the previous secret stops being valid
  - `meta` Meta
    - `request_id` string
    - `timestamp` string, date-time

## Other responses

- `401`: Authentication required or token invalid
- `404`: Resource not found

---

[API](https://skmtc.dev/winnr/apis/winnr-api.md) · [All operations](https://skmtc.dev/winnr/apis/winnr-api/llms.txt) · [OpenAPI document](https://skmtc.dev/winnr/apis/winnr-api/revisions/a4f960beb1eb?raw)