---
title: "Rotate a webhook endpoint's signing secret"
method: POST
path: "/api/v1/webhook-endpoints/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate a webhook endpoint's signing secret

`POST /api/v1/webhook-endpoints/{id}/rotate-secret`

## Request

- Base URL: `https://merchant.zahlo.eu`
- URL: `https://merchant.zahlo.eu/api/v1/webhook-endpoints/{id}/rotate-secret`
- Auth: API key in header `x-api-key`

Rotate a webhook endpoint's signing secret. Use the response status and request ID to decide whether to retry, reconcile, or ask the customer for action.

## Path parameters

- `id` string, required

## Headers

- `Idempotency-Key` string

## Response `200`

The endpoint with its new secret (shown once)

- WebhookEndpoint
  - `id` string, required
  - `object` 'webhook_endpoint', required
  - `livemode` boolean, required
  - `createdAt` string, date-time, required
  - `url` string, uri, required
  - `enabledEvents` string[], required
  - `status` 'enabled' | 'disabled', required
  - `description` string, nullable
  - `metadata` object: Up to 50 key-value pairs; keys up to 40 characters, values strings up to 500 characters.
  - `failingSince` string, date-time, nullable: Start of the current run of failed deliveries; null while healthy. After 3 days the endpoint is disabled.
  - `disabledReason` 'failing' | 'null', nullable: `failing` when Zahlo disabled the endpoint after 3 days of failures.
  - `secret` string: Only in the create and rotate-secret responses.

## Other responses

- `400`: Invalid request
- `401`: Authentication failed
- `404`: Resource not found
- `409`: Request conflicts with existing state

---

[API](https://skmtc.dev/zahlo/apis/zahlo-merchant-api.md) - [All operations](https://skmtc.dev/zahlo/apis/zahlo-merchant-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zahlo/apis/zahlo-merchant-api/revisions/8fcbef981e0d?raw)