---
title: "Rotate Webhook Secret"
method: POST
path: "/v1/integrations/webhook/secret"
tags: ["integrations"]
---

# Rotate Webhook Secret

`POST /v1/integrations/webhook/secret`

## Request

- Base URL: `https://api.claims.zicron.ai`
- URL: `https://api.claims.zicron.ai/v1/integrations/webhook/secret`
- Auth: none declared

Generate (or rotate) the org's webhook signing secret.

The raw secret is returned exactly once. Outgoing webhooks are signed with
hex HMAC-SHA256 over ``{X-Timestamp}.{raw_body}``, sent in the
``X-Signature`` header (see docs/PARTNER_INTEGRATION.md for receiver-side
verification). Rotation takes effect immediately, including queued
deliveries.

## Response `201`

Successful Response

- WebhookSecretResponse
  - `org_id` string, required
  - `secret` string, required: Signing secret — shown once, store it securely.
  - `created_at` string, required

---

[API](https://skmtc.dev/zicron/apis/zicron-api.md) · [All operations](https://skmtc.dev/zicron/apis/zicron-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zicron/apis/zicron-api/revisions/abe62e22aa46?raw)