---
title: "Rotate a webhook's signing secret"
description: "Mint a new signing secret for the endpoint. `POST /api/v1/webhooks/{id}/rotate-secret`"
url: https://www.unitpost.com/docs/platform/post-webhooks-id-rotate-secret
section: "Platform API reference"
updated: 2026-10-13
---
# Rotate a webhook's signing secret

`POST /api/v1/webhooks/{id}/rotate-secret`

Mint a new signing secret for the endpoint. The response carries the new `signing_secret` exactly once, as [Create a webhook endpoint](https://www.unitpost.com/docs/platform/post-webhooks) does. For 24 hours (until `previous_secret_expires_at`) every delivery is signed with the new and the old secret, so switch your receiver to the new one inside that window without dropping a delivery. Rotating again inside the window retires the older secret at once. Requires the `webhooks:manage` capability.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes | — |

## Response fields (200)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `previous_secret_expires_at` | string | yes | Until this time deliveries are signed with the new AND the old secret, so switch your receiver to the new one before then. |

## Responses

| Status | Description |
| --- | --- |
| 200 | The endpoint with its new secret. |
| 401 | Missing or invalid API key. |
| 403 | Insufficient scope. |
| 404 | Webhook not found. |
| 409 | Another rotation of this secret finished first. Rotate again. |

## Example request

```bash
curl -X POST 'https://www.unitpost.com/api/v1/webhooks/wh_123/rotate-secret' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'User-Agent: my-app/1.0'
```

## Example response (200)

```json
{
  "object": "webhook",
  "id": "id_123",
  "name": "Example",
  "url": "https://example.com",
  "events": [
    "email.sent"
  ],
  "status": "enabled",
  "created_at": "2026-01-01T00:00:00.000Z",
  "updated_at": "2026-01-01T00:00:00.000Z",
  "signing_secret": "string",
  "previous_secret_expires_at": "2026-01-01T00:00:00.000Z"
}
```

## Links

- HTML reference (with Node.js, Python, Ruby, PHP, Laravel, Go, Java, Rust, .NET and CLI examples): https://www.unitpost.com/docs/platform/post-webhooks-id-rotate-secret
- OpenAPI 3.1 (full schemas): https://www.unitpost.com/api/v1/openapi.json