> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trypost.it/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate webhook secret

> Rotate the signing secret. The previous secret stops working immediately.

Requires **manage webhooks** permission (Owner / Admin). Other-workspace IDs return `404`.

Update your receiver with the new secret before or immediately after this call. The next attempt — including a retry already queued — signs with the new secret. Deliveries that still verify against the old secret will fail.

## Request

<ParamField path="webhook" type="string" required>
  The webhook UUID whose secret should be rotated.
</ParamField>

## Response

Returns the webhook including the new `signing_secret`. Same shape as [`GET /webhooks/{webhook}`](/api-reference/endpoint/get-webhook).

<RequestExample>
  ```bash theme={null}
  curl -X POST https://app.trypost.it/api/webhooks/a1b2c3d4-e5f6-7890-abcd-ef1234567890/rotate-secret \
    -H "Authorization: Bearer YOUR_API_KEY"
  ```
</RequestExample>

<ResponseExample>
  ```json theme={null}
  {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "endpoint": "https://example.com/webhooks/trypost",
    "events": ["post.published", "post.failed"],
    "status": "enabled",
    "last_sent_at": "2026-09-04T15:04:05+00:00",
    "paused_at": null,
    "consecutive_failures": 0,
    "signing_secret": "whsec_newsecretabcdefghijklmnopqrstuv",
    "created_at": "2026-09-01T12:00:00+00:00",
    "updated_at": "2026-09-04T16:30:00+00:00"
  }
  ```
</ResponseExample>