# Rotate a webhook signing secret

`POST /v1/webhooks/{id}/rotate-secret`

Requires an API key with the `webhooks:write` scope. [About keys and scopes](/docs/api/authentication)

Returns a new secret once. For 24 hours requests carry signatures from both the new and the old secret, so the receiver can switch without dropping events.

## Path parameters

- `id` (string, required, uuid)

## Returns

Returns `200 OK` with a `CreatedWebhook` in `data`. Otherwise returns an error; [Errors](/docs/api/errors) lists every code and which to retry.

- `id` (string, required, uuid)
- `url` (string, required, uri)
- `events` (string[], required) — The event types it receives.
- `source` (string | null, required, one of `zapier`, `make`, `n8n`, `http_api`) — The integration that created it; null when created directly.
- `status` (string, required, one of `active`, `paused`, `disabled`) — `disabled` is set only by the platform; `active` re-enables it.
- `previousSecretExpiresAt` (string | null, required, date-time) — Until when the replaced secret still signs requests after a rotation.
- `circuitOpenUntil` (string | null, required, date-time) — While set and in the future, deliveries to this endpoint wait: it failed five requests in a row. The next request after it is a probe; a success clears it.
- `createdAt` (string, required, date-time)
- `secret` (string, required) — Signs every delivery; shown once, here.

## Example

```bash
curl -X POST https://api.kirora.io/v1/webhooks/018f2a4e-6b1c-7d3e-9f40-37386ae05a6b/rotate-secret \
  -H "Authorization: Bearer $KIRORA_API_KEY"
```

Response `200`:

```json
{
  "data": {
    "id": "018f2a4e-6b1c-7d3e-9f40-37386ae05a6b",
    "url": "https://example.com",
    "events": [
      "*"
    ],
    "source": "zapier",
    "status": "active",
    "previousSecretExpiresAt": "2030-03-14T09:30:00Z",
    "circuitOpenUntil": "2030-03-14T09:30:00Z",
    "createdAt": "2030-03-14T09:30:00Z",
    "secret": "secret_example"
  }
}
```