> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stateset.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Mint a new signing secret in place; preserves delivery history.

> Issue a new signing secret for an existing webhook endpoint. Mirrors POST /keys/{id}/rotate: row identity (id, url, events, is_active, created_at) is…

Issue a new signing secret for an existing webhook endpoint.

Mirrors `POST /keys/{id}/rotate`: row identity (id, url, events,
is\_active, created\_at) is preserved; only the secret changes.
`updated_at` advances. The new plaintext secret is returned in
full exactly once — read it before the response goes out the
door, because subsequent reads omit it.

The old secret stops working the instant this commits. Tenants
should orchestrate the cutover the same way as API keys: deploy
the new secret to the receiver before calling this, OR tolerate
a brief window of failed-signature deliveries.

Delivery history (success / failure / retry rows) is unchanged —
rotation deliberately preserves it so audit trails survive.

Inactive endpoints 409 (parallel to API key rotate). Cross-tenant
ids 404. Same scope (`admin`) as the rest of the webhook surface.

### Path parameters

<ParamField path="endpoint_id" type="string (uuid)" required />

### Response

`WebhookEndpointWithSecret`

<ResponseField name="id" type="string" required />

<ResponseField name="url" type="string" required />

<ResponseField name="events" type="string[]" required />

<ResponseField name="is_active" type="boolean" required />

<ResponseField name="created_at" type="string" required />

<ResponseField name="updated_at" type="string" required />

<ResponseField name="secret" type="string" required>
  HMAC-SHA256 signing secret. Compare incoming X-Webhook-Signature against `HMAC(secret, f'&#123;t&#125;.&#123;body&#125;')`.
</ResponseField>

### Status codes

| Code  | Meaning             |
| ----- | ------------------- |
| `200` | Successful Response |
| `422` | Validation Error    |

<RequestExample>
  ```bash cURL theme={null}
  curl --request POST \
    --url 'https://api.computer.stateset.app/api/v1/webhooks/{endpoint_id}/rotate-secret' \
    --header 'X-API-Key: YOUR_API_KEY'
  ```
</RequestExample>

<ResponseExample>
  ```json 200 theme={null}
  {
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "url": "https://example.com/webhooks/stateset",
    "events": [
      "string"
    ],
    "is_active": true,
    "created_at": "2026-08-31T14:22:05Z",
    "updated_at": "2026-08-31T14:22:05Z",
    "secret": "YOUR_API_KEY"
  }
  ```
</ResponseExample>