> ## Documentation Index
> Fetch the complete documentation index at: https://docs.memorylake.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate Signing Secret

> Replaces the signing secret and returns the new one — the only time it is shown

```
POST /openapi/memorylake/admin/v1/webhooks/{webhook_id}/rotate-secret
```

Replaces the signing secret and returns the new one — the only time it is shown. For 24 hours requests carry signatures from both the new and the previous secret, so receivers can switch without missing a request. Rotating again within those 24 hours ends the older secret at once.

> [!NOTE]
>
> **Permission required:** `webhook:manage`

### Path Parameters

**webhook\_id** `string` *required*

Identifier of the webhook

```bash cURL theme={null}
curl -X POST 'https://app.memorylake.ai/openapi/memorylake/admin/v1/webhooks/16522a01eaa7b9feef48caafb0b487a5/rotate-secret' \
  -H 'Authorization: Bearer sk_xxxxxx'
```

### Response

**data** `object`

**Webhook With Secret object**

**secret** `string`

Signing secret (whsec\_…). Shown only in this response — store it now; a lost secret can only be rotated.

**webhook** `object`

**Webhook object**

**all\_events** `boolean`

true = every event type is sent, including types added in the future; events is then the selection kept for when this is switched off

**created\_at** `integer`

When the webhook was added, Unix seconds

**description** `string`

Description; empty when none was given

**events** `array`

Selected event types (see [List Event Types](https://docs.memorylake.ai/features/memorylake/api-reference/webhooks/list-webhook-event-types.md))

**secret\_last4** `string`

Last four characters of the current signing secret. The full secret is returned only by [Add Webhook](https://docs.memorylake.ai/features/memorylake/api-reference/webhooks/create-webhook.md) and [Rotate Signing Secret](https://docs.memorylake.ai/features/memorylake/api-reference/webhooks/rotate-webhook-secret.md).

**status** `string`

auto\_disabled = turned off after every delivery failed for 3 days; enable it after fixing the endpoint. One of: `enabled`, `disabled`, `auto_disabled`.

**url** `string`

Endpoint URL events are sent to

**webhook\_id** `string`

Identifier of the webhook

**created\_by\_member\_id** `string`

Member who added the webhook

**last\_delivery\_at** `integer`

Time of the latest attempt, Unix seconds; absent if nothing was sent yet

**last\_delivery\_succeeded** `boolean`

Whether the latest delivery succeeded

**previous\_secret\_expires\_at** `integer`

Until when the previous secret still signs requests after a rotation, Unix seconds; absent outside that window

**secret\_rotated\_at** `integer`

When the signing secret was last rotated, Unix seconds; absent if never

```json Success (200) theme={null}
{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    "secret": "example",
    "webhook": {
      "all_events": false,
      "created_at": 1760000000,
      "description": "Example description",
      "events": [
        "example"
      ],
      "secret_last4": "example",
      "status": "enabled",
      "url": "https://example.com/url",
      "webhook_id": "b5f1a133e89a12f450352f1f50843c42",
      "created_by_member_id": "cb17cae3f79d7fd264472475d7d5d2fe",
      "last_delivery_at": 1760000000,
      "last_delivery_succeeded": false,
      "previous_secret_expires_at": 1760000000,
      "secret_rotated_at": 1760000000
    }
  }
}
```

### Errors

Errors answer with `success: false`, a `message` and an `error_code`. See [Error Codes](https://docs.memorylake.ai/features/memorylake/api-reference/errors.md) for every code.

| Status | Meaning |
| - | - |
| `401` | The API key is missing, invalid, disabled or expired |
| `403` | The key is not allowed to do this |
| `404` | The resource does not exist |
| `422` | The body or a parameter failed validation |
| `429` | Too many requests. Wait for the time in `Retry-After` |
| `500` | Server-side error |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.