Skip to main content
POST
Rotate Webhook Secret

Overview

Generate a new signing secret for a webhook. The old secret becomes invalid immediately. The new secret is only returned once, so make sure to store it securely.
Pro webhook setup and secret rotation are support-managed. Contact support@daya.co if you need to rotate a webhook signing secret for your Pro account.

Authentication

X-Api-Key
string
required
Your API key with Write scope

Path Parameters

id
string
required
Webhook ID (UUID)Example: 770e8400-e29b-41d4-a716-446655440000

Request Examples

Response

success
boolean
required
Indicates if the request was successful
message
string
required
Human-readable response message
data
object
required
Webhook with new secret

Success Response

The secret is a 64-character hex string (32 bytes). This is the raw secret used for HMAC-SHA256 signature verification.

Error Responses

The old secret becomes invalid immediately. After rotating, update your webhook verification code with the new secret before processing any new webhook deliveries.

Rate Limits

  • 100 requests per minute per API key

Next Steps

Webhook Verification

Learn how to verify webhook signatures

Get Webhook

View webhook details