> ## Documentation Index
> Fetch the complete documentation index at: https://docs.daya.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate Webhook Secret

> Generate a new signing secret for a webhook

## Overview

Generate a new signing secret for a webhook. The old secret becomes invalid immediately. The new secret is only returned once, so make sure to store it securely.

<Info>
  Pro webhook setup and secret rotation are support-managed. Contact [support@daya.co](mailto:support@daya.co) if you need to rotate a webhook signing secret for your Pro account.
</Info>

## Authentication

<ParamField header="X-Api-Key" type="string" required>
  Your API key with Write scope

  ```
  X-Api-Key: daya_sk_YOUR_API_KEY
  ```
</ParamField>

## Path Parameters

<ParamField path="id" type="string" required>
  Webhook ID (UUID)

  **Example:** `770e8400-e29b-41d4-a716-446655440000`
</ParamField>

## Request Examples

<CodeGroup>
  ```bash cURL theme={null}
  curl --request POST \
    --url 'https://api.pro.daya.co/public/v1/webhooks/770e8400-e29b-41d4-a716-446655440000/rotate-secret' \
    --header 'X-Api-Key: daya_sk_YOUR_API_KEY'
  ```

  ```javascript JavaScript theme={null}
  const webhookId = '770e8400-e29b-41d4-a716-446655440000';

  const response = await fetch(
    `https://api.pro.daya.co/public/v1/webhooks/${webhookId}/rotate-secret`,
    {
      method: 'POST',
      headers: { 'X-Api-Key': 'daya_sk_YOUR_API_KEY' }
    }
  );

  const data = await response.json();
  // IMPORTANT: Store the new secret securely - it's only shown once!
  console.log('New secret:', data.data.secret);
  ```

  ```python Python theme={null}
  import requests

  webhook_id = '770e8400-e29b-41d4-a716-446655440000'
  headers = {'X-Api-Key': 'daya_sk_YOUR_API_KEY'}

  response = requests.post(
      f'https://api.pro.daya.co/public/v1/webhooks/{webhook_id}/rotate-secret',
      headers=headers
  )

  result = response.json()
  # IMPORTANT: Store the new secret securely - it's only shown once!
  print(f"New secret: {result['data']['secret']}")
  ```

  ```go Go theme={null}
  package main

  import (
      "encoding/json"
      "fmt"
      "net/http"
  )

  func main() {
      req, _ := http.NewRequest("POST", "https://api.pro.daya.co/public/v1/webhooks/770e8400-e29b-41d4-a716-446655440000/rotate-secret", nil)
      req.Header.Set("X-Api-Key", "daya_sk_YOUR_API_KEY")

      client := &http.Client{}
      resp, err := client.Do(req)
      if err != nil {
          panic(err)
      }
      defer resp.Body.Close()

      var result map[string]interface{}
      json.NewDecoder(resp.Body).Decode(&result)
      // IMPORTANT: Store the new secret securely - it's only shown once!
      fmt.Println("New secret:", result["data"])
  }
  ```
</CodeGroup>

## Response

<ResponseField name="success" type="boolean" required>
  Indicates if the request was successful
</ResponseField>

<ResponseField name="message" type="string" required>
  Human-readable response message
</ResponseField>

<ResponseField name="data" type="object" required>
  Webhook with new secret

  <Expandable title="webhook properties">
    <ResponseField name="id" type="string">
      Unique webhook identifier (UUID)
    </ResponseField>

    <ResponseField name="url" type="string">
      Webhook endpoint URL
    </ResponseField>

    <ResponseField name="description" type="string">
      Webhook description
    </ResponseField>

    <ResponseField name="events" type="array">
      Events this webhook is subscribed to
    </ResponseField>

    <ResponseField name="status" type="string">
      Webhook status: `active`, `paused`, `disabled`
    </ResponseField>

    <ResponseField name="secret" type="string">
      **New signing secret for verifying webhook payloads.**

      <Warning>
        This is only returned once. Store it securely!
      </Warning>
    </ResponseField>

    <ResponseField name="created_at" type="string">
      ISO 8601 creation timestamp
    </ResponseField>

    <ResponseField name="updated_at" type="string">
      ISO 8601 last update timestamp
    </ResponseField>
  </Expandable>
</ResponseField>

### Success Response

<ResponseExample>
  ```json 200 OK theme={null}
  {
    "success": true,
    "message": "Webhook secret rotated successfully",
    "data": {
      "id": "770e8400-e29b-41d4-a716-446655440000",
      "url": "https://example.com/webhooks/daya",
      "description": "Order notifications",
      "events": ["order.filled", "order.cancelled"],
      "status": "active",
      "secret": "b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef12345678",
      "failure_count": 0,
      "last_success_at": "2024-01-15T10:30:00Z",
      "last_failure_at": null,
      "last_failure_reason": null,
      "created_at": "2024-01-01T00:00:00Z",
      "updated_at": "2024-01-15T12:00:00Z"
    },
    "timestamp": "2024-01-15T12:00:00Z"
  }
  ```
</ResponseExample>

<Note>
  The `secret` is a 64-character hex string (32 bytes). This is the raw secret used for HMAC-SHA256 signature verification.
</Note>

## Error Responses

<ResponseExample>
  ```json 400 Bad Request - Invalid ID theme={null}
  {
    "success": false,
    "message": "Validation error",
    "error": {
      "code": "VALIDATION_ERROR",
      "message": "Invalid webhook ID format"
    }
  }
  ```

  ```json 404 Not Found theme={null}
  {
    "success": false,
    "message": "Webhook not found",
    "error": {
      "code": "WEBHOOK_NOT_FOUND",
      "message": "No webhook found with the specified ID"
    }
  }
  ```

  ```json 401 Unauthorized theme={null}
  {
    "success": false,
    "message": "Unauthorized",
    "error": {
      "code": "API_KEY_INVALID",
      "message": "The provided API key is invalid"
    }
  }
  ```
</ResponseExample>

<Warning>
  **The old secret becomes invalid immediately.** After rotating, update your webhook verification code with the new secret before processing any new webhook deliveries.
</Warning>

## Rate Limits

* **100 requests per minute** per API key

## Next Steps

<CardGroup cols={2}>
  <Card title="Webhook Verification" icon="shield-check" href="/pro/webhooks/verification">
    Learn how to verify webhook signatures
  </Card>

  <Card title="Get Webhook" icon="eye" href="/pro/api-reference/get-webhook">
    View webhook details
  </Card>
</CardGroup>