# Rotate webhook secret

> Creates a new signing secret for an endpoint. During grace_hours (0 to 72, default 24) every delivery carries two signatures, so you can switch without losing events. Returns the new secret, shown only once.

Last updated: 2026-10-25. Source: https://docs.smartchat.marketing/en/api/reference/webhooks/rotate_webhook_secret/

Creates a new signing secret for an endpoint. During grace_hours (0 to 72, default 24) every delivery carries two signatures, so you can switch without losing events. Returns the new secret, shown only once.

`POST /v1/webhook-endpoints/{endpoint_id}/rotate-secret`

| | |
|---|---|
| Permission | `webhooks:write` ([all permissions](https://docs.smartchat.marketing/en/api/permissions/)) |
| Risk | Write (no outside effect) |
| Idempotency-Key | Not needed ([how it works](https://docs.smartchat.marketing/en/concepts/idempotency/)) |
| Safe to repeat | Not safe to repeat blindly: the server keeps no key for this call, so a repeat does the work again. |
| Rate limit class | `write` (120 requests per minute per key) |
| Confirmation | None |
| MCP tool | Not available in MCP |
| Since version | 2026-10-25 |

## What it does

- Changes data in your account. It does not send messages to contacts.

## Request

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `endpoint_id` | string | Webhook endpoint ID. |

**Body** (JSON)

| Name | Type | Required | Description |
|---|---|---|---|
| `grace_hours` | integer | no | Hours during which the old secret still signs. 0 stops the old secret at once. 0 to 72; default `24` |

## Examples

**curl**

```bash
curl -X POST "https://api.smartchat.marketing/v1/webhook-endpoints/whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234/rotate-secret" \
  -H "Authorization: Bearer $SMARTCHAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "grace_hours": 24
}'
```

**Python**

```python
import os
import requests

response = requests.post(
    "https://api.smartchat.marketing/v1/webhook-endpoints/whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234/rotate-secret",
    headers={"Authorization": "Bearer " + os.environ["SMARTCHAT_API_KEY"]},
    json={
        "grace_hours": 24,
    },
)
response.raise_for_status()
print(response.json())
```

**TypeScript**

```typescript
const response = await fetch("https://api.smartchat.marketing/v1/webhook-endpoints/whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234/rotate-secret", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SMARTCHAT_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "grace_hours": 24
  }),
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());
```

Response (200):


```json
{
  "object": "webhook_endpoint",
  "id": "whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234",
  "url": "https://example.com/hooks/smartchat",
  "description": "Order system",
  "enabled_events": [
    "contact.created",
    "message.received"
  ],
  "status": "active",
  "disabled_reason": null,
  "secret_hint": "whsec_...Lm4Z",
  "consecutive_failures": 0,
  "last_success_at": "2026-10-25T09:45:00Z",
  "last_failure_at": null,
  "secret_previous_expires_at": "2026-10-26T09:50:00Z",
  "created_at": "2026-10-25T09:41:07Z",
  "updated_at": "2026-10-25T09:45:00Z",
  "secret": "whsec_Qe7Rt2YuI9oP0aSdFgHjKlZxCvBnM3wE5rT8yUiO1pA"
}
```

## Response

Status 200. Every response has the headers `Request-Id`, `SmartChat-Version` and `X-RateLimit-*`.

| Name | Type | Description |
|---|---|---|
| `object` | string | Always "webhook_endpoint". always `webhook_endpoint` |
| `id` | string | Webhook endpoint ID. |
| `url` | string | HTTPS address that receives the events. up to 2000 characters |
| `description` | string | Your own note about this endpoint. up to 200 characters |
| `enabled_events` | array of string | Event types this endpoint receives, or ["*"] for all available events. up to 30 items |
| `status` | string | active and degraded receive events. paused and disabled do not; call enable_webhook_endpoint. one of: `active`, `degraded`, `paused`, `disabled` |
| `disabled_reason` | string or null | Why the endpoint was paused or disabled. Null while it is working. up to 60 characters |
| `secret_hint` | string | Last 4 characters of the signing secret, for example whsec_...abcd. up to 20 characters |
| `consecutive_failures` | integer | Failed delivery attempts in a row since the last success. 0 to 1000000 |
| `last_success_at` | string or null | Time of the last successful delivery. up to 40 characters; format date-time |
| `last_failure_at` | string or null | Time of the last failed delivery attempt. up to 40 characters; format date-time |
| `secret_previous_expires_at` | string or null | While a secret rotation is running: when the old secret stops signing. Otherwise null. up to 40 characters; format date-time |
| `created_at` | string | When the endpoint was created. up to 40 characters; format date-time |
| `updated_at` | string | When the endpoint was last changed. up to 40 characters; format date-time |
| `secret` | string | Signing secret (whsec_...). Store it now; it is never shown again. up to 80 characters |

## Errors

| Code | Status | When |
|---|---|---|
| [`api_key_expired`](https://docs.smartchat.marketing/en/errors/#api_key_expired) | 401 | This API key has expired. |
| [`api_key_invalid`](https://docs.smartchat.marketing/en/errors/#api_key_invalid) | 401 | This API key is not valid. |
| [`api_key_revoked`](https://docs.smartchat.marketing/en/errors/#api_key_revoked) | 401 | This API key was revoked. |
| [`authentication_required`](https://docs.smartchat.marketing/en/errors/#authentication_required) | 401 | No API key was sent. Send 'Authorization: Bearer <key>'. |
| [`insufficient_scope`](https://docs.smartchat.marketing/en/errors/#insufficient_scope) | 403 | This key lacks a required permission. |
| [`ip_not_allowed`](https://docs.smartchat.marketing/en/errors/#ip_not_allowed) | 403 | This IP address is not allowed for this key. |
| [`endpoint_not_found`](https://docs.smartchat.marketing/en/errors/#endpoint_not_found) | 404 | No webhook endpoint with this ID exists in this account. |
| [`validation_failed`](https://docs.smartchat.marketing/en/errors/#validation_failed) | 422 | A field is not valid. |
| [`rate_limited`](https://docs.smartchat.marketing/en/errors/#rate_limited) | 429 | Too many requests. Wait and try again. |
| [`internal_error`](https://docs.smartchat.marketing/en/errors/#internal_error) | 500 | Something went wrong on our side. |

All errors use [one format](https://docs.smartchat.marketing/en/concepts/errors-overview/).