Rotate webhook secret

Creates a new signing secret for an endpoint. During grace_hours (0 to 72, default 24) every delivery carries two signatures, so you can switch without losing events. Returns the new secret, shown only once.

POST /v1/webhook-endpoints/{endpoint_id}/rotate-secret

Permission	`webhooks:write` (all permissions)
Risk	Write (no outside effect)
Idempotency-Key	Not needed (how it works)
Safe to repeat	Not safe to repeat blindly: the server keeps no key for this call, so a repeat does the work again.
Rate limit class	`write` (120 requests per minute per key)
Confirmation	None
MCP tool	Not available in MCP
Since version	2026-10-25

#What it does

Changes data in your account. It does not send messages to contacts.

#Request

Path parameters

Name	Type	Description
`endpoint_id`	string	Webhook endpoint ID.

Body (JSON)

Name	Type	Required	Description
`grace_hours`	integer	no	Hours during which the old secret still signs. 0 stops the old secret at once. 0 to 72; default `24`

#Examples

curlPythonTypeScript

curl -X POST "https://api.smartchat.marketing/v1/webhook-endpoints/whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234/rotate-secret" \
  -H "Authorization: Bearer $SMARTCHAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "grace_hours": 24
}'

import os
import requests

response = requests.post(
    "https://api.smartchat.marketing/v1/webhook-endpoints/whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234/rotate-secret",
    headers={"Authorization": "Bearer " + os.environ["SMARTCHAT_API_KEY"]},
    json={
        "grace_hours": 24,
    },
)
response.raise_for_status()
print(response.json())

const response = await fetch("https://api.smartchat.marketing/v1/webhook-endpoints/whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234/rotate-secret", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SMARTCHAT_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "grace_hours": 24
  }),
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());

Response (200):

{
  "object": "webhook_endpoint",
  "id": "whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234",
  "url": "https://example.com/hooks/smartchat",
  "description": "Order system",
  "enabled_events": [
    "contact.created",
    "message.received"
  ],
  "status": "active",
  "disabled_reason": null,
  "secret_hint": "whsec_...Lm4Z",
  "consecutive_failures": 0,
  "last_success_at": "2026-10-25T09:45:00Z",
  "last_failure_at": null,
  "secret_previous_expires_at": "2026-10-26T09:50:00Z",
  "created_at": "2026-10-25T09:41:07Z",
  "updated_at": "2026-10-25T09:45:00Z",
  "secret": "whsec_Qe7Rt2YuI9oP0aSdFgHjKlZxCvBnM3wE5rT8yUiO1pA"
}

#Response

Status 200. Every response has the headers Request-Id, SmartChat-Version and X-RateLimit-*.

Name	Type	Description
`object`	string	Always "webhook_endpoint". always `webhook_endpoint`
`id`	string	Webhook endpoint ID.
`url`	string	HTTPS address that receives the events. up to 2000 characters
`description`	string	Your own note about this endpoint. up to 200 characters
`enabled_events`	array of string	Event types this endpoint receives, or ["*"] for all available events. up to 30 items
`status`	string	active and degraded receive events. paused and disabled do not; call enable_webhook_endpoint. one of: `active`, `degraded`, `paused`, `disabled`
`disabled_reason`	string or null	Why the endpoint was paused or disabled. Null while it is working. up to 60 characters
`secret_hint`	string	Last 4 characters of the signing secret, for example whsec_...abcd. up to 20 characters
`consecutive_failures`	integer	Failed delivery attempts in a row since the last success. 0 to 1000000
`last_success_at`	string or null	Time of the last successful delivery. up to 40 characters; format date-time
`last_failure_at`	string or null	Time of the last failed delivery attempt. up to 40 characters; format date-time
`secret_previous_expires_at`	string or null	While a secret rotation is running: when the old secret stops signing. Otherwise null. up to 40 characters; format date-time
`created_at`	string	When the endpoint was created. up to 40 characters; format date-time
`updated_at`	string	When the endpoint was last changed. up to 40 characters; format date-time
`secret`	string	Signing secret (whsec_...). Store it now; it is never shown again. up to 80 characters

#Errors

Code	Status	When
`api_key_expired`	401	This API key has expired.
`api_key_invalid`	401	This API key is not valid.
`api_key_revoked`	401	This API key was revoked.
`authentication_required`	401	No API key was sent. Send 'Authorization: Bearer <key>'.
`insufficient_scope`	403	This key lacks a required permission.
`ip_not_allowed`	403	This IP address is not allowed for this key.
`endpoint_not_found`	404	No webhook endpoint with this ID exists in this account.
`validation_failed`	422	A field is not valid.
`rate_limited`	429	Too many requests. Wait and try again.
`internal_error`	500	Something went wrong on our side.

All errors use one format.