> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reachedapp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate a Webhook Secret

> Generates a new signing secret for a webhook.

# Rotate a Webhook Secret

Generates a new signing secret and returns it **once**. The previous secret stops working immediately.

## Request

`POST /v1/webhooks/:id/rotate-secret`

### Path Parameters

| Parameter | Type | Required | Description                          |
| --------- | ---- | -------- | ------------------------------------ |
| `id`      | uuid | Yes      | The unique identifier of the webhook |

## Example

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST \
    "https://kdjmltmhxvvmiuehafgl.supabase.co/functions/v1/api-gateway/v1/webhooks/wh-uuid-1/rotate-secret" \
    -H "Authorization: Bearer rchd_live_xxxxxxxxxxxx"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch(
    "https://kdjmltmhxvvmiuehafgl.supabase.co/functions/v1/api-gateway/v1/webhooks/wh-uuid-1/rotate-secret",
    {
      method: "POST",
      headers: {
        "Authorization": "Bearer rchd_live_xxxxxxxxxxxx"
      }
    }
  );
  const { data } = await response.json();
  // Store data.secret securely — the old secret is now invalid
  ```
</CodeGroup>

## Response

```json theme={null}
{
  "data": {
    "id": "wh-uuid-1",
    "name": "Data pipeline",
    "url": "https://api.yourcompany.com/reached/webhook",
    "events": ["call.completed", "transcript.ready"],
    "is_active": true,
    "secret": "whsec_new_secret_xxxxxxxxxxxx"
  }
}
```

### Response Fields

| Field       | Type    | Description                                                 |
| ----------- | ------- | ----------------------------------------------------------- |
| `id`        | uuid    | Webhook unique identifier                                   |
| `name`      | string  | Human-readable label                                        |
| `url`       | string  | HTTPS endpoint URL                                          |
| `events`    | array   | Subscribed event types                                      |
| `is_active` | boolean | Whether the webhook is active                               |
| `secret`    | string  | New signing secret (returned only once — store it securely) |