---
title: "Give a webhook endpoint a new signing secret, returned once | Crossmart Docs"
description: "Documentation for Crossmart, the open-source multichannel platform for sellers and their AI agents."
url: "https://docs.crossmart.io/developers/api/operations/webhookendpointscontroller_rotatesecret_v1/"
---

# Give a webhook endpoint a new signing secret, returned once

POST

/api/v1/workspaces/{workspaceId}/webhook-endpoints/{endpointId}/rotate-secret

Select code sample

```sh
curl --request POST \
  --url https://api.crossmart.io/api/v1/workspaces/example/webhook-endpoints/example/rotate-secret \
  --header 'x-api-key: <x-api-key>'
```

- Crossmart Cloud

For 24 hours deliveries are signed with both the new and the old secret (two v1 signatures), so the receiver can switch without dropping events.

## Authorizations

- **[api_key](https://docs.crossmart.io/developers/api/#api_key)**
- **[cookie](https://docs.crossmart.io/developers/api/#cookie)**
- **[bearer](https://docs.crossmart.io/developers/api/#bearer)**

## Parameters

### Path Parameters

**workspaceId**

required

string

**endpointId**

required

string

## Responses

### 200

Media typeapplication/json

object

**endpoint**

required

object

**id**

required

string format: uuid

**url**

required

string

**description**

required

string

nullable

**eventTypes**

required

Array\<string>

Allowed values: order.created order.updated inventory.stock_changed listing.published listing.failed listing.removed product.created product.updated product.deleted webhook.test

**enabled**

required

False when turned off by someone or after repeated failures

boolean

**disabledReason**

required

MANUAL: turned off by someone. FAILING: turned off by Crossmart.

string

Allowed values: MANUAL FAILING

**disabledAt**

required

string format: date-time

nullable

**consecutiveFailures**

required

Failed attempts since the last delivery that went through

number

**lastDelivery**

required

The latest delivery attempt, whatever event it carried; null before the first

object

**attemptedAt**

required

string format: date-time

**outcome**

required

SUCCEEDED: the endpoint answered 2xx. FAILED: anything else, or no answer.

string

Allowed values: SUCCEEDED FAILED

**responseStatus**

required

Null when no response came: a timeout or a connection error

number

nullable

**error**

required

Why the attempt failed; null on success

string

nullable

**previousSecretExpiresAt**

required

Until then deliveries are also signed with the secret the last rotation replaced

string format: date-time

nullable

**createdAt**

required

string format: date-time

**updatedAt**

required

string format: date-time

**secret**

required

The signing secret. Shown once; store it now.

string

#### Example

```json
{
  "endpoint": {
    "url": "https://example.com/crossmart/webhooks",
    "description": "Order notifications to n8n",
    "eventTypes": [
      "order.created"
    ],
    "disabledReason": "MANUAL",
    "lastDelivery": {
      "outcome": "SUCCEEDED",
      "responseStatus": 200,
      "error": "The endpoint answered with HTTP 503"
    }
  },
  "secret": "whsec_3q2-7wEXAMPLEsecretVALUE0123456789abcdef"
}
```

### 503

The server has no CREDENTIALS_MASTER_KEY to encrypt secrets with