# Rotate a webhook subscription secret — API reference

> Replaces the signing secret and exposes it once with the subscription record.

Source: https://upfour.io/docs/api/webhook-subscriptions/rotate-a-webhook-subscription-secret

[Developers](https://upfour.io/docs/api.md)/[Webhook subscriptions](https://upfour.io/docs/api/webhook-subscriptions.md)

Replaces the signing secret and exposes it once with the subscription record.

POST https://app.upfour.io/v1/webhook-subscriptions/{subscriptionID}/rotate-secret

scope webhook.write beta [Idempotency-Key supported](https://upfour.io/docs/api/idempotency.md) returns 200

## Parameters

| Field | Type | Description |
| --- | --- | --- |
| `subscriptionID` required | uuid | path parameter |

## Returns

A successful request returns `200` with application/json.

Response fields 1 top-level fields

| Field | Type | Description |
| --- | --- | --- |
| `data` | WebhookSubscriptionCreated | |
| WebhookSubscriptionCreated · 11 fields FieldTypeDescription `active` boolean `created_at` string (date-time) `events` string[]  · nullable `failure_count` integer `id` uuid `org_id` uuid `secret` string Signing secret of the subscription, `whsec_` plus 64 hex characters. Returned by this call only; list, update and read calls never include it. Store it now: a lost secret cannot be read back, only replaced with POST /webhook-subscriptions/{subscriptionID}/rotate-secret. The old secret stops signing at once. `updated_at` string (date-time) `url` string `disabled_at` string (date-time) Set while the subscription is switched off, by active: false or by the delivery worker after repeated failures. `last_delivery_at` string (date-time) | | |

## Errors

Only the errors this operation can return. Every error uses the [same envelope](https://upfour.io/docs/api/responses.md).

| Status | Code | Meaning |
| --- | --- | --- |
| 400 | [bad_request](https://upfour.io/docs/api/errors#code-bad_request) | The request is malformed or fails validation. |
| 404 | [not_found](https://upfour.io/docs/api/errors#code-not_found) | The requested resource does not exist or is outside the caller's scope. |
| 403 | [permission_denied](https://upfour.io/docs/api/errors#code-permission_denied) | The credentials do not permit this action. |

Every call can also return `unauthorized` (401), `rate_limit_exceeded` (429) or `internal_error` (500 / 502). See [Responses and errors](https://upfour.io/docs/api/responses.md).

[PreviousRedeliver a webhook delivery](https://upfour.io/docs/api/webhook-subscriptions/redeliver-a-webhook-delivery.md) [NextSend a webhook test](https://upfour.io/docs/api/webhook-subscriptions/send-a-webhook-test.md)

## Request

### cURL

```bash
curl -s -X POST "https://app.upfour.io/v1/webhook-subscriptions/3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90/rotate-secret" \
  -H "Authorization: Bearer $UP4_API_KEY"
```

### JavaScript

```javascript
const res = await fetch("https://app.upfour.io/v1/webhook-subscriptions/3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90/rotate-secret", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.UP4_API_KEY}`,
  },
});
console.log(res.status, await res.json());
```

### Python

```python
import os
import requests

res = requests.post(
    "https://app.upfour.io/v1/webhook-subscriptions/3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90/rotate-secret",
    headers={"Authorization": f"Bearer {os.environ['UP4_API_KEY']}"},
)
print(res.status_code, res.json())
```

### Go

```go
package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://app.upfour.io/v1/webhook-subscriptions/3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90/rotate-secret", nil)
	req.Header.Set("Authorization", "Bearer "+os.Getenv("UP4_API_KEY"))
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	out, _ := io.ReadAll(res.Body)
	fmt.Println(res.StatusCode, string(out))
}
```

### PHP

```php
<?php
$ch = curl_init("https://app.upfour.io/v1/webhook-subscriptions/3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90/rotate-secret");
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer " . getenv("UP4_API_KEY"),
    ],
]);
$response = curl_exec($ch);
echo curl_getinfo($ch, CURLINFO_RESPONSE_CODE), " ", $response, "\n";
curl_close($ch);
```

## Response

### 200

```json
{
  "data": {
    "active": false,
    "created_at": "2026-01-15T09:30:00Z",
    "events": [
      "example"
    ],
    "failure_count": 1,
    "id": "3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90",
    "org_id": "3f6c1a52-8b1e-4f0d-9a43-2c5d7e8f1a90",
    "secret": "example",
    "updated_at": "2026-01-15T09:30:00Z",
    "url": "https://example.com"
  }
}
```

### 400

```json
{
  "error": {
    "code": "bad_request",
    "message": "The request is malformed or fails validation.",
    "request_id": "req_…"
  }
}
```

### 403

```json
{
  "error": {
    "code": "permission_denied",
    "message": "The credentials do not permit this action.",
    "request_id": "req_…"
  }
}
```

### 404

```json
{
  "error": {
    "code": "not_found",
    "message": "The requested resource does not exist or is outside the caller's scope.",
    "request_id": "req_…"
  }
}
```