---
title: Rotate a webhook secret
description: Makes a new signing secret and shows it once.
doc_version: 0.1.0-preview
last_updated: 2026-09-14
---

# Rotate a webhook secret

`POST /v1/workspaces/{workspaceId}/webhooks/{webhookId}/rotate-secret`

Makes a new signing secret and shows it once. The previous secret keeps signing for the overlap, 24 hours by default. A member manages their own webhooks, a workspace key manages workspace webhooks, and an Admin manages every webhook.

## Authentication

Send `Authorization: Bearer <GRAPHON_API_KEY>`. Read the key from the
GRAPHON_API_KEY environment variable. Never print it.

## Path parameters

- `workspaceId` (string) — The workspace id.
- `webhookId` (string) — The webhook id.

## Request body

- `previousSecretExpiresInSeconds` (number (optional)) — How long the previous secret keeps signing: 0 to 604800 (7 days). Default 86400. 0 stops it at once.

## Example request

```bash
curl \
  --url "https://api.beta.graphon.ai/v1/workspaces/wspq7ws2np5l8z4/webhooks/whkN4vB7qX2mZ/rotate-secret" \
  --header "Authorization: Bearer $GRAPHON_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"previousSecretExpiresInSeconds":86400}'
```

## CLI

```bash
graphon webhooks rotate-secret whkN4vB7qX2mZ --previous-expires-in 86400 --write-env .env
```

## Example response

```json
{
  "webhook": {
    "id": "whkN4vB7qX2mZ",
    "workspaceId": "wspq7ws2np5l8z4",
    "name": "indexing-callbacks",
    "url": "https://hooks.example.com/graphon",
    "eventTypes": [
      "object.indexed",
      "object.indexing_failed"
    ],
    "bucketIds": null,
    "enabled": true,
    "disabledReason": null,
    "ownerKind": "user",
    "ownerUserId": "usrB2c3D4e5F6",
    "signing": {
      "secretFingerprint": "sha256:9b2d44f0",
      "previousSecretFingerprint": null,
      "previousSecretExpiresAt": null
    },
    "delivery": {
      "pendingDeliveries": 0,
      "lastSucceededAt": "2026-10-14T09:05:13.004Z",
      "lastFailedAt": null
    },
    "createdBy": {
      "userId": "usrB2c3D4e5F6",
      "apiKeyId": null
    },
    "createdAt": "2026-10-14T09:00:00.000Z",
    "updatedAt": "2026-10-14T09:00:00.000Z"
  },
  "secret": "whsec_<shown once>"
}
```

## Sitemap

See the full [sitemap](/sitemap.md) for all pages.