> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamlinedpayments.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate webhook secret

> Replaces the signing secret and returns the new one, once. It takes effect
immediately, for deliveries already queued as well: there is no period in which
both secrets verify, so switch your receiver to the new secret as you rotate.




## OpenAPI

````yaml /api-reference/openapi.yaml post /webhook_endpoints/{uuid}/rotate_secret
openapi: 3.0.3
info:
  title: Streamlined API
  description: >
    Access customers, customer applications, customer groups, products, payouts,
    invoices, transactions, and deposit links programmatically through this API,
    and receive webhooks when deposit links change. All requests must be
    authenticated with an API key.
  version: 1.6.0
  license:
    name: Proprietary
    url: https://streamlinedpayments.com/terms
servers:
  - url: https://api.staging.streamlinedpayments.com/api/v1
    description: Sandbox
  - url: https://api.streamlinedpayments.com/api/v1
    description: Production
security:
  - AppIdAuth: []
    ApiKeyAuth: []
tags:
  - name: Customers
    description: Create, update and delete the businesses you sell to.
  - name: Customer applications
    description: >-
      List the applications your customers submit, and approve them. Approving
      can also set net terms and export the customer to Shopify. See [Approve
      customer applications](/guides/customer-applications).
  - name: Customer groups
    description: >-
      Organize customers into groups and manage who's in each one. A group can
      be linked to a Shopify B2B company.
  - name: Customer files
    description: Upload and manage files attached to a customer.
  - name: Customer addresses
    description: Manage a customer's addresses and choose their default billing address.
  - name: Orders
    description: Create orders, add and remove line items, and schedule them.
  - name: Invoices
    description: Create invoices from orders, then list, look up and update them.
  - name: Transactions
    description: List transactions and look one up.
  - name: Payouts
    description: List payouts, including pending ones, and look one up.
  - name: Products
    description: >-
      Create and update the products and services you sell, import them in bulk,
      and merge duplicates.
  - name: Deposit links
    description: Collect money from a customer before an invoice exists.
  - name: Webhooks
    description: >-
      Register HTTPS endpoints to receive events when something changes. See
      [Webhooks](/guides/webhooks) for signatures, retries and delivery
      guarantees.
paths:
  /webhook_endpoints/{uuid}/rotate_secret:
    post:
      tags:
        - Webhooks
      summary: Rotate webhook secret
      description: >
        Replaces the signing secret and returns the new one, once. It takes
        effect

        immediately, for deliveries already queued as well: there is no period
        in which

        both secrets verify, so switch your receiver to the new secret as you
        rotate.
      operationId: rotateWebhookSecret
      parameters:
        - name: uuid
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Rotated. Includes the new secret.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointWithSecret'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  schemas:
    WebhookEndpointWithSecret:
      allOf:
        - $ref: '#/components/schemas/WebhookEndpoint'
        - type: object
          properties:
            secret:
              type: string
              description: Signs every delivery. Returned only on create and rotate.
              example: whsec_Hk3m9QpXa7Tz2Lr8Vn4Bc6Wd1Ys5Fe0Gj
    WebhookEndpoint:
      type: object
      properties:
        uuid:
          type: string
        url:
          type: string
        description:
          type: string
          nullable: true
        events:
          type: array
          items:
            type: string
        status:
          type: string
          enum:
            - enabled
            - disabled
        disabled_reason:
          type: string
          nullable: true
          description: Why the endpoint switched itself off. Null while enabled.
        last_success_at:
          type: string
          format: date-time
          nullable: true
        last_failure_at:
          type: string
          format: date-time
          nullable: true
        created_at:
          type: string
          format: date-time
      example:
        uuid: 6f1d3c2a-9b8e-4a7d-b5c4-1e2f3a4b5c6d
        url: https://erp.example.com/webhooks/streamlined
        description: ERP deposit sync
        events:
          - deposit_link.paid
          - deposit_link.payment_failed
        status: enabled
        disabled_reason: null
        last_success_at: '2026-09-10T16:04:12Z'
        last_failure_at: null
        created_at: '2026-09-10T15:00:00Z'
    Error:
      type: object
      properties:
        error:
          type: string
        message:
          type: string
  responses:
    Unauthorized:
      description: Authentication failed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          examples:
            AuthenticationRequired:
              value:
                error: Authentication required
                message: >-
                  API endpoint requires authentication. Please provide valid
                  X-App-Id and X-Api-Key headers.
            InvalidCredentials:
              value:
                error: Invalid credentials
                message: >-
                  The provided API credentials are invalid. Please check your
                  X-App-Id and X-Api-Key values.
    NotFound:
      description: Resource not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    AppIdAuth:
      type: apiKey
      in: header
      name: X-App-Id
      description: App ID for authentication
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-Api-Key
      description: API Key for authentication

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.