> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mobilerun.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate signing secret

> Generates a new signing secret for the webhook subscription and returns it once in the response. The previous secret is replaced immediately, so any signature verification on your endpoint must be updated to use the new value.



## OpenAPI

````yaml /api-reference/webhooks.yaml post /webhooks/{id}/rotate-secret
openapi: 3.1.0
info:
  title: Webhooks
  version: v1
servers:
  - description: Droidrun Cloud API
    url: https://api.mobilerun.ai/v1
security:
  - bearerAuth: []
paths:
  /webhooks/{id}/rotate-secret:
    post:
      tags:
        - Webhooks
      summary: Rotate signing secret
      description: >-
        Generates a new signing secret for the webhook subscription and returns
        it once in the response. The previous secret is replaced immediately, so
        any signature verification on your endpoint must be updated to use the
        new value.
      operationId: rotateWebhookSecret
      parameters:
        - in: path
          name: id
          required: true
          schema:
            example: 550e8400-e29b-41d4-a716-446655440000
            format: uuid
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    properties:
                      blockedAt:
                        type:
                          - string
                          - 'null'
                      blockedReason:
                        type:
                          - string
                          - 'null'
                      createdAt:
                        type: string
                      createdBy:
                        description: >-
                          Id of the actor who created this endpoint. Null when
                          no creator was recorded.
                        format: uuid
                        type:
                          - string
                          - 'null'
                      description:
                        type:
                          - string
                          - 'null'
                      eventTypes:
                        items:
                          type: string
                        type: array
                      health:
                        description: >-
                          System-observed delivery health. `blocked` endpoints
                          are auto-disabled after sustained failure; PATCH
                          state=ACTIVE to re-enable.
                        enum:
                          - healthy
                          - failing
                          - blocked
                        type: string
                      id:
                        format: uuid
                        type: string
                      secret:
                        description: Signing secret — shown only once. Store it now.
                        type: string
                      signingEnabled:
                        type: boolean
                      state:
                        enum:
                          - ACTIVE
                          - DISABLED
                          - DELETED
                        type: string
                      updatedAt:
                        type: string
                      url:
                        type: string
                    required:
                      - id
                      - url
                      - eventTypes
                      - state
                      - health
                      - blockedAt
                      - blockedReason
                      - signingEnabled
                      - description
                      - createdBy
                      - createdAt
                      - updatedAt
                      - secret
                    type: object
                required:
                  - data
                type: object
          description: New signing secret (shown once)
        '401':
          description: Unauthorized
        '404':
          content:
            application/json:
              schema:
                properties:
                  error:
                    type: string
                required:
                  - error
                type: object
          description: Not Found
        '500':
          description: Internal Server Error
      x-codeSamples:
        - lang: JavaScript
          source: >-
            import Mobilerun from '@mobilerun/sdk';


            const client = new Mobilerun({
              apiKey: process.env['MOBILERUN_CLOUD_API_KEY'], // This is the default and can be omitted
            });


            const response = await
            client.webhooks.rotateSecret('550e8400-e29b-41d4-a716-446655440000');


            console.log(response.data);
        - lang: Python
          source: |-
            import os
            from mobilerun_sdk import Mobilerun

            client = Mobilerun(
                api_key=os.environ.get("MOBILERUN_CLOUD_API_KEY"),  # This is the default and can be omitted
            )
            response = client.webhooks.rotate_secret(
                "550e8400-e29b-41d4-a716-446655440000",
            )
            print(response.data)
components:
  securitySchemes:
    bearerAuth:
      bearerFormat: Opaque
      description: Bearer token via Authorization header
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.