# Roll the signing secret

> Mints a new secret. The old one keeps verifying for 24 hours, during which deliveries carry two `v1` signatures and `previousSecretExpiresAt` says when it stops. If Raylight could no longer read the old secret (the delivery log says so), it is dropped at once instead: deliveries carry only the new signature and `previousSecretExpiresAt` is null.

### POST /v1/webhooks/{id}/roll-secret

**Roll the signing secret**

Mints a new secret. The old one keeps verifying for 24 hours, during which deliveries carry two `v1` signatures and `previousSecretExpiresAt` says when it stops. If Raylight could no longer read the old secret (the delivery log says so), it is dropped at once instead: deliveries carry only the new signature and `previousSecretExpiresAt` is null.

Auth: `Authorization: Bearer rl_live_...` with the `productions` scope.

Parameters:

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | uuid | yes | The endpoint id. |

Responses:

| Status | Meaning |
| --- | --- |
| 200 | The endpoint with its new secret. |
| 400 | Invalid request. |
| 401 | Missing, invalid or revoked key. |
| 403 | The key lacks the `productions` scope (code `api_key_missing_scope`), or its owner has view-only access to the workspace (code `forbidden`). |
| 404 | No such endpoint or workspace for this key (code `not_found`). |
| 409 | The secret was rolled somewhere else at the same moment (code `conflict`). Nothing changed from this call; try again. |
| 429 | Rate limited, or a monthly cap reached. |
| 503 | Webhooks are not switched on for this server (code `disabled`). Every webhook route answers this while they are off. |

Response body (200):

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `endpoint` | object | yes |  |
| `endpoint.id` | uuid | yes |  |
| `endpoint.workspaceId` | uuid | yes |  |
| `endpoint.url` | url | yes |  |
| `endpoint.description` | string \| null | yes |  |
| `endpoint.events` | enum[] | yes |  |
| `endpoint.enabled` | boolean | yes |  |
| `endpoint.disabledReason` | string \| null | yes |  |
| `endpoint.consecutiveFailures` | integer | yes |  |
| `endpoint.lastAttemptAt` | datetime \| null | yes |  |
| `endpoint.lastSuccessAt` | datetime \| null | yes |  |
| `endpoint.previousSecretExpiresAt` | datetime \| null | yes |  |
| `endpoint.createdAt` | datetime | yes |  |
| `endpoint.updatedAt` | datetime | yes |  |
| `endpoint.secret` | string | yes |  |

Example (curl):

```bash
curl -X POST https://api.raylight.app/v1/webhooks/$ID/roll-secret \
  -H "Authorization: Bearer $RAYLIGHT_API_KEY"
```

## More

- Previous: [Delete a webhook endpoint](https://www.raylight.app/docs/reference/delete-v1-webhooks-id.md)
- Next: [Send a test event](https://www.raylight.app/docs/reference/post-v1-webhooks-id-test.md)
- All docs: https://www.raylight.app/llms.txt
- Everything in one file: https://www.raylight.app/llms-full.txt
- OpenAPI: https://api.raylight.app/v1/openapi.json