> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coverwhale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate a Subscription Secret

> Generate a new signing secret for a subscription. **The new `secret` is returned only in this response** — store it now. The previous secret keeps verifying for a short grace window so in-flight deliveries signed with it still validate.



## OpenAPI

````yaml post /webhook-subscriptions/{id}/rotate-secret
openapi: 3.0.0
info:
  title: Cover Whale API V1
  contact:
    name: Cover Whale API Team
  version: '1.0'
servers:
  - url: https://api.coverwhale.dev/v1
security:
  - AccessToken: []
tags:
  - name: Authentication
    description: Authenticating & Interacting with the API
paths:
  /webhook-subscriptions/{id}/rotate-secret:
    post:
      tags:
        - Webhooks
      summary: Rotate a Subscription Secret
      description: >-
        Generate a new signing secret for a subscription. **The new `secret` is
        returned only in this response** — store it now. The previous secret
        keeps verifying for a short grace window so in-flight deliveries signed
        with it still validate.
      operationId: rotateWebhookSubscriptionSecret
      parameters:
        - name: Accept
          in: header
          required: true
          schema:
            type: string
          example: application/json
        - name: AccessToken
          in: header
          required: true
          schema:
            type: string
          example: eyJraWQiOiJnRk5oTTh2RnRKWXVDVXU1S........
        - name: id
          in: path
          required: true
          schema:
            type: integer
          example: 42
      responses:
        '200':
          description: Secret rotated — new `secret` included here only
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: integer
                    example: 42
                  company_id:
                    type: integer
                    example: 6042
                  endpoint_url:
                    type: string
                    example: https://hooks.yourapp.com/coverwhale
                  event_types:
                    type: array
                    items:
                      type: string
                    example:
                      - submission.bind_completed
                  active:
                    type: boolean
                    example: true
                  secret:
                    type: string
                    description: The new signing secret — shown only here.
                    example: whsec_3a8f5d2c9e1b...
                  secret_rotated_at:
                    type: string
                    format: date-time
                    example: '2026-07-14T13:00:00+00:00'
                  created_at:
                    type: string
                    format: date-time
                    example: '2026-07-14T12:00:00+00:00'
                  updated_at:
                    type: string
                    format: date-time
                    example: '2026-07-14T13:00:00+00:00'
        '404':
          description: Not found (or not owned by your account)
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                example:
                  error: Not found
components:
  securitySchemes:
    AccessToken:
      type: apiKey
      description: >-
        AWS Cognito access token obtained from the /authentication endpoint.
        Token expires after 3600 seconds.
      name: AccessToken
      in: header

````