> ## Documentation Index
> Fetch the complete documentation index at: https://developer.sodacards.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate a webhook signing secret

> RotateWebhookSecret issues a new signing secret for an endpoint without
 interrupting deliveries: the new secret is returned once, and the previous one
 stays valid until prev_secret_expires_at. During that window deliveries are
 signed with both, so switch your verification to the new secret before the
 deadline. Rotating again replaces the outgoing secret rather than adding a
 third, so at most two secrets are ever accepted at once.



## OpenAPI

````yaml /api-reference/sodacards.yaml post /v1/webhooks/{id}/rotate
openapi: 3.1.0
info:
  title: SODACARDS Developer API
  description: Sell gift cards and game top-ups from your own systems.
  version: 1.0.0
servers:
  - url: https://api.sodacards.com
security:
  - ApiKeyAuth: []
tags:
  - name: PublicAPIService
    description: >-
      PublicAPIService is the public developer API a reseller calls with an API
      key.
       It is served as REST (via HTTP transcoding) so developers use GET /v1/... and
       curl, and its OpenAPI 3.1 spec is generated from this one file. Every method is
       authenticated by the API-key gateway that fronts it.
paths:
  /v1/webhooks/{id}/rotate:
    post:
      summary: Rotate a webhook signing secret
      description: |-
        RotateWebhookSecret issues a new signing secret for an endpoint without
         interrupting deliveries: the new secret is returned once, and the previous one
         stays valid until prev_secret_expires_at. During that window deliveries are
         signed with both, so switch your verification to the new secret before the
         deadline. Rotating again replaces the outgoing secret rather than adding a
         third, so at most two secrets are ever accepted at once.
      operationId: rotateWebhookSecret
      parameters:
        - name: id
          in: path
          description: id is the webhook endpoint whose signing secret to rotate.
          required: true
          schema:
            type: string
            title: id
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/sodacards.devpublic.v1.RotateWebhookSecretResponse
components:
  schemas:
    sodacards.devpublic.v1.RotateWebhookSecretResponse:
      type: object
      properties:
        secret:
          type: string
          title: secret
          description: >-
            secret is the new signing secret, shown only once, like at
            registration.
        prevSecretExpiresAt:
          type: string
          title: prev_secret_expires_at
          description: >-
            prev_secret_expires_at is when the previous secret stops being
            accepted
             (RFC 3339). Until then both secrets validate a delivery.
      title: RotateWebhookSecretResponse
      additionalProperties: false
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      description: Your API key, prefixed sc_live_ or sc_test_.
      name: X-API-Key
      in: header

````