---
title: Rotate the signing secret — POST /api/v1/webhook_subscriptions/{id}/rotate_secret
description: Generates a new signing_secret (returned once, in this response) and preserves the previous one for 24 hours so deliveries during your deploy window ship…
canonical_url: "https://cascades.crscreditapi.com/docs/api/webhooks/rotate-webhook-secret"
doc_version: "1.0.0"
last_updated: "2026-10-09T18:04:24Z"
source: "public/api-docs/v1/swagger.yaml#rotateWebhookSecret"
---

# Rotate the signing secret — POST /api/v1/webhook_subscriptions/{id}/rotate_secret

`POST https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/{id}/rotate_secret`

- Operation id: `rotateWebhookSecret`
- Scopes: `webhooks:write`
- Idempotent: no
- OpenAPI: https://cascades.crscreditapi.com/openapi.json · https://cascades.crscreditapi.com/openapi.yaml (operationId `rotateWebhookSecret`)

Generates a new `signing_secret` (returned once, in this response)
and preserves the previous one for 24 hours so deliveries during
your deploy window ship with both `v1=` (new) and `v0=` (old)
signatures. After the grace window only `v1=` ships. Requires
`webhooks:write`.

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `id` | integer | yes | Webhook subscription id. Scoped to the calling api_client. |

## Responses

### 200 — New signing_secret returned (one-time)

`application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `data` | WebhookSubscription | no |  |
|   `id` | integer | no |  |
|   `object` | string | no |  |
|   `url` | string | no |  |
|   `event_filter` | array of WebhookEventName | no | Empty = subscribed to ALL events. |
|   `active` | boolean | no |  |
|   `last_delivered_at` | string (date-time), nullable | no |  |
|   `created_at` | string (date-time) | no |  |
|   `updated_at` | string (date-time) | no |  |
|   `signing_secret` | string | no |  |
| `meta` | Meta | no |  |
|   `request_id` | string | yes | Correlation id for this request. Also sent as the `X-Request-Id` response header; quote it when contacting support. |

```json
{
  "data": {
    "id": 1,
    "object": "webhook_subscription",
    "url": "https://hooks.partner.example/cascades",
    "event_filter": [
      "execution.completed"
    ],
    "active": true,
    "last_delivered_at": "2026-05-08T18:41:05Z",
    "created_at": "2026-05-08T18:41:05Z",
    "updated_at": "2026-05-08T18:41:05Z",
    "signing_secret": "whsec_4f1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9"
  },
  "meta": {
    "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f"
  }
}
```

### 401 — Missing, malformed, expired or revoked bearer token. The `WWW-Authenticate` header carries the RFC 6750 challenge.

`application/json` — `ErrorEnvelope`

```json
{
  "error": {
    "code": "unauthorized",
    "message": "A valid bearer token is required.",
    "details": [],
    "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/unauthorized"
  }
}
```

### 403 — Token does not hold the required scope. `details` lists the scope(s) that were checked.

`application/json` — `ErrorEnvelope`

```json
{
  "error": {
    "code": "insufficient_scope",
    "message": "This token does not have the required scope.",
    "details": [
      {
        "field": "scope",
        "message": "executions:write"
      }
    ],
    "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/insufficient_scope"
  }
}
```

### 404 — Resource does not exist or belongs to another tenant / api_client

`application/json` — `ErrorEnvelope`

```json
{
  "error": {
    "code": "not_found",
    "message": "The requested resource was not found.",
    "details": [],
    "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/not_found"
  }
}
```

### 429 — Rate limit exceeded (60 req/min per IP on `/api/v1`, 600 req/hour
per token prefix, or 300 req/5 min per IP globally). The body is the
standard error envelope and `Retry-After` gives the seconds until
the window resets.


`application/json` — `ErrorEnvelope`

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded. Retry later.",
    "details": [],
    "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f",
    "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/rate_limited"
  }
}
```

## Code samples

### cURL

```shell
curl -X POST "https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/12/rotate_secret" \
  -H "Authorization: Bearer {{API_KEY}}"
```

### Node.js

```javascript
const response = await fetch("https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/12/rotate_secret", {
  method: "POST",
  headers: {
    "Authorization": "Bearer {{API_KEY}}"
  }
});

const { data, meta } = await response.json();
console.log(response.status, data, meta.request_id);
```

### Python

```python
import requests

response = requests.post(
    "https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/12/rotate_secret",
    headers={
        "Authorization": "Bearer {{API_KEY}}",
    },
)
response.raise_for_status()
payload = response.json()
print(payload["data"], payload["meta"]["request_id"])
```

### Ruby

```ruby
require "net/http"
require "json"

uri = URI("https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/12/rotate_secret")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer {{API_KEY}}"

response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
payload = JSON.parse(response.body)
puts payload["data"], payload.dig("meta", "request_id")
```

### Go

```go
package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("POST", "https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/12/rotate_secret", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer {{API_KEY}}")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	out, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(out))
}
```

### Agent

```shell
claude mcp add cascades \
  -e CASCADES_API_KEY={{API_KEY}} \
  -e CASCADES_PROD_BASE_URL=https://cascades.crscreditapi.com \
  -- npx -y @crscreditapi/cascades-mcp-server

# Then ask your assistant:
#   "Rotate the signing secret 12 using the Cascades API."
# No MCP tool covers this endpoint yet; the assistant can call POST /webhook_subscriptions/{id}/rotate_secret with curl.
```

## Related

- [Webhooks](https://cascades.crscreditapi.com/docs/concepts/webhooks)
- [Verify webhook signatures](https://cascades.crscreditapi.com/docs/guides/verify-webhooks)

## Sitemap

See the full [sitemap](https://cascades.crscreditapi.com/sitemap.md) for all pages.