> ## Documentation Index
> Fetch the complete documentation index at: https://developer.payrollintegrations.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke Previous Signing Secret

> Ends the 24-hour overlap that follows a rotation: from the next delivery, only the current signing secret signs. Use it once your verifier has switched to the new secret, or straight after rotating if the previous secret may have leaked. Succeeds when there is no previous secret. Responds 404 when the subscription does not exist, is inactive, or belongs to another entity.

> [!WARNING]
>
> Deliveries are signed only with the current secret from the next delivery
> onward. Revoke the previous secret only after the receiving server verifies
> with the new one, or immediately if the previous secret may have been
> exposed. Learn more about [rotating a signing
> secret](https://developer.payrollintegrations.com/api-reference/prod/webhook-subscriptions.md#rotate-a-signing-secret).


## OpenAPI

````yaml api-reference/openapi.json DELETE /v1/webhooks/subscriptions/{webhook_subscription_id}/signing-secret/previous
openapi: 3.0.3
info:
  title: Payroll Integrations Public API
  version: 1.0.0
  description: Public API for Payroll Integrations platform
  license:
    name: MIT
servers:
  - url: https://api.payrollintegrationsapp.com
    description: Production
security: []
tags:
  - name: auth
  - name: employer-identifiers
  - name: meta
  - name: payroll-connections
  - name: payroll-platforms
  - name: users
  - name: webhooks
paths:
  /v1/webhooks/subscriptions/{webhook_subscription_id}/signing-secret/previous:
    delete:
      tags:
        - webhooks
      summary: Revoke the previous webhook signing secret
      description: >-
        Ends the 24-hour overlap that follows a rotation: from the next
        delivery, only the current signing secret signs. Use it once your
        verifier has switched to the new secret, or straight after rotating if
        the previous secret may have leaked. Succeeds when there is no previous
        secret. Responds 404 when the subscription does not exist, is inactive,
        or belongs to another entity.
      operationId: >-
        delete_v1_webhooks_subscriptions_webhook_subscription_id_signing_secret_previous
      parameters:
        - name: webhook_subscription_id
          in: path
          required: true
          schema:
            description: Unique identifier of the webhook subscription
            type: string
            format: uuid
            pattern: >-
              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
          description: Unique identifier of the webhook subscription
          example: 00000000-0000-0000-0000-000000000000
      responses:
        '204':
          description: Previous signing secret revoked
        '400':
          description: Invalid request parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Invalid or missing token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          headers:
            WWW-Authenticate:
              schema:
                description: Authentication challenge (Bearer)
                type: string
              description: Authentication challenge (Bearer)
        '403':
          description: Insufficient permissions or access denied
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Webhook subscription not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          headers:
            Retry-After:
              schema:
                description: Number of seconds to wait before retrying
                type: string
              description: Number of seconds to wait before retrying
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - bearerAuth: []
components:
  schemas:
    ErrorResponse:
      type: object
      properties:
        message:
          description: Human-readable error message
          type: string
        errors:
          description: Array of specific error details
          type: array
          items:
            type: string
      required:
        - message
        - errors
      additionalProperties: false
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        Bearer token obtained from the /v1/auth/token endpoint. Send as:
        Authorization: Bearer <token>.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.