> ## Documentation Index > Fetch the complete documentation index at: https://developer.payrollintegrations.com/llms.txt > Use this file to discover all available pages before exploring further. # Rotate Webhook Signing Secret > Replaces the signing secret of an active webhook subscription and returns the new secret, which is shown only in this response. For 24 hours after a rotation, every delivery carries two entries in `webhook-signature`: one made with the new secret and one with the previous secret, so your verifier keeps accepting deliveries while you switch it to the new secret. After that only the new secret signs. Rotating again within the 24 hours retires the oldest secret immediately. If the previous secret may have leaked, end the overlap at once with DELETE /webhooks/subscriptions/{webhook_subscription_id}/signing-secret/previous. A subscription created before delivery signing was introduced has no secret and receives no deliveries until it is rotated once with this endpoint. Responds 404 when the subscription does not exist, is inactive, or belongs to another entity. > [!NOTE] > > The previous secret keeps signing alongside the new one for 24 hours. Learn > more about [rotating a signing > secret](https://developer.payrollintegrations.com/api-reference/prod/webhook-subscriptions.md#rotate-a-signing-secret) > and [verifying deliveries](https://developer.payrollintegrations.com/api-reference/prod/webhook-subscriptions.md#webhook-signatures). ## OpenAPI ````yaml api-reference/openapi.json POST /v1/webhooks/subscriptions/{webhook_subscription_id}/signing-secret openapi: 3.0.3 info: title: Payroll Integrations Public API version: 1.0.0 description: Public API for Payroll Integrations platform license: name: MIT servers: - url: https://api.payrollintegrationsapp.com description: Production security: [] tags: - name: auth - name: employer-identifiers - name: meta - name: payroll-connections - name: payroll-platforms - name: users - name: webhooks paths: /v1/webhooks/subscriptions/{webhook_subscription_id}/signing-secret: post: tags: - webhooks summary: Rotate a webhook subscription signing secret description: >- Replaces the signing secret of an active webhook subscription and returns the new secret, which is shown only in this response. For 24 hours after a rotation, every delivery carries two entries in `webhook-signature`: one made with the new secret and one with the previous secret, so your verifier keeps accepting deliveries while you switch it to the new secret. After that only the new secret signs. Rotating again within the 24 hours retires the oldest secret immediately. If the previous secret may have leaked, end the overlap at once with DELETE /webhooks/subscriptions/{webhook_subscription_id}/signing-secret/previous. A subscription created before delivery signing was introduced has no secret and receives no deliveries until it is rotated once with this endpoint. Responds 404 when the subscription does not exist, is inactive, or belongs to another entity. operationId: post_v1_webhooks_subscriptions_webhook_subscription_id_signing_secret parameters: - name: webhook_subscription_id in: path required: true schema: description: Unique identifier of the webhook subscription type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ description: Unique identifier of the webhook subscription example: 00000000-0000-0000-0000-000000000000 responses: '200': description: Signing secret rotated content: application/json: schema: $ref: >- #/components/schemas/RotateWebhookSubscriptionSigningSecretResponse example: webhookSubscriptionId: 00000000-0000-0000-0000-000000000000 signingSecret: whsec_AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8= '400': description: Invalid request parameters content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Invalid or missing token content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' headers: WWW-Authenticate: schema: description: Authentication challenge (Bearer) type: string description: Authentication challenge (Bearer) '403': description: Insufficient permissions or access denied content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: Webhook subscription not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' headers: Retry-After: schema: description: Number of seconds to wait before retrying type: string description: Number of seconds to wait before retrying '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: RotateWebhookSubscriptionSigningSecretResponse: type: object properties: webhookSubscriptionId: description: Unique identifier of the webhook subscription type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ signingSecret: description: >- HMAC-SHA256 key for verifying deliveries (Standard Webhooks, `whsec_` prefixed base64). Shown only in this response; it cannot be retrieved again. type: string required: - webhookSubscriptionId - signingSecret additionalProperties: false ErrorResponse: type: object properties: message: description: Human-readable error message type: string errors: description: Array of specific error details type: array items: type: string required: - message - errors additionalProperties: false securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Bearer token obtained from the /v1/auth/token endpoint. Send as: Authorization: Bearer . ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.