> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracklysms.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate Signing Secret

> Rotate an endpoint's HMAC signing secret with a 24-hour grace window.

Generates a new signing secret while keeping the old one valid for a **24-hour grace window**. During the window, events carry the new signature in `X-Trackly-Signature` and the old one in `X-Trackly-Signature-Prev`, so you can roll the secret with **zero missed events**. See [Webhook Signing](/api-reference/v2/webhooks/signing#rotating-the-signing-secret).

## Path Parameters

<ParamField path="endpoint_id" type="string" required>
  The endpoint's id.
</ParamField>

## Examples

<RequestExample>
  ```bash cURL theme={null}
  curl -X POST https://api.tracklysms.com/api/v2/webhooks/66b0f7c84a1d4b2e9c3a1f2e/rotate-secret \
    -H "X-Api-Key: trk_your_api_key"
  ```
</RequestExample>

<ResponseExample>
  ```json 200 — Success theme={null}
  {
    "webhook": {
      "id": "66b0f7c84a1d4b2e9c3a1f2e",
      "url": "https://hooks.bizinga.com/trackly",
      "events": ["message.delivered", "message.failed"],
      "active": true,
      "signingSecret": "new64hex...",
      "previousSigningSecret": "old64hex...",
      "signingSecretRotatedAt": "2026-07-26T16:00:00Z"
    },
    "graceExpiresAt": "2026-07-27T16:00:00Z"
  }
  ```
</ResponseExample>

## Error Codes

| HTTP Status | Error Code       | Description                                 |
| ----------- | ---------------- | ------------------------------------------- |
| 404         | `not_found`      | No endpoint with that id on the account.    |
| 500         | `internal_error` | The rotation could not be completed; retry. |