> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stabyl.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate a Partner webhook signing secret

> Generates and returns a new Standard Webhooks secret exactly once. The previous secret remains valid only for the configured overlap; a second rotation during overlap returns 409.



## OpenAPI

````yaml /openapi/openapi.json post /partner/webhooks/{webhook_id}/secret/rotate
openapi: 3.1.0
info:
  title: Stabyl API
  description: >-
    REST API for approved Stabyl accounts to automate exchange, wallet, and
    non-production simulation workflows.
  contact:
    name: Stabyl Support
    email: support@stabyl.com
  license:
    name: Proprietary
  version: 1.0.0
servers:
  - url: https://api.stabyl.com/v1
    description: Production
  - url: https://api-staging.stabyl.com/v1
    description: Staging
security: []
tags:
  - name: Exchange
    description: Trading market data and order management for account automation.
  - name: Wallets
    description: >-
      Supported routes, deposit destinations, balances, transactions, and saved
      recipients.
  - name: Webhooks
    description: >-
      Outbound event delivery configuration and eventually consistent delivery
      history. Verify Standard Webhooks webhook-id, webhook-timestamp, and
      webhook-signature headers against the unchanged raw request body before
      parsing JSON.
  - name: Simulation
    description: Non-production endpoints for testing integration behavior.
paths:
  /partner/webhooks/{webhook_id}/secret/rotate:
    post:
      tags:
        - Webhooks
      summary: Rotate a Partner webhook signing secret
      description: >-
        Generates and returns a new Standard Webhooks secret exactly once. The
        previous secret remains valid only for the configured overlap; a second
        rotation during overlap returns 409.
      operationId: post_partner_webhooks_webhook_id_secret_rotate
      parameters:
        - name: webhook_id
          in: path
          description: Webhook endpoint identifier
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: Secret rotated and shown once
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - data
                properties:
                  data:
                    $ref: '#/components/schemas/RotatePartnerWebhookSecretResponse'
                  status:
                    type: string
                    enum:
                      - success
              example:
                data:
                  previous_secret_valid_until: '2026-07-13T11:00:00Z'
                  secret: whsec_<new-shown-once>
                  secret_version: 2
                  webhook_id: 01980d95-5537-76aa-88a8-ad59117632ef
                status: success
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - error
                properties:
                  error:
                    type: object
                    required:
                      - code
                      - message
                    properties:
                      code:
                        type: string
                        example: UNAUTHORIZED
                      message:
                        type: string
                        example: missing X-Api-Key header
                  status:
                    type: string
                    enum:
                      - error
              example:
                error:
                  code: UNAUTHORIZED
                  message: missing X-Api-Key header
                status: error
        '403':
          description: Missing `webhooks:manage`
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - error
                properties:
                  error:
                    type: object
                    required:
                      - code
                      - message
                    properties:
                      code:
                        type: string
                        example: MISSING_SCOPE
                      message:
                        type: string
                        example: missing_scope
                  status:
                    type: string
                    enum:
                      - error
              example:
                error:
                  code: MISSING_SCOPE
                  message: missing_scope
                status: error
        '404':
          description: Endpoint not found
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - error
                properties:
                  error:
                    type: object
                    required:
                      - code
                      - message
                    properties:
                      code:
                        type: string
                        example: NOT_FOUND
                      message:
                        type: string
                        example: resource not found
                  status:
                    type: string
                    enum:
                      - error
              example:
                error:
                  code: NOT_FOUND
                  message: resource not found
                status: error
        '409':
          description: Secret rotation overlap is still active
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - error
                properties:
                  error:
                    type: object
                    required:
                      - code
                      - message
                    properties:
                      code:
                        type: string
                        example: SECRET_ROTATION_IN_PROGRESS
                      message:
                        type: string
                        example: secret_rotation_in_progress
                  status:
                    type: string
                    enum:
                      - error
              example:
                error:
                  code: SECRET_ROTATION_IN_PROGRESS
                  message: secret_rotation_in_progress
                status: error
        '503':
          description: Partner webhook mutation is disabled
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - error
                properties:
                  error:
                    type: object
                    required:
                      - code
                      - message
                    properties:
                      code:
                        type: string
                        example: PARTNER_WEBHOOKS_DISABLED
                      message:
                        type: string
                        example: partner_webhooks_disabled
                  status:
                    type: string
                    enum:
                      - error
              example:
                error:
                  code: PARTNER_WEBHOOKS_DISABLED
                  message: partner_webhooks_disabled
                status: error
      security:
        - api_key: []
components:
  schemas:
    RotatePartnerWebhookSecretResponse:
      type: object
      required:
        - webhook_id
        - secret
        - secret_version
        - previous_secret_valid_until
      properties:
        previous_secret_valid_until:
          type: string
          format: date-time
        secret:
          type: string
          description: New signing secret shown only in this rotation response.
          example: whsec_<shown-once>
        secret_version:
          type: integer
          format: int32
        webhook_id:
          type: string
          format: uuid
  securitySchemes:
    api_key:
      type: apiKey
      in: header
      name: X-Api-Key
      description: >-
        API credential. Withdrawal quote and submit operations additionally
        require the documented Ed25519 timestamp, nonce, and signature headers.
      x-default: sb_test_your_key

````