> ## Documentation Index
> Fetch the complete documentation index at: https://docs.partners.api.cobee.io/llms.txt
> Use this file to discover all available pages before exploring further.

# [DRAFT] Rotate signing secret

<Note>
  **Coming soon**: The Webhooks API is currently under design review. This documentation describes the target interface and may change before release.
</Note>

## Overview

Generates a new signing secret for the subscription and invalidates the previous one immediately.

> **Important**: rotate the secret if you suspect it has been compromised. Since the previous secret stops working at rotation time, update the secret in your endpoint as soon as you receive the response — deliveries signed with the new secret start immediately.


## OpenAPI

````yaml POST /webhooks/subscriptions/{subscriptionId}/secret
openapi: 3.0.1
info:
  title: Partners API
  description: >-
    Partners API definition where you can check the documentation for the
    different available operations to integrate with the platform.
  license:
    name: MIT
  version: 1.0.0
servers:
  - url: https://pre-partners-api.cobee.io/api/v3
  - url: https://partners-api.cobee.io/api/v3
security:
  - bearerAuth: []
paths:
  /webhooks/subscriptions/{subscriptionId}/secret:
    post:
      summary: Rotate the signing secret
      parameters:
        - name: subscriptionId
          in: path
          required: true
          description: The unique identifier of the webhook subscription
          schema:
            type: string
            format: uuid
          example: c3d4e5f6-a1b2-4c3d-8e5f-6a7b8c9d0e1f
      responses:
        '200':
          description: >-
            Signing secret successfully rotated. The previous secret is
            invalidated immediately — update your endpoint before rotating.
          content:
            application/json:
              schema:
                type: object
                required:
                  - id
                  - signingSecret
                properties:
                  id:
                    type: string
                    format: uuid
                    description: The unique identifier of the subscription.
                    example: c3d4e5f6-a1b2-4c3d-8e5f-6a7b8c9d0e1f
                  signingSecret:
                    type: string
                    description: >-
                      The new secret used to sign webhook payloads
                      (HMAC-SHA256).
                    example: whsec_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c
        '404':
          description: Not Found - The webhook subscription was not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                message: Resource not found
        '500':
          description: Internal Server Error - Something went wrong on our end
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                message: Internal server error
components:
  schemas:
    Error:
      required:
        - error
        - message
      type: object
      properties:
        error:
          type: integer
          format: int32
        message:
          type: string
      example:
        message: 'Bad request: Invalid field value'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

````