# Rotate webhook signing secret

Issue a new HMAC signing secret for an outbound webhook endpoint.

Source: https://statusdashboard.com/docs/api/integrations/webhooks/outbound/endpoints/rotate-signing-secret

`POST /app/integrations/webhooks/outbound/endpoints/signing-secret/rotate`

Replaces the endpoint’s outbound signing secret. The previous secret stops verifying immediately. The new secret is returned **once** in this response.

Requires the `admin` or `subscriber` role and the **integrations** feature entitlement.

***

## Request
See [API Basics](/docs/api) for required headers.

### Body
| Field         | Type                         | Required | Description                           |
| ------------- | ---------------------------- | -------- | ------------------------------------- |
| `dashboardId` | uuid                         | Yes      | Dashboard that owns the subscriber    |
| `urlHash`     | string (64-char SHA-256 hex) | Yes      | Stable endpoint hash from list/create |

***

## Sample request
```bash
curl -X POST https://api.statusdashboard.com/app/integrations/webhooks/outbound/endpoints/signing-secret/rotate \
  -H "Authorization: Bearer bcf847abf5c6:def456" \
  -H "Content-Type: application/json" \
  -d '{
    "dashboardId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "urlHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  }'
```

## Sample response
**Status: `200 OK`**

```json
{
  "signingSecret": "whout_newsecret…"
}
```

***

## Error responses
| Status | When                                 |
| ------ | ------------------------------------ |
| `400`  | Invalid body                         |
| `403`  | Missing role or integrations feature |
| `404`  | Dashboard or subscriber not found    |

***

## See also
* [Outbound Webhooks — Signing](/docs/integrations/webhooks/outbound#signing)
* [Create webhook endpoint](/docs/api/integrations/webhooks/outbound/endpoints/create)