# Give an Endpoint a New Secret

A new secret for one endpoint, shown once. It signs every delivery to that endpoint from now on.

## Overview

- The old secret stops at once, for retries too. Deliveries your server refuses until it has the new secret are retried, so put it in place within a few minutes.
- `secretHint` and `secretRotatedAt` change with it; the rest of the endpoint stays as it is. No body.
- `404` `WEBHOOK_ENDPOINT_NOT_FOUND` for an endpoint that is not this tenant's. Same roles as [Add an Endpoint](https://docs.aureahub.com/docs/webhook-endpoint-add.md); written to the tenant's activity log with the new hint only.

> Note: **Your tenant's quorum** [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md) — where it holds administrators' actions (a tenant on the institutional security profile by its profile; every other tenant's records them only): this call answers `202` `{ "state": "awaiting_quorum", "requestId" }` — the **202** tab below — and nothing is done until another administrator of your tenant approves it; the answer it would have given is then read once by who asked ([Read the Answer](https://docs.aureahub.com/docs/quorum-request-result.md)). With no other administrator able to approve it, it is done at once. [Your Tenant's Quorum](https://docs.aureahub.com/docs/guide-tenant-quorum.md). Every other tenant gets the answers below, unchanged.

## Endpoint

### `POST /v1/admin/tenants/{id}/webhook-endpoints/{endpointId}/rotate-secret`

Authentication: bearer token required.

Gives the endpoint a new secret and returns it once.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes | Tenant UUID |
| `endpointId` | string | yes | The endpoint's id |

**Responses**

`200` Replaced

```json
{
  "endpoint": {
    "id": "8a3c5e71-2b4d-4f60-9e1a-7c2d4b6f8e01",
    "environment": "production",
    "url": "https://ledger.example.com/aurea/events",
    "description": "Ledger service",
    "eventTypes": ["ramp.deposit.updated", "ramp.transaction.updated"],
    "status": "active",
    "secretHint": "c9Qe",
    "secretRotatedAt": "2026-10-06T10:01:17.904Z",
    "createdAt": "2026-10-06T08:12:40.511Z",
    "updatedAt": "2026-10-06T10:01:17.904Z"
  },
  "secret": "whsec_… (44 characters of base64, ending c9Qe=)"
}
```

`202` Awaiting quorum

```json
{
  "state": "awaiting_quorum",
  "requestId": "4e2b9c17-8a3d-4f60-b5e1-7c9d0a2f6b38"
}
```

---

Web version: https://docs.aureahub.com/#webhook-endpoint-rotate