> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prava.space/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate the Signing Secret

> Issue a new signing secret, keeping the old one valid for 24 hours.

Returns a new one-time `signing_secret` and `overlap_hours: 24`. The previous secret stays valid for **24 hours**, so accept both while you update your receiver. See [Security](https://docs.prava.space/webhooks/security.md).

This request requires an `Idempotency-Key` header and has no body, so omit `Content-Type: application/json`. A retry with the same key returns `{ "replayed": true, "overlap_hours": 24 }` without the secret.

You can't rotate again during the overlap: the request returns `409 WEBHOOK_ROTATION_OVERLAP`.


## OpenAPI

````yaml api-reference/openapi.json POST /v1/webhook-endpoints/{endpointId}/rotate-secret
openapi: 3.1.0
info:
  title: Prava Payments API
  description: >-
    Server-side REST API for Prava Payments. All requests are authenticated with
    your secret key (sk_test_* in sandbox, sk_live_* in production).
  version: 1.0.0
servers:
  - url: https://sandbox.api.prava.space
    description: Sandbox
  - url: https://api.prava.space
    description: Production
security:
  - bearerAuth: []
paths:
  /v1/webhook-endpoints/{endpointId}/rotate-secret:
    post:
      tags:
        - Webhooks
      summary: POST /v1/webhook-endpoints/{endpointId}/rotate-secret
      description: >-
        Gated preview; application and environment are derived from the secret
        key. See the Webhooks guide for delivery and signing contracts.
      parameters:
        - name: endpointId
          in: path
          required: true
          schema:
            type: string
        - name: Idempotency-Key
          in: header
          required: true
          schema:
            type: string
            pattern: ^[A-Za-z0-9_-]{8,120}$
      responses:
        '200':
          description: >-
            Successful operation; endpoints never include stored signing
            secrets.
          content:
            application/json:
              schema:
                oneOf:
                  - title: Rotated
                    type: object
                    required:
                      - signing_secret
                      - overlap_hours
                    properties:
                      signing_secret:
                        type: string
                        description: The new secret. Returned only on this response.
                      overlap_hours:
                        type: integer
                        const: 24
                        description: Hours the previous secret stays valid.
                  - title: Retry
                    type: object
                    required:
                      - replayed
                      - overlap_hours
                    properties:
                      replayed:
                        type: boolean
                        const: true
                      overlap_hours:
                        type: integer
                        const: 24
        '400':
          description: Invalid input or cursor
        '404':
          description: Resource not found in this application
        '409':
          description: Verification, idempotency, or endpoint state conflict
        '503':
          description: Preview disabled or temporarily unavailable
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Your secret key: sk_test_* (sandbox) or sk_live_* (production).'

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.