---
title: "Rotate the signing secret"
description: "Trillet OEM API: Returns a new secret."
openapi: /public/openapi/trillet-oem.yaml POST /partner/v1/webhook-endpoints/{id}/rotate-secret
lastUpdated: "2026-10-28"
---

> **For AI agents:** the complete documentation index is at [llms.txt](https://docs.trillet.ai/llms.txt). Append `.md` to any page URL for its markdown version.

`POST https://api.trillet.ai/partner/v1/webhook-endpoints/{id}/rotate-secret`

Returns a new `secret`. The previous secret keeps signing alongside the new one for 24 hours.
Needs `webhooks:write` and a key that is not restricted to some tenants.

## Authentication

- `partnerKey` — http bearer (tpk_live_...)

## Response 200

The endpoint with its new secret.
  - response
    - (allOf)
      - value
        - (allOf)
          - value (object)
            - object: … (nested further)
            - id: … (nested further)
            - url: … (nested further)
            - description: … (nested further)
            - enabledEvents: … (nested further)
            - status: … (nested further)
            - disabledReason: … (nested further)
            - failingSince: … (nested further)
            - includeConversationData: … (nested further)
            - redactPII: … (nested further)
            - createdAt: … (nested further)
          - value (object)
            - secret: … (nested further)
      - value (object)
        - `previousSecretExpiresAt` (string | null, date-time) — When the previous secret stops signing, or `null` when there was none.

## Response 401

The partner key is missing, malformed, unknown or revoked (`partner_key_required`, `invalid_api_key`, `partner_not_enabled`).
  - response (object)
    - `error` (object, required)
      - `type` (string, required, one of: invalid_request_error, authentication_error, permission_error, conflict_error, rate_limit_error, api_error, idempotency_error)
      - `code` (string, required) — A stable code. Handle errors by `code`, not by `message`.
      - `message` (string, required)
      - `param` (string) — The request field the error is about, when there is one.
      - `requestId` (string | null) — Include it when you contact support. Not present on idempotency errors.

## Response 403

`missing_scope`, or `key_restricted` on webhook endpoint routes.
  - response (object)
    - `error` (object, required)
      - `type` (string, required, one of: invalid_request_error, authentication_error, permission_error, conflict_error, rate_limit_error, api_error, idempotency_error)
      - `code` (string, required) — A stable code. Handle errors by `code`, not by `message`.
      - `message` (string, required)
      - `param` (string) — The request field the error is about, when there is one.
      - `requestId` (string | null) — Include it when you contact support. Not present on idempotency errors.

## Response 404

Not found, or not yours. For example `tenant_not_found`.
  - response (object)
    - `error` (object, required)
      - `type` (string, required, one of: invalid_request_error, authentication_error, permission_error, conflict_error, rate_limit_error, api_error, idempotency_error)
      - `code` (string, required) — A stable code. Handle errors by `code`, not by `message`.
      - `message` (string, required)
      - `param` (string) — The request field the error is about, when there is one.
      - `requestId` (string | null) — Include it when you contact support. Not present on idempotency errors.


---

📦 **OpenAPI specs:** Every OpenAPI specification referenced by this documentation is available as a single download — https://docs.trillet.ai/api-specs.zip