> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anivahealth.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate Secret

> Replace the signing secret of a webhook

Create a new signing secret for a webhook. The old secret keeps signing for 24 hours, until
`previous_secret_expires_at`. A second rotation within that time stops the oldest secret at once.

> [!NOTE]
>
> Requires the `webhooks_manage` scope.

## Request

### Path parameters

**id** `string` *required*

Webhook identifier (UUID).

### Body parameters

The body is optional.

**revoke\_current\_secret\_now** `boolean` (default: false)

`true` stops the current secret at once, for example after a leak.

## Response

On success, the API returns `200 OK` with the webhook and its new secret.

**secret** `string` *required*

The signing secret, `whsec_` plus base64. Aniva shows it only in this response. See [Verify the
signature](/concepts/webhooks#verify-the-signature).

**id** `string` *required*

Webhook identifier (UUID).

**url** `string` *required*

The HTTPS URL Aniva posts events to.

**description** `string`

Free text for your own reference. May be `null`.

**enabled\_events** `string[]` *required*

[Event types](/concepts/webhooks#events) this webhook receives. `*` means every type.

**alert\_emails** `string[]` *required*

Addresses Aniva emails when deliveries keep failing.

**status** `string` *required*

`enabled` or `disabled`.

**disabled\_at** `string`

ISO 8601 UTC instant the webhook was disabled. `null` while enabled.

**disabled\_reason** `string`

Why the webhook was disabled. See [Failure notices](/concepts/webhooks#failure-notices). `null`
while enabled.

**failing\_since** `string`

ISO 8601 UTC instant the current failure streak started. `null` when the last delivery succeeded.

**previous\_secret\_expires\_at** `string`

ISO 8601 UTC instant the previous secret stops signing. `null` when no rotation is in progress.

**created\_at** `string` *required*

ISO 8601 UTC instant the webhook was created.

**updated\_at** `string` *required*

ISO 8601 UTC instant of the last change.

## Error responses

| Status | Description |
| - | - |
| `400` | Invalid request. See the `error` message. |
| `401` | Invalid API key. |
| `403` | No API key, or an API key without the `webhooks_manage` scope. |
| `404` | Webhook not found, or it belongs to another API key. |
| `500` | Internal server error. |

```bash cURL theme={null}
curl --request POST \
  --url https://anivahealth.com/api/v1/webhooks/4a6c8e0f-2b4d-4f6a-8c0e-2a4c6e8f0b1d/rotate-secret \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "revoke_current_secret_now": false
  }'
```

```json 200 theme={null}
{
  "id": "4a6c8e0f-2b4d-4f6a-8c0e-2a4c6e8f0b1d",
  "url": "https://partner.example.com/webhooks/aniva",
  "description": "Production",
  "enabled_events": [
    "appointment.confirmed",
    "appointment.results.completed",
    "home_kit_order.results.completed"
  ],
  "alert_emails": ["ops@partner.example.com"],
  "status": "enabled",
  "disabled_at": null,
  "disabled_reason": null,
  "failing_since": null,
  "previous_secret_expires_at": "2026-10-17T10:00:00.000Z",
  "created_at": "2026-10-15T08:00:00.000Z",
  "updated_at": "2026-10-16T10:00:00.000Z",
  "secret": "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw8L0qsE2bkS4="
}
```

```json 404 theme={null}
{
  "error": "Webhook not found"
}
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.