# Roll an endpoint's signing secret

`POST https://api.parasend.com/v1/webhook_endpoints/{id}/roll_secret`

Source: https://parasend.com/docs/api/webhooks/roll-secret

Authentication: `Authorization: Bearer <API key>` (a `ps_test_` key in test mode, `ps_live_` in live mode).
Send an `Idempotency-Key` header: a retry with the same key returns the first answer.

Creates a new signing secret and returns the endpoint with it in `secret` — the only time it is shown. The previous secret stays valid for 24 hours (`previous_secret_expires_at`): during that window every request carries two v1 values in Parasend-Signature, `t=<t>,v1=<hmac with new>,v1=<hmac with previous>`, so the receiver can switch without a gap. Rolling again inside the window drops the older previous secret at once (only one previous secret is kept). Audit webhook_endpoint.secret_rolled.

## Path parameters

- `id` (string, required): The webhook endpoint's ID, starting `whk_`.

## Example: Roll an endpoint's signing secret

```bash
curl -X POST "https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA/roll_secret" \
  -H "Authorization: Bearer $PARASEND_KEY" \
  -H "Idempotency-Key: $(uuidgen)"
```

```js
const res = await fetch('https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA/roll_secret', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.PARASEND_KEY}`,
    'Idempotency-Key': crypto.randomUUID(),
  },
});
const data = await res.json();
```

## Response 200

The endpoint, with the new secret in `secret`.

```json
{
  "id": "whk_01M6R27T4KCSN7M0CHFGVH7JRA",
  "object": "webhook_endpoint",
  "url": "https://hooks.fyrirtaeki.example/parasend",
  "event_types": [
    "delivery.confirmed",
    "delivery.bounced",
    "delivery.expired"
  ],
  "description": "Case system",
  "secret": "whsec_rRFB9XFIxFTnLDYnjK9XUyGO61WwvXXRNq9Nfw5cBuQ",
  "auth": {
    "mode": "none",
    "static_bearer": null,
    "oauth2": null
  },
  "delivery_sources": null,
  "status": "enabled",
  "livemode": false,
  "exhausted_events": 0,
  "last_exhausted_at": null,
  "retrying_events": 0,
  "last_attempt": {
    "created": "2026-11-06T09:15:05.775Z",
    "ok": true,
    "status_code": 200,
    "latency_ms": 0,
    "failure_stage": null,
    "error": null,
    "replay": true,
    "test": false
  },
  "created_by": {
    "user_id": "usr_01M6R27SYD4B50414S0BZ4KBKR",
    "name": "Jóna Jónsdóttir",
    "via": "api_key"
  },
  "previous_secret_expires_at": "2026-11-07T09:15:05.963Z",
  "created": "2026-11-06T09:15:05.746Z"
}
```

Errors: one shape, `{"error": {type, code, message, param, request_id}}`; every code is listed at https://parasend.com/docs/errors.