> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unifystays.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate Webhook Secret

> Issue a new signing secret with a 24-hour verification overlap.

The new `signing_secret` becomes active immediately and is returned only in this
response. The previous secret remains valid until
`previous_secret_valid_until`.

During the 24-hour overlap, webhook requests include both `v1` and `v0`
signatures. Update your receiver to accept the new secret before removing the
old one.

[Read the signature verification guide](/guides/verify-webhook-signatures)


## OpenAPI

````yaml reference/openapi.json POST /webhooks/endpoints/{endpoint_id}/rotate-secret
openapi: 3.0.0
info:
  title: Unifystays API
  description: >-
    One unified hotel API across suppliers. Integrate once, then enable and
    manage suppliers from the Unifystays portal.
  version: '1.0'
  contact: {}
servers:
  - url: https://api-sandbox.unifystays.com
    description: Sandbox
  - url: https://api.unifystays.com
    description: Production
security:
  - x-api-key: []
tags: []
paths:
  /webhooks/endpoints/{endpoint_id}/rotate-secret:
    post:
      tags:
        - Webhooks
      summary: Rotate an endpoint signing secret
      description: >-
        Issues a new secret immediately. During the 24-hour overlap, deliveries
        include signatures for both the new and previous secrets.
      operationId: WebhookController_rotateSecret
      parameters:
        - name: endpoint_id
          required: true
          in: path
          description: Webhook endpoint UUID.
          schema:
            example: 8b95a9e0-4af3-4c6d-92df-84b64256d27f
            type: string
        - name: language
          description: Enter language code(ex. en)
          in: header
          schema: {}
      responses:
        '200':
          description: Signing secret rotated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointRotatedResponseDto'
components:
  schemas:
    WebhookEndpointRotatedResponseDto:
      type: object
      properties:
        id:
          type: string
          format: uuid
          example: 8b95a9e0-4af3-4c6d-92df-84b64256d27f
          description: Unique webhook endpoint identifier.
        name:
          type: string
          example: Production booking events
          description: Human-readable endpoint name.
        url:
          type: string
          format: uri
          example: https://example.com/webhooks/unifystays
          description: URL that receives signed webhook POST requests.
        status:
          type: string
          enum:
            - ACTIVE
            - PAUSED
            - DISABLED
          example: ACTIVE
          description: >-
            Current endpoint state. Paused and disabled endpoints do not receive
            new deliveries.
        event_types:
          type: array
          example:
            - booking.confirmed
            - booking.cancelled
          description: Normalized event subscriptions for this endpoint.
          items:
            type: string
            enum:
              - booking.created
              - booking.confirmed
              - booking.failed
              - booking.cancellation_requested
              - booking.cancelled
              - booking.cancellation_failed
              - booking.*
        consecutive_failures:
          type: number
          example: 0
          description: >-
            Consecutive delivery failures since the last success or
            reactivation.
        last_success_at:
          type: string
          format: date-time
          nullable: true
          example: '2026-08-08T08:30:00.000Z'
          description: Time of the most recent successful delivery, if any.
        last_failure_at:
          type: string
          format: date-time
          nullable: true
          example: null
          description: Time of the most recent failed delivery, if any.
        disabled_at:
          type: string
          format: date-time
          nullable: true
          example: null
          description: Time the endpoint was disabled, if applicable.
        disabled_reason:
          type: string
          nullable: true
          example: null
          description: Reason the endpoint was disabled, if applicable.
        created_at:
          type: string
          format: date-time
          example: '2026-08-08T08:00:00.000Z'
          description: Endpoint creation time.
        updated_at:
          type: string
          format: date-time
          example: '2026-08-08T08:30:00.000Z'
          description: Time the endpoint was last updated.
        signing_secret:
          type: string
          example: whsec_************************
          description: >-
            HMAC signing secret. Returned only once; store it securely before
            discarding the response.
        previous_secret_valid_until:
          type: string
          format: date-time
          nullable: true
          example: '2026-08-09T08:30:00.000Z'
          description: >-
            Time until which signatures made with the previous secret remain
            valid.
      required:
        - id
        - name
        - url
        - status
        - event_types
        - consecutive_failures
        - last_success_at
        - last_failure_at
        - disabled_at
        - disabled_reason
        - created_at
        - updated_at
        - signing_secret
        - previous_secret_valid_until
  securitySchemes:
    x-api-key:
      type: apiKey
      in: header
      name: x-api-key
      description: Environment-specific API key created in the Unifystays portal

````