> ## Documentation Index
> Fetch the complete documentation index at: https://docs.services.payward.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate webhook secret

> Rotates the webhook's signing secret and returns the new value.

The new secret replaces the previous secret. Deliveries also include a signature made with the old secret during a short grace period so partners can roll the new value out without dropped deliveries. The new signing secret is returned in plaintext exactly once. Partners must persist it and use it to verify the signature on inbound webhook deliveries.



## OpenAPI

````yaml https://d2588n1sy4m36o.cloudfront.net/uat/merged/openapi.json post /v1/webhooks/{webhook_id}/secret/rotate
openapi: 3.1.0
info:
  title: PWS Public API
  version: '1'
  description: >-
    Integrate with Payward Services to onboard users, manage accounts and funds,
    trade assets, and receive event notifications.
  contact:
    name: Payward Services
servers:
  - url: https://api.sandbox.services.payward.com
security: []
tags:
  - name: Assets
    description: List the assets PWS is willing to swap.
    x-displayName: Assets
  - name: Conversions
    description: >-
      Rule-driven and on-demand fiat ↔ crypto value movement, including
      conversion rules and deposits.
    x-displayName: Conversions
  - name: Auto Earn
    description: >-
      Manage Auto Earn preferences and retrieve allocation and reward
      information.
    x-displayName: Auto Earn
  - name: Bonded Earn
    description: >-
      Allocate funds to and deallocate funds from bonded earn strategies, review
      allocations, and track request status.
    x-displayName: Bonded Earn
  - name: Funding
    description: >-
      Discover deposit and withdrawal options, manage deposit addresses, and
      move funds between accounts.
    x-displayName: Funding
  - name: Derivative transfers
    description: >-
      Move funds between an account's spot balance and the same owner's futures
      balance.
    x-displayName: Derivative transfers
  - name: Portfolio
    description: 'Inspect a customer''s portfolio: balances, valuations, and transactions.'
    x-displayName: Portfolio
  - name: Ramp
    description: >-
      Support Ramp flows with discovery, quotes, limits, and hosted checkout
      experiences.
    x-displayName: Ramp
  - name: Reports
    description: Settlement and reconciliation reports for the partner.
    x-displayName: Reports
  - name: Swaps
    description: Account-funded quotes that lock a price until they expire or are executed.
    x-displayName: Swaps
  - name: Onchain quotes
    description: Wallet-funded quotes that return the data needed to settle onchain.
    x-displayName: Onchain quotes
  - name: Price trigger swaps
    description: Swaps that wait for a target price before submitting a trade.
    x-displayName: Price trigger swaps
  - name: Travel Rule verifications
    description: Travel Rule address ownership verification flows.
    x-displayName: Travel Rule verifications
  - name: Users
    description: >-
      User onboarding and status flows that the partner manages.


      - **Create User** provisions an account-owned user from an external
      reference and optional email.

      - **Get User** retrieves the user's profile, verification status, and
      required actions.


      Use the returned user `id` for calls that require the user's identifier.
    x-displayName: Users
  - name: Verifications
    description: Identity verification (KYC) submission and status for end users.
    x-displayName: Verifications
  - name: Webhooks
    description: >-
      Register HTTPS destinations to receive event deliveries, rotate signing
      secrets, and inspect, update, or delete existing subscriptions. Each
      subscription is owned by the authenticated partner; deliveries are signed
      with HMAC-SHA256 and retried on transient failures.
    x-displayName: Webhooks
paths:
  /v1/webhooks/{webhook_id}/secret/rotate:
    post:
      tags:
        - Webhooks
      summary: Rotate webhook secret
      description: >-
        Rotates the webhook's signing secret and returns the new value.


        The new secret replaces the previous secret. Deliveries also include a
        signature made with the old secret during a short grace period so
        partners can roll the new value out without dropped deliveries. The new
        signing secret is returned in plaintext exactly once. Partners must
        persist it and use it to verify the signature on inbound webhook
        deliveries.
      operationId: rotateWebhookSecret
      parameters:
        - in: path
          name: webhook_id
          required: true
          schema:
            description: Identifier returned by CreateWebhook.
            type: string
            minLength: 1
            maxLength: 64
          style: simple
          example: ep_2YuTbBzs6F8XUjWk7p7uA9KNdL5
      responses:
        '200':
          description: Successful response
          headers:
            X-Trace-Id:
              $ref: '#/components/headers/TraceId'
            Strict-Transport-Security:
              $ref: '#/components/headers/StrictTransportSecurity'
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
          content:
            application/json:
              schema:
                description: >-
                  Response from RotateWebhookSecret.


                  The new signing secret is returned in plaintext exactly once.
                  Partners must persist it before discarding the response; it
                  cannot be re-read later.
                type: object
                properties:
                  data:
                    description: >-
                      Data envelope returned exactly once after a successful
                      RotateWebhookSecret.
                    type: object
                    properties:
                      id:
                        description: Identifier of the webhook whose secret was rotated.
                        type: string
                      signing_secret:
                        description: >-
                          The new HMAC-SHA256 signing secret. Partners use this
                          to verify the signature header on every inbound
                          webhook delivery.
                        type: string
                        format: password
                    required:
                      - id
                      - signing_secret
                required:
                  - data
              examples:
                rotate-webhook-secret-response:
                  summary: Rotate webhook secret response
                  value:
                    data:
                      id: ep_2YuTbBzs6F8XUjWk7p7uA9KNdL5
                      signing_secret: whsec_MfJhd2pQ0sZ8nB4vK1xLrT6yWcEa5Ug
        '400':
          $ref: '#/components/responses/WebhooksBadRequestResponse'
        '401':
          $ref: '#/components/responses/WebhooksUnauthenticatedResponse'
        '403':
          $ref: '#/components/responses/WebhooksForbiddenResponse'
        '404':
          description: Webhook not found
          headers:
            X-Trace-Id:
              $ref: '#/components/headers/TraceId'
            Strict-Transport-Security:
              $ref: '#/components/headers/StrictTransportSecurity'
            Cache-Control:
              $ref: '#/components/headers/CacheControl'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Webhooks_WebhookNotFoundError'
              examples:
                webhook-not-found:
                  summary: Webhook not found
                  value:
                    error:
                      type: webhooks_error
                      status: 404
                      instance: req_01H00000000000000000000000
                      code: webhook_not_found
        '429':
          $ref: '#/components/responses/WebhooksResourceExhaustedResponse'
        '500':
          $ref: '#/components/responses/WebhooksInternalResponse'
        '503':
          $ref: '#/components/responses/WebhooksUnavailableResponse'
        '504':
          $ref: '#/components/responses/WebhooksDeadlineExceededResponse'
      security:
        - ApiKey: []
          ApiSign: []
          ApiNonce: []
components:
  headers:
    TraceId:
      description: Trace identifier for the request. Include it when contacting support.
      schema:
        type: string
        example: 4bf92f3577b34da6a3ce929d0e0e4736
    StrictTransportSecurity:
      description: Enforces HTTPS for the duration specified by `max-age`.
      schema:
        type: string
        example: max-age=31536000; includeSubDomains; preload
    CacheControl:
      description: Prevents caching of sensitive financial data. Always `no-store`.
      schema:
        type: string
        enum:
          - no-store
        example: no-store
  responses:
    WebhooksBadRequestResponse:
      description: Validation error
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/BadRequestError'
          examples:
            invalid-request:
              $ref: '#/components/examples/webhooks-bad-request'
    WebhooksUnauthenticatedResponse:
      description: Authentication failed
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/UnauthenticatedError'
          examples:
            authentication-failed:
              $ref: '#/components/examples/webhooks-unauthenticated'
    WebhooksForbiddenResponse:
      description: Permission denied
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ForbiddenError'
          examples:
            caller-is-not-allowed:
              $ref: '#/components/examples/webhooks-forbidden'
    WebhooksResourceExhaustedResponse:
      description: Rate limit exceeded
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ResourceExhaustedError'
          examples:
            rate-limit-exceeded:
              $ref: '#/components/examples/webhooks-resource-exhausted'
    WebhooksInternalResponse:
      description: Internal server error
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/InternalError'
          examples:
            internal-error:
              $ref: '#/components/examples/webhooks-internal'
    WebhooksUnavailableResponse:
      description: Service unavailable
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/UnavailableError'
          examples:
            service-unavailable:
              $ref: '#/components/examples/webhooks-service-unavailable'
    WebhooksDeadlineExceededResponse:
      description: Deadline exceeded
      headers:
        X-Trace-Id:
          $ref: '#/components/headers/TraceId'
        Strict-Transport-Security:
          $ref: '#/components/headers/StrictTransportSecurity'
        Cache-Control:
          $ref: '#/components/headers/CacheControl'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/DeadlineExceededError'
          examples:
            request-deadline-exceeded:
              $ref: '#/components/examples/webhooks-deadline-exceeded'
  schemas:
    Webhooks_WebhookNotFoundError:
      description: The requested webhook does not exist or is not accessible.
      allOf:
        - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
        - type: object
          required:
            - error
          properties:
            error:
              allOf:
                - $ref: '#/components/schemas/PwsGeneralError'
                - type: object
                  required:
                    - status
                    - code
                  properties:
                    status:
                      type: integer
                      format: int32
                      const: 404
                    code:
                      type: string
                      enum:
                        - webhook_not_found
    BadRequestError:
      title: Bad Request
      description: Request validation failed or the request could not be processed.
      oneOf:
        - title: Bad Request
          allOf:
            - $ref: '#/components/schemas/PwsValidationErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsValidationError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        status:
                          type: integer
                          format: int32
                          const: 400
                        code:
                          type: string
                          enum:
                            - bad_request
        - title: Gateway
          description: >-
            Gateway-level validation failure returned before the request reaches
            the service.
          allOf:
            - $ref: '#/components/schemas/PwsValidationErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsValidationError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        type:
                          type: string
                          const: service_error
                        status:
                          type: integer
                          format: int32
                          const: 400
                        code:
                          type: string
                          const: gateway
    UnauthenticatedError:
      title: Unauthenticated
      description: Authentication credentials are missing, invalid, or not accepted.
      oneOf:
        - title: Unauthenticated
          allOf:
            - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsGeneralError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        status:
                          type: integer
                          format: int32
                          const: 401
                        code:
                          type: string
                          enum:
                            - unauthenticated
        - title: Gateway
          description: Authentication failure returned by the API gateway.
          allOf:
            - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsGeneralError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        type:
                          type: string
                          const: service_error
                        status:
                          type: integer
                          format: int32
                          const: 401
                        code:
                          type: string
                          const: gateway
    ForbiddenError:
      title: Forbidden
      description: The caller is not allowed to perform this operation.
      oneOf:
        - title: Forbidden
          allOf:
            - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsGeneralError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        status:
                          type: integer
                          format: int32
                          const: 403
                        code:
                          type: string
                          enum:
                            - forbidden
        - title: Gateway
          description: Authorization failure returned by the API gateway.
          allOf:
            - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
            - type: object
              required:
                - error
              properties:
                error:
                  allOf:
                    - $ref: '#/components/schemas/PwsGeneralError'
                    - type: object
                      required:
                        - status
                        - code
                      properties:
                        type:
                          type: string
                          const: service_error
                        status:
                          type: integer
                          format: int32
                          const: 403
                        code:
                          type: string
                          const: gateway
    PwsGeneralErrorEnvelope:
      description: Error envelope for operational or domain failures.
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/PwsGeneralError'
          description: General error details.
    PwsGeneralError:
      description: Standard PWS API error object for non-validation failures.
      allOf:
        - $ref: '#/components/schemas/PwsErrorBase'
        - type: object
          properties:
            causes:
              description: Additional error details, when present.
              type: array
              items:
                type: object
                additionalProperties: true
    ResourceExhaustedError:
      description: The request was rate limited or a resource quota was exhausted.
      allOf:
        - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
        - type: object
          required:
            - error
          properties:
            error:
              allOf:
                - $ref: '#/components/schemas/PwsGeneralError'
                - type: object
                  required:
                    - status
                    - code
                  properties:
                    status:
                      type: integer
                      format: int32
                      const: 429
                    code:
                      type: string
                      enum:
                        - resource_exhausted
    InternalError:
      description: An unexpected server-side error occurred.
      allOf:
        - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
        - type: object
          required:
            - error
          properties:
            error:
              allOf:
                - $ref: '#/components/schemas/PwsGeneralError'
                - type: object
                  required:
                    - status
                    - code
                  properties:
                    status:
                      type: integer
                      format: int32
                      const: 500
                    code:
                      type: string
                      enum:
                        - internal
    UnavailableError:
      description: The service is temporarily unavailable.
      allOf:
        - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
        - type: object
          required:
            - error
          properties:
            error:
              allOf:
                - $ref: '#/components/schemas/PwsGeneralError'
                - type: object
                  required:
                    - status
                    - code
                  properties:
                    status:
                      type: integer
                      format: int32
                      const: 503
                    code:
                      type: string
                      enum:
                        - unavailable
    DeadlineExceededError:
      description: The request deadline was exceeded before a response could be produced.
      allOf:
        - $ref: '#/components/schemas/PwsGeneralErrorEnvelope'
        - type: object
          required:
            - error
          properties:
            error:
              allOf:
                - $ref: '#/components/schemas/PwsGeneralError'
                - type: object
                  required:
                    - status
                    - code
                  properties:
                    status:
                      type: integer
                      format: int32
                      const: 504
                    code:
                      type: string
                      enum:
                        - deadline_exceeded
    PwsValidationErrorEnvelope:
      description: Error envelope for request validation failures.
      type: object
      required:
        - error
      properties:
        error:
          $ref: '#/components/schemas/PwsValidationError'
          description: Validation error details.
    PwsValidationError:
      description: Standard PWS API error object for request validation failures.
      type: object
      required:
        - type
        - status
        - instance
        - code
      properties:
        type:
          description: Machine-readable error class.
          type: string
        status:
          description: HTTP status code returned for this error.
          type: integer
          format: int32
        instance:
          description: Request identifier for this specific error occurrence.
          type: string
        code:
          description: Stable machine-readable error code.
          type: string
        doc_url:
          description: Optional link to documentation for this error.
          type: string
          format: uri
        causes:
          description: Validation failures that contributed to the error.
          type: array
          items:
            $ref: '#/components/schemas/PwsErrorCause'
    PwsErrorBase:
      description: Common fields present on every PWS API error object.
      type: object
      required:
        - type
        - status
        - instance
        - code
      properties:
        type:
          description: Machine-readable error class.
          type: string
        status:
          description: HTTP status code returned for this error.
          type: integer
          format: int32
        instance:
          description: Request identifier for this specific error occurrence.
          type: string
        code:
          description: Stable machine-readable error code.
          type: string
        doc_url:
          description: Optional link to documentation for this error.
          type: string
          format: uri
    PwsErrorCause:
      description: A single request validation failure.
      type: object
      required:
        - field
        - message
      properties:
        field:
          description: Dot-notation path to the offending request field.
          type: string
        message:
          description: Human-readable explanation of the failed validation rule.
          type: string
  examples:
    webhooks-bad-request:
      summary: Invalid request
      value:
        error:
          type: webhooks_error
          instance: req_01H00000000000000000000000
          status: 400
          code: bad_request
          causes:
            - field: page_size
              message: must be between 1 and 25
    webhooks-unauthenticated:
      summary: Authentication failed
      value:
        error:
          type: webhooks_error
          instance: req_01H00000000000000000000000
          status: 401
          code: unauthenticated
    webhooks-forbidden:
      summary: Caller is not allowed
      value:
        error:
          type: webhooks_error
          instance: req_01H00000000000000000000000
          status: 403
          code: forbidden
    webhooks-resource-exhausted:
      summary: Rate limit exceeded
      value:
        error:
          type: webhooks_error
          instance: req_01H00000000000000000000000
          status: 429
          code: resource_exhausted
    webhooks-internal:
      summary: Internal error
      value:
        error:
          type: webhooks_error
          instance: req_01H00000000000000000000000
          status: 500
          code: internal
    webhooks-service-unavailable:
      summary: Service unavailable
      value:
        error:
          type: webhooks_error
          instance: req_01H00000000000000000000000
          status: 503
          code: unavailable
    webhooks-deadline-exceeded:
      summary: Request deadline exceeded
      value:
        error:
          type: webhooks_error
          instance: req_01H00000000000000000000000
          status: 504
          code: deadline_exceeded
  securitySchemes:
    ApiKey:
      type: apiKey
      in: header
      name: API-Key
      description: Your public API key. Identifies the partner making the request.
    ApiSign:
      type: apiKey
      in: header
      name: API-Sign
      description: HMAC signature over the request, computed with your private key.
    ApiNonce:
      type: apiKey
      in: header
      name: API-Nonce
      description: Monotonically increasing nonce included in the request signature.

````