> ## Documentation Index > Fetch the complete documentation index at: https://docs.emailx.ai/llms.txt > Use this file to discover all available pages before exploring further. # Rotate a webhook secret > Issues a new signing secret. The old one keeps working for 24 hours. Permission: `webhooks:manage` [Read the recovery rules](https://docs.emailx.ai/en/api-reference/idempotency.md) before retrying a write. Keep the same key and body for the same logical operation. ## OpenAPI ````yaml openapi/emailx.en.json POST /workspaces/{workspace_id}/webhook-endpoints/{endpoint_id}/secret-rotations openapi: 3.0.3 info: title: Emailx API version: 1.0.0-beta description: >- Customer and agency integrations for Emailx. Beta access is operator-issued. The v1 beta supports bounded People CSV/XLSX imports, saved email-template settings, selected email generation with explicit AI-credit confirmation, exact-message approval, reviewed email activation for native scheduled sending, and explicitly confirmed inbox replies bound to saved context when host capabilities permit. Inbox context is bounded and may be incomplete or stale; no provider refresh occurs. Manual LinkedIn imports, reviewed activation and reviewed resume of paused campaigns are separate gated workflows. Reply drafts, knowledge, team, infrastructure quotes with hosted checkout and agency administration are covered by separate scopes. Signed webhooks report durable operation outcomes. It does not support immediate batches or direct card charges. servers: - url: https://app.emailx.ai/api/v1 description: Emailx application ยท access must be enabled security: [] tags: - name: Getting started - name: Workspaces - name: Contacts - name: Templates - name: Campaigns - name: Inbox - name: Senders - name: Team - name: Analytics - name: Imports - name: Operations - name: Knowledge - name: Infrastructure - name: Agency paths: /workspaces/{workspace_id}/webhook-endpoints/{endpoint_id}/secret-rotations: post: tags: - Webhooks summary: Rotate a webhook secret description: |- Issues a new signing secret. The old one keeps working for 24 hours. Permission: `webhooks:manage` operationId: rotate_api_webhook_secret parameters: - name: workspace_id in: path required: true schema: type: integer minimum: 1 description: Emailx workspace (Clients) ID, not the agency workspace link ID. - name: endpoint_id in: path required: true schema: type: integer minimum: 1 description: Resource identifier. - name: Idempotency-Key in: header required: true schema: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9_.:/-]+$ description: Unique per logical mutation. Same path and body replay for 24 hours. requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/Empty' example: {} responses: '201': description: Created headers: X-Request-Id: schema: type: string Emailx-Api-Version: schema: type: string X-RateLimit-Limit: schema: type: string X-RateLimit-Remaining: schema: type: string X-RateLimit-Reset: schema: type: string content: application/json: schema: type: object properties: data: $ref: '#/components/schemas/WebhookEndpointWithSecret' required: - data example: data: id: 7 url: https://hooks.example.com/emailx description: CRM sync event_types: - operation.succeeded - operation.failed status: enabled disabled_reason: null consecutive_failures: 0 previous_secret_expires_at: null created_at: '2026-11-01T09:00:00Z' updated_at: '2026-11-01T09:00:00Z' secret: whsec_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= '400': description: Request error content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Invalid, expired or revoked API key content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Insufficient scope or write permission content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Resource missing or inaccessible content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: Conflict, concurrent request or uncertain original result content: application/json: schema: $ref: '#/components/schemas/Error' headers: Retry-After: schema: type: string description: Seconds to wait when present. '413': description: Request error content: application/json: schema: $ref: '#/components/schemas/Error' '415': description: Request error content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: Rate limited; respect Retry-After content: application/json: schema: $ref: '#/components/schemas/Error' headers: Retry-After: schema: type: string description: Seconds to wait when present. '500': description: Request error content: application/json: schema: $ref: '#/components/schemas/Error' '503': description: API disabled, request storage unavailable or feature not enabled content: application/json: schema: $ref: '#/components/schemas/Error' headers: Retry-After: schema: type: string description: Seconds to wait when present. security: - BearerAuth: [] x-codeSamples: - lang: cURL source: >- curl -X POST "https://app.emailx.ai/api/v1/workspaces/123/webhook-endpoints/{endpoint_id}/secret-rotations" \ -H "Authorization: Bearer $EMAILX_API_KEY" \ -H "Content-Type: application/json" \ -H "Idempotency-Key: example-operation-001" \ --data '{}' - lang: Python source: |- import os, requests response = requests.post( "https://app.emailx.ai/api/v1/workspaces/123/webhook-endpoints/{endpoint_id}/secret-rotations", headers={"Authorization": "Bearer " + os.environ["EMAILX_API_KEY"], "Idempotency-Key": "example-operation-001"}, json={}, timeout=30, ) response.raise_for_status() print(response.json()) - lang: JavaScript source: >- const response = await fetch("https://app.emailx.ai/api/v1/workspaces/123/webhook-endpoints/{endpoint_id}/secret-rotations", { method: "POST", headers: { Authorization: `Bearer ${process.env.EMAILX_API_KEY}`, "Content-Type": "application/json", "Idempotency-Key": "example-operation-001" }, body: JSON.stringify({}), signal: AbortSignal.timeout(30000), }); if (!response.ok) throw new Error(`Emailx: ${response.status}`); console.log(await response.json()); components: schemas: Empty: type: object properties: {} additionalProperties: false WebhookEndpointWithSecret: type: object properties: id: type: integer minimum: 1 url: type: string format: uri description: type: string nullable: true event_types: type: array minItems: 1 maxItems: 6 uniqueItems: true items: type: string enum: - operation.succeeded - operation.partially_succeeded - operation.failed - operation.cancelled - operation.needs_reconciliation - operation.awaiting_user_action status: type: string enum: - enabled - disabled disabled_reason: type: string nullable: true consecutive_failures: type: integer minimum: 0 previous_secret_expires_at: type: string nullable: true format: date-time created_at: type: string nullable: true format: date-time updated_at: type: string nullable: true format: date-time secret: type: string pattern: ^whsec_[A-Za-z0-9+/=]{44}$ description: Shown only in this response. Store it to verify webhook-signature. required: - id - url - event_types - status - consecutive_failures - secret Error: type: object properties: error: type: object properties: code: type: string message: type: string request_id: type: string details: type: object additionalProperties: true required: - code - message - request_id required: - error securitySchemes: BearerAuth: type: http scheme: bearer description: >- ex_test_ or ex_live_ key issued by an Emailx operator. Never use provider keys or session cookies. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.