# POST /v1/webhooks/{endpoint_id}/roll-secret

> New signing secret; the old one is accepted for 24 hours.

In [Webhooks and events API](https://vestra.ai/developers/reference/api/webhooks-and-events.md): Where events go, how each delivery went, and the record of every event.

Send `Authorization: Bearer vk_test_...` on every call.

New signing secret; the old one is accepted for 24 hours.

Your API key, scope `setup` or `all`. On the card: [`events`](https://vestra.ai/developers/events.md). Over HTTP it is made from the contract: fill in each {…} and every value.

## Request

Path:

- `endpoint_id` (`string`, required): The webhook endpoint's id (`whk_...`).

## Answers 200

- `id` (`string`): The endpoint (whk_...). Example: `whk_2bq`.
- `object` (`"webhook_endpoint"`): Always webhook_endpoint.
- `url` (`string`): Where the events go.
- `events` (`(string | "*")[]`): The events it wants.
- `description` (`string | null`): Your note; null when you gave none.
- `active` (`boolean`): Whether events are sent to it.
- `mode` (`"live" | "test"`): The mode it hears: test or live, the mode of the key that made it. A test endpoint never hears a live event.
- `deployment_id` (`string | null`): Only this deployment's events reach it (dep_...), plus your account's, such as keys, users and usage alerts. Set when a deployment's vestra.yaml declared the endpoint. Null: every event its types allow.
- `managed_by` (`"file" | null`): file: declared in that deployment's vestra.yaml, so deploying the file changes it; null: you made it.
- `created_at` (`string`): When it was made, as an ISO 8601 time.
- `updated_at` (`string`): When it last changed, as an ISO 8601 time.
- `secret` (`string`): The signing secret, shown this once: check every delivery against it (the Vestra-Signature header). Keep it on your server. Example: `whsec_...`.

## Code

**HTTP**

```bash
curl -X POST "$VESTRA_BASE_URL/v1/webhooks/{endpoint_id}/roll-secret" \
  -H "Authorization: Bearer $VESTRA_API_KEY"
```

**TypeScript, Python, CLI, MCP**: No sample in your language for this route, so here it is over HTTP.