> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trycontour.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate the signing secret

> Replace the signing secret.

The new secret is shown in this response only. The old one stops working
immediately, so update your handler's configuration before calling this.



## OpenAPI

````yaml api-reference/openapi.json POST /v1/webhook-endpoints/{endpoint_id}/rotate-secret
openapi: 3.1.0
info:
  description: >-
    Programmatic access to Contour from your own backend: place outbound calls,
    read their results, and manage the webhook endpoints that receive signed
    `call.started`, `call.ended` and `call.analyzed` events.
  title: Contour API
  version: '1.0'
servers:
  - url: https://api.contourvoice.com
security:
  - HTTPBearer: []
tags:
  - description: Place outbound calls and read their state and recordings.
    name: Calls
  - description: >-
      Register URLs to receive signed events, send test events, and inspect or
      retry deliveries.
    name: Webhook Endpoints
paths:
  /v1/webhook-endpoints/{endpoint_id}/rotate-secret:
    post:
      tags:
        - Webhook Endpoints
      summary: Rotate the signing secret
      description: |-
        Replace the signing secret.

        The new secret is shown in this response only. The old one stops working
        immediately, so update your handler's configuration before calling this.
      operationId: rotate_webhook_secret
      parameters:
        - in: path
          name: endpoint_id
          required: true
          schema:
            format: uuid
            title: Endpoint Id
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointSecretResponse'
          description: Successful Response
        '401':
          content:
            application/json:
              example:
                detail: Invalid or expired API key
          description: Missing or invalid API key.
        '404':
          content:
            application/json:
              example:
                detail: Webhook endpoint not found.
          description: No webhook endpoint with this id in your organization.
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
      security:
        - HTTPBearer: []
components:
  schemas:
    WebhookEndpointSecretResponse:
      description: Returned by create and rotate-secret only. ``secret`` is shown once.
      examples:
        - agent_ids:
            - 3f1c1b2e-6d1a-4c0e-9b2f-1a2b3c4d5e6f
          created_at: '2026-09-10T14:00:00Z'
          description: Production
          enabled: true
          events:
            - call.started
            - call.ended
            - call.analyzed
          id: b7e1c2d3-4f5a-4b6c-8d7e-9f0a1b2c3d4e
          secret: whsec_x9K2mQ7vR4tL8nP1sW5yB3dF6hJ0k9Qz
          secret_hint: k9Qz
          updated_at: '2026-09-10T14:00:00Z'
          url: https://example.com/webhooks/contour
      properties:
        agent_ids:
          anyOf:
            - items:
                format: uuid
                type: string
              type: array
            - type: 'null'
          description: Agent filter, or null for all calls in the organization.
          title: Agent Ids
        created_at:
          format: date-time
          title: Created At
          type: string
        description:
          anyOf:
            - type: string
            - type: 'null'
          description: Your label.
          title: Description
        enabled:
          description: False while deliveries are paused.
          title: Enabled
          type: boolean
        events:
          description: Subscribed events.
          items:
            type: string
          title: Events
          type: array
        id:
          description: Endpoint id; use it in every other endpoint call.
          format: uuid
          title: Id
          type: string
        secret:
          description: >-
            The signing secret (`whsec_...`). Shown in this response only; store
            it in your webhook handler's configuration.
          title: Secret
          type: string
        secret_hint:
          description: >-
            The last four characters of the signing secret, so you can tell
            which secret an endpoint is using without exposing it.
          title: Secret Hint
          type: string
        updated_at:
          format: date-time
          title: Updated At
          type: string
        url:
          description: Where events are delivered.
          title: Url
          type: string
      required:
        - id
        - url
        - events
        - enabled
        - secret_hint
        - created_at
        - updated_at
        - secret
      title: WebhookEndpointSecretResponse
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
  securitySchemes:
    HTTPBearer:
      description: >-
        Your organization's API key (`sk_cont_...`), sent as `Authorization:
        Bearer sk_cont_...`. Keep it server-side.
      scheme: bearer
      type: http

````