> ## Documentation Index
> Fetch the complete documentation index at: https://www.papers.bot/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate the webhook signing secret

> Returns the new signingSecret once, retaining the prior secret for one hour. Repeated rotation during that hour returns 409. Requires a human owner/admin session; agent API keys and delegated OAuth cannot administer the workspace.



## OpenAPI

````yaml /openapi.json post /webhook-endpoints/{id}/rotate-secret
openapi: 3.1.0
info:
  title: Papers API
  version: 0.1.0
  description: >-
    Email, SMS, and workspace resources for Papers. Authenticate resource
    requests with a scoped API key or OAuth token. Administrative endpoints
    require a human session.
servers:
  - url: https://www.papers.bot/v1
security:
  - bearerAuth: []
paths:
  /webhook-endpoints/{id}/rotate-secret:
    post:
      tags:
        - Webhook endpoints
      summary: Rotate the webhook signing secret
      description: >-
        Returns the new signingSecret once, retaining the prior secret for one
        hour. Repeated rotation during that hour returns 409. Requires a human
        owner/admin session; agent API keys and delegated OAuth cannot
        administer the workspace.
      operationId: rotateWebhookSecret
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful JSON response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        '429':
          description: >-
            Request rate limit or communication quota exceeded. Rate-limit
            responses include Retry-After.
          headers:
            Retry-After:
              description: >-
                Seconds until the request-rate window resets (rate_limited
                errors)
              schema:
                type: integer
                minimum: 1
                maximum: 60
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: Request rejected
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - sessionCookie: []
components:
  schemas:
    Error:
      $schema: https://json-schema.org/draft/2020-12/schema
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
            request_id:
              type: string
            retryable:
              type: boolean
            details:
              anyOf:
                - type: object
                  properties:
                    approvalId:
                      type: string
                      minLength: 1
                  required:
                    - approvalId
                  additionalProperties: false
                - type: array
                  items:
                    type: object
                    properties:
                      code:
                        type: string
                      path:
                        type: array
                        items:
                          type:
                            - string
                            - number
                      message:
                        type: string
                    required:
                      - code
                      - path
                      - message
                    additionalProperties: false
          required:
            - code
            - message
            - request_id
            - retryable
          additionalProperties: false
      required:
        - error
      additionalProperties: false
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        Workspace API key or delegated OAuth access token with /v1 resource
        audience. Administrative routes require the Better Auth browser session
        instead.
    sessionCookie:
      type: apiKey
      in: cookie
      name: __Secure-better-auth.session_token
      description: >-
        Better Auth session with selected organization. Mutations also require
        the trusted Origin header.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.