> ## Documentation Index > Fetch the complete documentation index at: https://apidocs.scripe.io/llms.txt > Use this file to discover all available pages before exploring further. # Rotate the endpoint's signing secret > Mint a new plaintext signing secret and persist it as the canonical secret for the endpoint. The response carries the plaintext once; future reads expose only `secretLast4`. In-flight deliveries finish signing with the previous secret; anything enqueued after the rotation lands uses the new one. Plan a brief overlap window in your receiver if you can't afford a single missed verification. Not idempotent — every call generates a fresh secret. Requires the `webhooks:manage` scope. ## OpenAPI ````yaml /openapi/v1.yaml post /webhook-endpoints/{endpointId}/rotate-secret openapi: 3.1.0 info: title: Scripe Public API version: '2026-08-01' summary: Read-only access to Scripe workspaces, projects, notes, posts, and sources. description: | The Scripe public API gives integrators stable, versioned read access to a workspace's content surface. Phase 2 ships read endpoints only; write endpoints land in Phase 3. All endpoints (except `/v1/health`) require a Bearer API key. Pin the API version with the `Scripe-Api-Version` request header to opt out of breaking changes. contact: name: Scripe Support url: https://scripe.io/support email: support@scripe.io license: name: Proprietary servers: - url: https://api.scripe.io/v1 description: Production security: - BearerApiKey: [] tags: - name: Health description: Liveness and authenticated key smoke tests. - name: Workspace description: The workspace + principal resolved from your API key. - name: Projects description: Personal-brand, company-page, and amplifier projects. - name: Notes description: Project notes with paired calendar slot. - name: Posts description: Drafts, scheduled, and published LinkedIn posts. - name: Analytics description: Your own LinkedIn analytics and viral-post inspiration search. - name: Sources description: Transcriptions (audio/video sources) with truncated body. - name: Uploads description: >- Pre-signed S3 PUT URLs the customer uploads bytes to before referencing via Sources or Knowledge. - name: Knowledge description: >- Knowledge-base documents indexed for RAG. Async ingest via text, file, URL, or YouTube. - name: Jobs description: >- Async-job lifecycle — submitted via post-generation, knowledge ingest, file source. - name: Webhooks description: | Outbound HTTP callbacks. Subscribe an endpoint to one or more event names; we POST a signed JSON payload every time a matching event fires in the workspace. The signing secret is shown once on create and once on rotate — verify the `Webhook-Signature: t=,v1=` header on every delivery. paths: /webhook-endpoints/{endpointId}/rotate-secret: post: tags: - Webhooks summary: Rotate the endpoint's signing secret description: | Mint a new plaintext signing secret and persist it as the canonical secret for the endpoint. The response carries the plaintext once; future reads expose only `secretLast4`. In-flight deliveries finish signing with the previous secret; anything enqueued after the rotation lands uses the new one. Plan a brief overlap window in your receiver if you can't afford a single missed verification. Not idempotent — every call generates a fresh secret. Requires the `webhooks:manage` scope. operationId: rotateWebhookEndpointSecret parameters: - $ref: '#/components/parameters/ScripeApiVersion' - name: endpointId in: path required: true schema: type: string example: whe_a1b2c3d4e5f6g7h8 responses: '200': description: Secret rotated. Response carries the new plaintext secret. content: application/json: schema: $ref: '#/components/schemas/WebhookEndpointWithSecretResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/RateLimited' components: parameters: ScripeApiVersion: name: Scripe-Api-Version in: header required: false description: | Pin the API version. Format `YYYY-MM-DD`. Omit to receive the currently rolling default. Unknown versions return `400 version_unsupported`. schema: type: string example: '2026-08-01' schemas: WebhookEndpointWithSecretResponse: type: object required: - data properties: data: $ref: '#/components/schemas/WebhookEndpointWithSecret' WebhookEndpointWithSecret: allOf: - $ref: '#/components/schemas/WebhookEndpoint' - type: object required: - secret properties: secret: type: string description: | Plaintext signing secret. Returned exactly once — on create and on rotate-secret. Subsequent reads expose only `secretLast4`. Use this value to verify the `Webhook-Signature: t=,v1=` header on every delivery. Store immediately; we cannot recover it. example: >- whsec_4f9d3b6a1e2c8f0d7b5a4e9c2d1f8a3b6c5e0d9f2a1b4c7e8d3f6a5b2c1e0d4f Error: type: object required: - error properties: error: type: object required: - code - message - request_id - docs_url properties: code: type: string description: Stable, machine-readable error identifier. example: not_found message: type: string request_id: type: string example: req_a1b2c3d4e5f6 docs_url: type: string format: uri details: description: Optional structured payload — shape varies per code. WebhookEndpoint: type: object description: | Display-safe shape of a webhook endpoint. The plaintext signing secret is never present here — only `secretLast4`. Use `WebhookEndpointWithSecret` (returned by create + rotate) when the plaintext matters. required: - id - url - name - events - isActive - disabledReason - projectId - secretLast4 - createdAt properties: id: type: string example: whe_a1b2c3d4e5f6g7h8 url: type: string format: uri example: https://hooks.example.com/scripe name: type: string example: Production CRM events: type: array items: $ref: '#/components/schemas/WebhookEventName' example: - post.created - job.completed isActive: type: boolean disabledReason: type: string nullable: true description: | Why the endpoint was auto-disabled (e.g. `repeated_failures`, `url_resolves_private`). `null` when the endpoint is healthy or was manually disabled. projectId: type: string nullable: true description: | Optional project scope. When set, only events for that project fan out to this endpoint. `null` = workspace-wide. secretLast4: type: string minLength: 4 maxLength: 4 description: Last 4 chars of the plaintext signing secret — display only. createdAt: type: string format: date-time updatedAt: type: string format: date-time nullable: true WebhookEventName: type: string description: | Closed list of subscribable events. Adding a new event name is a contract change — bump the docs + this enum in lockstep with the producer. enum: - note.created - post.created - post.updated - post.scheduled - post.unscheduled - source.created - job.completed - job.failed - knowledge.indexed responses: Unauthorized: description: Missing, malformed, expired, or revoked API key. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Plan not eligible, scope missing, or workspace mismatch. content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: Resource not found in this workspace. content: application/json: schema: $ref: '#/components/schemas/Error' RateLimited: description: Sliding-window rate limit exceeded. headers: Retry-After: schema: type: integer X-RateLimit-Limit: schema: type: integer X-RateLimit-Remaining: schema: type: integer X-RateLimit-Reset: schema: type: integer content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: BearerApiKey: type: http scheme: bearer bearerFormat: scripe_sk_live_* description: | Pass `Authorization: Bearer scripe_sk_live_<...>` (or `scripe_sk_test_<...>` for test keys) on every request. Keys are scoped to a single workspace and can be revoked from the Scripe dashboard. ````