> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paygood.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate a merchant webhook endpoint signing secret

> The plaintext signing secret is returned only once in this response. Delivery history is preserved.



## OpenAPI

````yaml /openapi.json post /merchants/{merchantId}/webhook-endpoints/{webhookEndpointId}/rotate-secret
openapi: 3.0.0
info:
  title: PayGood Merchant API
  description: Server-to-server integration surface for merchant API keys.
  version: '1448-03-01'
  contact: {}
servers:
  - url: https://api-sandbox.paygood.co
    description: Sandbox
  - url: https://api.paygood.co
    description: Production
security: []
paths:
  /merchants/{merchantId}/webhook-endpoints/{webhookEndpointId}/rotate-secret:
    post:
      tags:
        - merchant-webhook-endpoints
      summary: Rotate a merchant webhook endpoint signing secret
      description: >-
        The plaintext signing secret is returned only once in this response.
        Delivery history is preserved.
      operationId: MerchantWebhookEndpointsController_rotateSecret
      parameters:
        - name: webhookEndpointId
          required: true
          in: path
          description: Webhook endpoint TypeID (`whk_...`) to rotate.
          schema:
            type: string
        - name: merchantId
          required: true
          in: path
          description: Merchant TypeID (`mer_...`) owning the endpoint.
          schema:
            type: string
        - name: Idempotency-Key
          in: header
          description: >-
            Client-supplied unique key for safe retries of this mutating
            request. Scoped per merchant or resource as documented on each
            endpoint.
          required: true
          schema:
            type: string
            example: idem-01
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RotateWebhookEndpointSecretResponseDto'
      security:
        - bearer: []
components:
  schemas:
    RotateWebhookEndpointSecretResponseDto:
      type: object
      properties:
        webhookEndpointId:
          type: string
        signingSecret:
          type: string
          minLength: 1
        updatedAt:
          type: string
          format: date-time
          pattern: >-
            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
      required:
        - webhookEndpointId
        - signingSecret
        - updatedAt
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: merchant_<prefix>_<secret>
      type: http
      description: Merchant API key bearer token.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.