> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowpayroll.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate the signing secret

> Issues a new secret, returned once, with a new public key. The previous secret and its key keep signing for 24 hours, so every delivery carries both sets of signatures while you switch over.



## OpenAPI

````yaml /api-reference/specs/webhooks.json post /endpoints/{endpointId}/secrets
openapi: 3.1.1
info:
  title: Webhooks Service
  description: >-
    Outbound webhooks for FlowPayroll: register an endpoint, subscribe to event
    types, manage signing secrets, inspect the delivery log and replay.
  version: v1
servers:
  - url: https://api.sandbox.flowpayroll.ai/v1/webhooks
security:
  - X-Auth-Token: []
tags:
  - name: Alert contacts
  - name: Delivery log
  - name: Endpoint subscriptions
  - name: Endpoints
  - name: Event types
  - name: Events
  - name: Replays
paths:
  /endpoints/{endpointId}/secrets:
    post:
      tags:
        - Endpoints
      summary: Rotate the signing secret
      description: >-
        Issues a new secret, returned once, with a new public key. The previous
        secret and its key keep signing for 24 hours, so every delivery carries
        both sets of signatures while you switch over.
      operationId: CreateSigningSecret
      parameters:
        - name: endpointId
          in: path
          required: true
          schema:
            type: string
        - name: Idempotency-Key
          in: header
          description: >-
            Makes a retry safe: the same key from the same person with the same
            body within 24 hours gets the first response back instead of running
            again. The same key with a different request is refused with 409.
          schema:
            maxLength: 255
            type: string
      responses:
        '201':
          description: Created
          headers:
            Location:
              description: Where the new resource can be read.
              schema:
                type: string
                format: uri
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedSigningSecretResponseResponseBody'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObjectResponseBody'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObjectResponseBody'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObjectResponseBody'
components:
  schemas:
    CreatedSigningSecretResponseResponseBody:
      type: object
      properties:
        message:
          $ref: '#/components/schemas/MessageWithTokenResponse'
        content:
          $ref: '#/components/schemas/CreatedSigningSecretResponseContentResponse'
        validationIssues:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/ValidationIssue'
      additionalProperties: false
    ObjectResponseBody:
      type: object
      properties:
        message:
          $ref: '#/components/schemas/MessageWithTokenResponse'
        content:
          $ref: '#/components/schemas/ObjectContentResponse'
        validationIssues:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/ValidationIssue'
      additionalProperties: false
    MessageWithTokenResponse:
      type: object
      properties:
        text:
          type: string
        token:
          type: string
        tokenArguments:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/ValidationIssueArgument'
      additionalProperties: false
    CreatedSigningSecretResponseContentResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/CreatedSigningSecretResponse'
        metadata:
          $ref: '#/components/schemas/ContentMetadataResponse'
      additionalProperties: false
    ValidationIssue:
      type: object
      properties:
        field:
          type: string
        reason:
          type: string
        reasonToken:
          type: string
        reasonTokenArguments:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/ValidationIssueArgument'
      additionalProperties: false
    ObjectContentResponse:
      type: object
      properties:
        data:
          type: 'null'
        metadata:
          $ref: '#/components/schemas/ContentMetadataResponse'
      additionalProperties: false
    ValidationIssueArgument:
      type: object
      properties:
        name:
          type: string
        value:
          type: 'null'
      additionalProperties: false
    CreatedSigningSecretResponse:
      type: object
      properties:
        secret:
          $ref: '#/components/schemas/SigningSecretResponse'
        signingSecret:
          type: string
      additionalProperties: false
    ContentMetadataResponse:
      type: object
      properties:
        dateFormat:
          type: string
        dateTimeFormat:
          type: string
        paginationToken:
          type:
            - 'null'
            - string
          description: >-
            Cursor for the next page, present only when more results follow and
            null on the last page. Pass it back unmodified to continue; it is
            opaque and short-lived, so do not store it.
      additionalProperties: false
    SigningSecretResponse:
      required:
        - createdDate
        - publicKey
        - secretId
        - status
      type: object
      properties:
        secretId:
          type: string
        status:
          enum:
            - Revoked
            - Active
            - Expiring
          type: string
        createdDate:
          type: string
        expiresDate:
          type:
            - 'null'
            - string
        publicKey:
          type: string
      additionalProperties: false
  securitySchemes:
    X-Auth-Token:
      type: apiKey
      description: FlowPayroll JWT (raw token, no Bearer prefix)
      name: X-Auth-Token
      in: header

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.