> ## Documentation Index > Fetch the complete documentation index at: https://docs.opper.ai/llms.txt > Use this file to discover all available pages before exploring further. # Rotate a project's webhook signing secret > Replaces the project's signing secret and returns the new one. For 24 hours webhooks carry two signatures, one with the new secret and one with the previous, so your endpoint can switch without dropping a delivery; after that only the new one signs. Rotating again within the 24 hours retires the previous secret at once. Requires the `apikeys:write` scope. ## OpenAPI ````yaml post /management/v1/projects/{uuid}/webhook/secret/rotate openapi: 3.1.0 info: description: Schema-driven generative API that orchestrates LLM-powered workflows. title: Task API version: 3.0.0 servers: - description: Production url: https://api.opper.ai - description: Local development url: http://localhost:8080 security: - BearerAuth: [] tags: - description: OpenAI-compatible chat completions name: Chat - description: OpenAI Responses API compatible endpoint name: Responses - description: Google-compatible interactions endpoint name: Interactions - description: Model registry and capabilities name: Models - description: Synchronous image generation name: Images - description: Text-to-speech and speech-to-text name: Audio - description: Asynchronous video generation name: Videos - description: Realtime WebSocket sessions and their ephemeral tickets name: Realtime - description: Many requests on a provider's batch API at the batch price name: Batches - description: Reusable file storage for media inputs and generated outputs name: Files - description: Async generation status and downloads name: Artifacts - description: >- Signed completion webhooks for async jobs, and the project secret that signs them name: Webhooks - description: OpenAI-compatible embeddings name: Embeddings - description: Recorded HTTP request/response generations name: Generations - description: System health and status name: System - description: Roundtable endpoint — fan out a query to multiple LLMs and combine results name: Roundtable - description: Web search, fetch, and other utility tools name: Tools - description: Caller identity, credits, and usage name: Account - description: >- Programmatic project and API-key management. Authenticates with an `op-mak-…` management token; available on the control_plane and enterprise plans. name: Management paths: /management/v1/projects/{uuid}/webhook/secret/rotate: post: tags: - Management summary: Rotate a project's webhook signing secret description: >- Replaces the project's signing secret and returns the new one. For 24 hours webhooks carry two signatures, one with the new secret and one with the previous, so your endpoint can switch without dropping a delivery; after that only the new one signs. Rotating again within the 24 hours retires the previous secret at once. Requires the `apikeys:write` scope. operationId: rotateManagementProjectWebhookSecret parameters: - description: Project UUID in: path name: uuid required: true schema: format: uuid type: string responses: '200': content: application/json: schema: properties: data: properties: created_at: format: date-time type: string previous_valid_until: description: >- Set after a rotation: until then webhooks also carry a signature made with the previous secret. format: date-time type: string secret: description: >- `whsec_` and the base64 of the key bytes, the form Standard Webhooks libraries take. type: string required: - secret - created_at type: object meta: type: object type: object description: Successful response '400': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Bad request '401': description: Unauthorized - missing or invalid API key '403': content: application/json: schema: properties: error: type: string required_scope: description: Present on the scope refusal. type: string type: object description: >- The token lacks the scope this endpoint requires (`required_scope` is returned). '404': content: application/json: schema: properties: error: type: string type: object description: >- No such project in the calling organization. A project of another organization is indistinguishable from one that does not exist. '500': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Internal server error '503': content: application/json: schema: properties: error: type: string type: object description: Webhook signing is not configured on this deployment. security: - ManagementBearer: [] components: schemas: ErrorResponse: properties: error: properties: code: type: string details: description: Any value message: type: string required: - code - message type: object meta: type: object required: - error type: object securitySchemes: BearerAuth: bearerFormat: API Key description: API key authentication. Pass your API key as a Bearer token. scheme: bearer type: http ManagementBearer: bearerFormat: Management API Key description: >- Management API authentication. Pass an `op-mak-…` management token as a Bearer token. Runtime `op-…` API keys are rejected with 403 — they belong on the data-plane endpoints. Mint a management key from the platform UI under Settings → API keys. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.