# POST /api/v1/webhooks/:id/rotate-secret

Auth: Bearer

HTML: https://cooperemail.com/docs/reference/webhook-rotate-secret

## Summary

Mint a new signing secret and return it once. The previous secret stays valid for 24 hours (previous_secret_expires_at, previous_secret_active true). The previous secret value is not returned. PATCH /api/v1/webhooks/:id with a different secret does the same overlap and still redacts the secret in the response. Rotating again replaces the previous secret and resets the window. A hook with no secret just stores the new one. Same webhook_write permission as PATCH. During the window x-cooper-signature is sha256=<hex>,sha256=<hex> and x-cooper-signature-v2 is v1=<hex>,v1=<hex>, current secret first. Split on the comma and accept the delivery when any segment matches. After expiry only the current secret is signed. Another account's id is 404 webhook_not_found. MCP: cooper_rotate_webhook_secret.

## Request

This call has no JSON body.

## Response

The OpenAPI document does not declare a JSON response schema for this call. The summary is the contract.

## Errors

- HTTP 404 webhook_not_found

The live `message` is the sentence for that code. Branch on `code`.

```json
{
  "error": {
    "type": "not_found",
    "code": "webhook_not_found",
    "docs_url": "https://cooperemail.com/docs#webhook_not_found"
  }
}
```

## Idempotency

This route does not document Idempotency-Key or client_id.