# Get a new signing secret

`POST https://management.horeca-24.de/api/partner/v1/webhook/rotate-secret`

The new secret is answered once. The previous one keeps signing for 24 hours, so each delivery carries two
`v1=` signatures in that time. Colliding rotations may answer `409 REQUEST_IN_PROGRESS` with `Retry-After: 2`.

## Headers

- `Authorization` (string, required): Bearer $PARTNER_API_KEY

## Response

### 200 — The new secret

- `webhookSecret` (string, required, pattern: `^whsec_`)
  Answered once. Store it.
- `previousExpiresAt` (string, optional, format: date-time)
  Until when the previous secret signs too

## Errors

- `401`: `UNAUTHORIZED`: the key is missing, malformed, unknown, wrong, expired or revoked
- `403`: `CONNECTION_REVOKED`: the restaurant deleted the connection; stop sending
- `409`: `STORE_OFFLINE`, `WEBHOOK_NOT_CONFIGURED`, `ORDER_CONFLICT`, `INVALID_TRANSITION` or `REQUEST_IN_PROGRESS`. `REQUEST_IN_PROGRESS` carries `Retry-After` (seconds); retry with the same body.

## Code example (cURL)

```sh
curl -X POST https://management.horeca-24.de/api/partner/v1/webhook/rotate-secret \
  -H "Authorization: Bearer $PARTNER_API_KEY"
```

## Response 200 — Example

```json
{
  "webhookSecret": "whsec_TmV3IHNlY3JldCwgc3RvcmUgbWUgc2FmZWx5IQ",
  "previousExpiresAt": "2026-10-16T09:00:00.000Z"
}
```