> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.rushorder.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.rushorder.com/_mcp/server.

# Rotate a signing secret

POST https://dream.rushorder.com/api/webhooks/subscriptions/{id}/secret
Content-Type: application/json

Webhooks are only available for certain clients. Contact your Rush Order representative to have them enabled. Creating or changing subscriptions with an API key must also be enabled for your account; otherwise this returns 403.

Issues a new signing secret and returns it. This is the only time it is shown. For 15 minutes afterward, each delivery carries signatures from both the new and the previous secret, so you can deploy the new secret without rejecting deliveries. If the previous secret may be compromised, send `{"RevokeImmediately": true}` to stop signing with it straight away; deliveries will then fail your signature check until the new secret is deployed. The body is optional.

Reference: https://docs.rushorder.com/api-reference/webhooks/rotate-secret

## Authentication

- `Authorization` header (basic auth, required) — Basic authentication of the form `Basic <base64(username:password)>`.

## Request

### Path parameters

- `id` (integer, required) — The subscription ID.

### Headers

- `RushOrderMomCode` (string, required) — All requests require the header to contain RushOrderMomCode, a 3 character string that represents the client internally in Rush Order. This should be given to you by Rush Order.

### Body (application/json)

This endpoint expects an object.

- `RevokeImmediately` (boolean, optional) — Stop signing with every previous secret right away. Defaults to false.

## Response

### 200

Success

- `SubscriptionId` (integer, optional)
- `Secret` (string, optional) — The signing secret, beginning with `whsec_`. This is the only time it is returned, so store it right away.
- `PreviousSecretExpiresAt` (datetime, optional, nullable) — When the previous secret stops signing deliveries. Null on create, and null when the previous secret was revoked immediately.

## Errors

### 403 Forbidden Error

Webhooks are not enabled for this client, or managing them with this API key is not enabled.

- `any`

### 404 Not Found Error

No subscription with that ID.

- `any`

## Examples

**Request**

```json
{}
```

**Response**

```json
{
  "SubscriptionId": 12,
  "Secret": "string",
  "PreviousSecretExpiresAt": "2024-01-15T09:30:00Z"
}
```

**SDK Code**

```python
import requests

url = "https://dream.rushorder.com/api/webhooks/subscriptions/12/secret"

payload = {}
headers = {
    "RushOrderMomCode": "ABC"
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers, auth=("<username>", "<password>"))

print(response.json())
```

```javascript
const url = 'https://dream.rushorder.com/api/webhooks/subscriptions/12/secret';
const credentials = btoa("<username>:<password>");

const options = {
  method: 'POST',
  headers: {
    RushOrderMomCode: 'ABC',
    Authorization: `Basic ${credentials}`,
    'Content-Type': 'application/json'
  },
  body: '{}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://dream.rushorder.com/api/webhooks/subscriptions/12/secret"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("RushOrderMomCode", "ABC")
	req.SetBasicAuth("<username>", "<password>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://dream.rushorder.com/api/webhooks/subscriptions/12/secret")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["RushOrderMomCode"] = 'ABC'
request.basic_auth("<username>", "<password>")
request["Content-Type"] = 'application/json'
request.body = "{}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://dream.rushorder.com/api/webhooks/subscriptions/12/secret")
  .header("RushOrderMomCode", "ABC")
  .basicAuth("<username>", "<password>")
  .header("Content-Type", "application/json")
  .body("{}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://dream.rushorder.com/api/webhooks/subscriptions/12/secret', [
  'body' => '{}',
  'headers' => [
    'Content-Type' => 'application/json',
    'RushOrderMomCode' => 'ABC',
  ],
    'auth' => ['<username>', '<password>'],
]);

echo $response->getBody();
```

```csharp
using RestSharp;
using RestSharp.Authenticators;

var client = new RestClient("https://dream.rushorder.com/api/webhooks/subscriptions/12/secret");
client.Authenticator = new HttpBasicAuthenticator("<username>", "<password>");
var request = new RestRequest(Method.POST);
request.AddHeader("RushOrderMomCode", "ABC");

request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let credentials = Data("<username>:<password>".utf8).base64EncodedString()

let headers = [
  "RushOrderMomCode": "ABC",
  "Authorization": "Basic \(credentials)",
  "Content-Type": "application/json"
]
let parameters = [] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://dream.rushorder.com/api/webhooks/subscriptions/12/secret")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```