---
title: "Rotate Webhooks Shared Secret"
url: "https://developer.pexa.co.uk/apis/notifications-v1-v1/versions/72a6ef34-73d4-4940-b586-d4154e57aaea/operations/createNotificationSecretRotation"
---

> Full API specification: https://developer.pexa.co.uk/apis/notifications-v1-v1/versions/72a6ef34-73d4-4940-b586-d4154e57aaea.md

# Rotate Webhooks Shared Secret

`POST` `/partner/api/notification/v1/notification-registrations/{registrationId}/secret-rotation`

Operation ID: `createNotificationSecretRotation`

This API is used to rotate existing shared secret with a new shared secret on the registration id provided for Webhook notifications

## Path parameters

- `registrationId` (string, required) - UUID of the registration

## Responses

- `200` - SUCCESS
- `400` - Bad Request
- `401` - Unauthorized
- `403` - Forbidden
- `500` - Internal Server Error

## OpenAPI definition

```yaml
openapi: 3.1.0
info:
  title: Notification Service - V1 APIs
  version: v1
servers:
  - url: https://api.pexa.co.uk
    description: API Gateway URL
paths:
  /partner/api/notification/v1/notification-registrations/{registrationId}/secret-rotation:
    post:
      tags:
        - WebhooksRegistration
      summary: Rotate Webhooks Shared Secret
      description: This API is used to rotate existing shared secret with a new shared
        secret on the registration id provided for Webhook notifications
      operationId: createNotificationSecretRotation
      security:
        - oauth2:
            - create:notification_registrations_secret_rotation
          tags:
            - Rotates shared secret
      parameters:
        - in: path
          name: registrationId
          schema:
            type: string
          required: true
          description: UUID of the registration
      responses:
        "200":
          description: SUCCESS
          headers:
            X-API-Version:
              schema:
                type: string
                description: The API version that was used to process the request.
          content:
            application/json:
              schema:
                description: New shared secret details, containing `shared_secret` attribute
                type: object
                required:
                  - sharedSecret
                  - expiry
                properties:
                  expiry:
                    type: string
                    description: The time until which the shared secret is valid
                    example: 2024-02-28T06:12:42Z
                  sharedSecret:
                    type: string
                    description: The shared secret used to validate the webhook request
                    example: 38e5d78c-d642-42d1-8064-0082dc87c4e5
        "400":
          description: Bad Request
          headers:
            X-API-Version:
              schema:
                type: string
                description: The API version that was used to process the request.
          content:
            application/json:
              schema:
                type: object
                description: Response object of the service
                properties:
                  errors:
                    default: []
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          description: |
                            The error code.
                          type: string
                          example: GA.NOTIF.400000
                        message:
                          description: |
                            The error message.
                          type: string
                          example: "Invalid UUID string: not-a-valid-id"
                        field:
                          description: |
                            The field in the request that caused the error.
              example:
                errors:
                  - code: GA.NOTIF.400000
                    message: "Invalid UUID string: 123"
                    field: null
        "401":
          description: Unauthorized
          headers:
            X-API-Version:
              schema:
                type: string
                description: The API version that was used to process the request.
          content:
            application/json:
              schema:
                type: object
                description: Response object of the service
                properties:
                  errors:
                    default: []
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          description: |
                            The error code.
                          type: string
                          example: GA.NOTIF.401004
                        message:
                          description: |
                            The error message.
                          type: string
                          example: Unauthorized
                        field:
                          description: |
                            The field in the request that caused the error.
              example:
                errors:
                  - code: GA.NOTIF.401004
                    message: Unauthorized
                    field: null
        "403":
          description: Forbidden
          headers:
            X-API-Version:
              schema:
                type: string
                description: The API version that was used to process the request.
          content:
            application/json:
              schema:
                type: object
                description: Response object of the service
                properties:
                  errors:
                    default: []
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          description: |
                            The error code.
                          type: string
                          example: GA.NOTIF.403003
                        message:
                          description: |
                            The error message.
                          type: string
                          example: Access Denied
                        field:
                          description: |
                            The field in the request that caused the error.
              example:
                errors:
                  - code: GA.NOTIF.403003
                    message: Forbidden
        "500":
          description: Internal Server Error
          headers:
            X-API-Version:
              schema:
                type: string
                description: The API version that was used to process the request.
          content:
            application/json:
              schema:
                type: object
                description: Response object of the service
                properties:
                  errors:
                    default: []
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          description: |
                            The error code.
                          type: string
                        message:
                          description: |
                            The error message.
                        field:
                          description: |
                            The field in the request that caused the error.
              example:
                errors:
                  - message: Internal Server Error
security:
  - oauth2:
      - create:notification_registrations_secret_rotation
    tags:
      - Rotates shared secret
components:
  securitySchemes:
    oauth2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://login.pexauk.co.uk/oauth/token
          scopes:
            create:notification_registrations: Create notification registrations
            edit:notification_registrations: Edit notification registrations
            delete:notification_registrations: Delete notification registrations
            create:notification_registrations_secret_rotation: Create notification registrations secret rotation
            view:notifications: View notifications
            create:notification_retry: Retry a notification
            create:webhook_domains: Whitelist a webhook domain
```