> ## Documentation Index
> Fetch the complete documentation index at: https://docs.replo.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate a form's webhook signing secret

> **Beta** — this endpoint may change before general availability.



## OpenAPI

````yaml /api-reference/openapi.json post /forms/{formId}/webhook-secret
openapi: 3.1.0
info:
  title: Replo Public API
  version: '2026-11-10'
servers:
  - url: https://api.replo.app/v1
security: []
paths:
  /forms/{formId}/webhook-secret:
    post:
      tags:
        - Forms
      summary: Rotate a form's webhook signing secret
      description: '**Beta** — this endpoint may change before general availability.'
      operationId: forms.rotateWebhookSecret
      parameters:
        - name: Replo-Api-Version
          in: header
          required: true
          schema:
            type: string
            enum:
              - '2026-11-10'
          description: The public API version to use for this request.
        - schema:
            type: string
            format: uuid
            description: The form's id, from replo_forms_list
          required: true
          description: The form's id, from replo_forms_list
          name: formId
          in: path
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                projectId:
                  type: string
                  format: uuid
                  description: The project that owns the forms, from list_projects
              required:
                - projectId
              additionalProperties: false
      responses:
        '200':
          description: Rotate a form's webhook signing secret
          content:
            application/json:
              schema:
                type: object
                properties:
                  object:
                    type: string
                    enum:
                      - form_webhook_secret
                  formId:
                    type: string
                    format: uuid
                  webhookSecret:
                    type: string
                    description: >-
                      Signs every delivery to the form's webhook; shown only in
                      this response, so store it now
                required:
                  - object
                  - formId
                  - webhookSecret
        '400':
          description: Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiError'
        '401':
          description: >-
            Missing or invalid Replo Public API token. Send an active key as
            `Authorization: Bearer replo_sk_...`; if it was revoked, create a
            new key in Replo Settings.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiError'
        '403':
          description: >-
            You are not authorized to access this resource. Ask a workspace
            owner to perform this action or to grant the key's creator access.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiError'
        '404':
          description: >-
            Not Found. The resource may not exist, this key may lack the
            required scope, or the key's creator may have lost access. Check the
            key's scopes in Replo Settings and the creator's project or
            workspace access; a workspace owner can grant access.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiError'
        '409':
          description: The resource is in a conflicting state.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiError'
        '413':
          description: File content exceeds the 10 MiB limit.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiError'
        '429':
          description: >-
            Too many requests. Please retry after the time indicated by the
            Retry-After header.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiError'
        '500':
          description: An internal error occurred.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiError'
        '503':
          description: Service temporarily unavailable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicApiError'
      security:
        - bearerAuth: []
components:
  schemas:
    PublicApiError:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
            doc_url:
              type: string
            issues:
              type: array
              items:
                type: object
                properties:
                  param:
                    type:
                      - string
                      - 'null'
                    description: >-
                      Dotted path to the failing field within the request body,
                      query or path, e.g. "name" or "variants.0.available"; null
                      when the rule covers the whole input.
                  message:
                    type: string
                    description: Why the field was rejected.
                required:
                  - param
                  - message
              description: >-
                Present on an invalid_request whose input failed validation:
                each failing field and why, at most 10.
          required:
            - code
            - message
            - doc_url
      required:
        - error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.