# Rotate a tool's webhook secret

> Generate a new signing secret for this tool. The previous one stops working on the next call, with no overlap, so update your endpoint first. The tool keeps its id, so flows that reference it by name are unaffected.

`POST https://api.zavu.dev/v1/senders/{senderId}/agent/tools/{toolId}/webhook/secret`

Generate a new signing secret for this tool. The previous one stops working on the next call, with no overlap, so update your endpoint first. The tool keeps its id, so flows that reference it by name are unaffected.

## Parameters

- `senderId` (path, string, required)
- `toolId` (path, string, required)

## Responses

### 200

New secret generated.

- `secret` (string, required): The new webhook secret.

### 401

Unauthorized.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

### 404

Tool not found.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

## Example

```bash
curl -X POST "https://api.zavu.dev/v1/senders/sender_abc123/agent/tools/tool_abc123/webhook/secret" \
  -H "Authorization: Bearer $ZAVUDEV_API_KEY"
```

```typescript
import Zavudev from "@zavudev/sdk";

const zavu = new Zavudev({ apiKey: process.env.ZAVUDEV_API_KEY });

const result = await zavu.senders.agent.tools.webhook.rotateSecret("tool_abc123", {
  senderId: "sender_abc123",
});

console.log(result);
```