> ## Documentation Index > Fetch the complete documentation index at: https://docs.clustr-ai.com/llms.txt > Use this file to discover all available pages before exploring further. # Rotate Webhook Secret > Replace the signing secret. The new secret is in this answer only. Every delivery from now on is signed with it. **Scope:** `exports:manage`. ## OpenAPI ````yaml /enterprise/openapi.yaml post /webhook/rotate-secret openapi: 3.1.0 info: title: Clustr Organization API description: > Organization-level operations for partners who run Clustr for many clients: workspaces, the signed webhook, usage and contract limits, erasure and the audit log. This API covers the organization only. Everything a workspace does (imports, jobs, search, saved views, tags) is the public API at `https://api.clustr-ai.com/api/public`, called with the organization key and an `X-Clustr-Tenant` header. ## Authentication Every endpoint needs an organization API key (it starts with `clo_`) in the `Authorization` header. ``` Authorization: Bearer clo_... ``` Clustr staff create organization keys. Each key carries scopes; an operation that needs a scope the key lacks answers `403`. version: '1.0' contact: name: Clustr Support url: https://clustr-ai.com servers: - url: https://api.clustr-ai.com/api/org/v1 description: Production security: - OrgKey: [] tags: - name: Workspaces description: >- Create, read, rename, suspend, resume and delete the workspaces of your organization. - name: Webhook description: The organization's signed webhook, its secret and its deliveries. - name: Usage and limits description: >- What your organization used, the monthly statement, and your contract limits. - name: Erasure description: Remove one person from every workspace of the organization. - name: Audit log description: The organization's own record of every call. paths: /webhook/rotate-secret: post: tags: - Webhook summary: Rotate Webhook Secret description: > Replace the signing secret. The new secret is in this answer only. Every delivery from now on is signed with it. **Scope:** `exports:manage`. operationId: rotateWebhookSecret responses: '200': description: The webhook with its new `secret`. content: application/json: schema: $ref: '#/components/schemas/WebhookResponse' example: success: true data: url: https://hooks.example.com/clustr secret: whsec_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d secretRotatedAt: '2026-10-14T10:00:00Z' updatedAt: '2026-10-14T10:00:00Z' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: No webhook is set. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': $ref: '#/components/responses/TooManyRequests' '502': $ref: '#/components/responses/BadGateway' '503': description: Webhooks are not available right now. Retry later. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: WebhookResponse: type: object required: - success - data properties: success: type: boolean example: true data: $ref: '#/components/schemas/Webhook' ErrorResponse: type: object description: >- Every error has this shape. Branch on `error.code`; `error.message` is for people. required: - success - error properties: success: type: boolean example: false error: type: object required: - code - message properties: code: type: string description: >- A stable code to branch on, such as `BAD_REQUEST`, `NOT_FOUND` or `CONFLICT`. example: BAD_REQUEST message: type: string description: A sentence a person can read. example: Invalid request body. request_id: type: string description: Quote it to Clustr support. Webhook: type: object required: - url - secretRotatedAt - updatedAt properties: url: type: string format: uri example: https://hooks.example.com/clustr secret: type: string description: >- The signing secret (`whsec_...`). Present only in the answer that created the webhook or rotated its secret. Store it then: it is never shown again. example: whsec_8f3b0c2a9d7e4f1b6a5c3e2d1f0a9b8c secretRotatedAt: type: string format: date-time description: When the secret was created or last rotated. updatedAt: type: string format: date-time responses: Unauthorized: description: >- The key is missing, invalid or revoked, or it is not an organization key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: success: false error: code: UNAUTHORIZED message: Invalid or revoked API key Forbidden: description: The key lacks the scope this operation needs. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: success: false error: code: FORBIDDEN message: This key lacks the tenants:write scope TooManyRequests: description: >- Your organization is over its rate limit. The limit is shared by all keys and workspaces of the organization. Wait for `Retry-After`, then retry. headers: Retry-After: $ref: '#/components/headers/RetryAfter' X-RateLimit-Limit: $ref: '#/components/headers/RateLimitLimit' X-RateLimit-Remaining: $ref: '#/components/headers/RateLimitRemaining' X-RateLimit-Reset: $ref: '#/components/headers/RateLimitReset' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: success: false error: code: RATE_LIMITED message: Too many requests BadGateway: description: The organization service could not be reached. Retry later. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: success: false error: code: UPSTREAM_UNAVAILABLE message: The organization service is unavailable headers: RetryAfter: description: Seconds to wait before retrying. schema: type: integer RateLimitLimit: description: Requests per second allowed for your organization. schema: type: integer RateLimitRemaining: description: Requests left in the current window. Always `0` on a `429`. schema: type: integer RateLimitReset: description: Unix time (seconds) when requests are allowed again. schema: type: integer securitySchemes: OrgKey: type: http scheme: bearer description: >- Organization API key (`clo_...`). The `X-API-Key` header is also accepted in place of `Authorization: Bearer`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.