# rotate_callback_secret

> Make a new callback signing secret

`POST /api/v2/callbacks/secret/rotate`

Needs the `results:read` scope.

- Auth: API key (Authorization: Bearer)
- Key scope needed: `results:read`
- Raw spec: https://app.diffusr.ai/api/v2/openapi.json

## Example

**cURL**

```bash
curl -X POST "https://app.diffusr.ai/api/v2/callbacks/secret/rotate" \
  -H "Authorization: Bearer $DIFFUSR_KEY"
```

**TypeScript**

```ts
import { Diffusr } from "diffusr";

const d = new Diffusr(); // reads DIFFUSR_KEY
const { secret } = await d.rotateCallbackSecret();
```

**Python**

```python
from diffusr import Diffusr

d = Diffusr()  # reads DIFFUSR_KEY
secret = d.rotate_callback_secret()["secret"]
```

## Response

### 200 ApiCallbackSecretView

The new secret. The old one keeps signing for 24 hours.

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `secret` | string | yes | Starts with "whsec_". Use it to check the webhook-signature header. |
| `previous_valid_until` | string | no | After a rotation, the old secret still signs (a second signature) until this time. |

## Errors

Every error body is `{ error, code, request_id, ... }`. See https://diffusr.ai/docs/errors.

- 401: Missing, wrong, revoked or expired API key (code UNAUTHORIZED, KEY_REVOKED, KEY_EXPIRED).
- 403: The key may not do this (SCOPE_DENIED, MODEL_NOT_ALLOWED, TEST_MODE_UNSUPPORTED, ACCOUNT_BLOCKED, allowance_exceeded).
- 422: The request is not valid (VALIDATION_FAILED, INVALID_JSON, PREFLIGHT_FAILED, CALLBACK_URL_INVALID, REFERENCE_*). `issues` lists each problem. Nothing was charged.
- 429: Too many requests or jobs (RATE_LIMITED, CONCURRENCY_LIMIT, UPLOAD_QUOTA, …). Wait Retry-After seconds, then retry.
- 500: Our fault (INTERNAL_ERROR). Quote request_id to support.
- 503: Paused or busy (API_PAUSED, MODEL_PAUSED, PROVIDER_PAUSED, PROVIDER_BUSY, UNAVAILABLE). Wait Retry-After seconds, then retry.

## Charges

Free. No credits are spent.