# Get a new webhook address

**POST** `/api/workflows/{id}/webhook/rotate`

Retires a workflow’s webhook address and gives it a new one.

Needs [an API token](https://docs.gorunner.io/api/authentication#scopes) with the **Write** permission for workflows (`workflow:write`).

> **Warning** The old address stops working the moment this answers. Anything still sending to it gets 404.

## Parameters

### Path

- `id` · Required · UUID: The workflow’s ID.

### Headers

- `Idempotency-Key` · Optional · string: Up to 255 characters. A retry with the same key within 24 hours answers the first new address again, instead of retiring that one too.

## After rotating

Point every sender at the new address. You can read the token again with [Get a workflow](https://docs.gorunner.io/api/workflows/get-workflow), with the **Run** permission for workflows.

A self-registering trigger isn’t told the new address. Publish again to sign it up anew. It takes no body.

## Responses

- 200 OK

  The new token. Its address is `/api/webhooks/{webhookToken}` on the API’s address. Without the **Run** permission for workflows, the answer leaves it out.

- 400 `VALIDATION_ERROR`

  `id` isn’t a UUID, or `Idempotency-Key` is over 255 characters.

- 403 `FORBIDDEN`

  The token lacks the **Write** permission for workflows.

- 404 `NOT_FOUND`

  No workflow with this ID in the token’s workspace.

- 409 `CONFLICT`

  The workflow doesn’t start from a webhook, so it has no address.

- 409 `CONFLICT`

  Another write to this workflow took too long, or a request with this `Idempotency-Key` is still in progress. Try again.

- 422 `VALIDATION_ERROR`

  This `Idempotency-Key` was already used with a different request.

- 500 `INTERNAL_ERROR`

  Nothing changed: the old address still works.

Any call can also answer: [`401 UNAUTHORIZED`](https://docs.gorunner.io/errors#UNAUTHORIZED) · [`401 TOKEN_ENDED`](https://docs.gorunner.io/errors#TOKEN_ENDED) · [`403 TOKEN_SURFACE_OFF`](https://docs.gorunner.io/errors#TOKEN_SURFACE_OFF) · [`403 FEATURE_OFF`](https://docs.gorunner.io/errors#FEATURE_OFF) · [`403 EMBED_NOT_ALLOWED`](https://docs.gorunner.io/errors#EMBED_NOT_ALLOWED) · [`403 EMBED_NOT_AVAILABLE`](https://docs.gorunner.io/errors#EMBED_NOT_AVAILABLE) · [`403 ACCOUNT_SUSPENDED`](https://docs.gorunner.io/errors#ACCOUNT_SUSPENDED) · [`413 PAYLOAD_TOO_LARGE`](https://docs.gorunner.io/errors#PAYLOAD_TOO_LARGE) · [`415 INVALID_CONTENT_TYPE`](https://docs.gorunner.io/errors#INVALID_CONTENT_TYPE) · [`429 RATE_LIMITED`](https://docs.gorunner.io/errors#RATE_LIMITED) · [`503 BUSY`](https://docs.gorunner.io/errors#BUSY) · [`503 PAUSED`](https://docs.gorunner.io/errors#PAUSED) · [`503 SERVICE_UNAVAILABLE`](https://docs.gorunner.io/errors#SERVICE_UNAVAILABLE). See [Errors](https://docs.gorunner.io/api/errors#by-status).

Request

**curl**

```bash
GORUNNER="https://api.gorunner.io"
GORUNNER_TOKEN="grt_…"  # needs Write for workflows
WORKFLOW_ID="your-workflow-id"

URL="$GORUNNER/api/workflows/$WORKFLOW_ID/webhook/"
URL="${URL}rotate"
curl -X POST "$URL" \
  -H "Authorization: Bearer $GORUNNER_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)"
```

**JavaScript**

```js
const GORUNNER = "https://api.gorunner.io";
const TOKEN = process.env.GORUNNER_TOKEN;
const WORKFLOW_ID = process.env.WORKFLOW_ID;

const res = await fetch(
  `${GORUNNER}/api/workflows/${WORKFLOW_ID}/` +
    `webhook/rotate`,
  {
    method: "POST",
    headers: {
        Authorization: `Bearer ${TOKEN}`,
        "Idempotency-Key": crypto.randomUUID(),
      },
  },
);
const { data } = await res.json();
```

**Python**

```python
import os, uuid, requests

GORUNNER = "https://api.gorunner.io"
TOKEN = os.environ["GORUNNER_TOKEN"]
WORKFLOW_ID = os.environ["WORKFLOW_ID"]

res = requests.post(
    f"{GORUNNER}/api/workflows/{WORKFLOW_ID}/"
    f"webhook/rotate",
    headers={
        "Authorization": f"Bearer {TOKEN}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
)
data = res.json()["data"]
```

Response · 200 OK

```json
{
  "data": {
    "id": "3b1e5c2a-7d4f-4e8b-a1c6-5f2d9b0e7a31",
    "webhookToken": "9d1e7c42-3b5a-4f68-8e20-6a7b9c0d1e2f"
  }
}
```

**Every field**

It takes no body.

### Response · 200 OK

- `data` · object
  - `id` · UUID: The workflow id.
  - `webhookToken` · string: The NEW token. The public URL is the API’s public base + `/api/webhooks/` + this value, and that endpoint is unauthenticated. The previous token is already dead.

Related: [Call a workflow’s webhook](https://docs.gorunner.io/api/webhooks) · [Publish a workflow](https://docs.gorunner.io/api/publish/publish-workflow)

Source: https://docs.gorunner.io/api/publish/rotate-workflow-webhook-token