> ## Documentation Index > Fetch the complete documentation index at: https://docs.zebratruth.ai/llms.txt > Use this file to discover all available pages before exploring further. # Rotate the tenant's video webhook signing secret > Generates a brand-new tenant-level webhook signing secret, replacing any existing value. Returns the new secret in the response (the only time it is exposed). **Important — in-flight deliveries are unaffected.** Each delivery's HMAC signature is computed at enqueue time and stored on the delivery record, so retries for already-queued webhooks continue to verify against the OLD secret. **New** jobs sign with the new secret. **Update your verifier immediately.** After rotation, your receiver must accept the NEW secret on the next job's webhook. Most receivers accept both old + new during a brief grace window — recommended. ## OpenAPI ````yaml /openapi/zebratruth-v1.yaml post /compliance/webhooks/video/secret/rotate openapi: 3.1.0 info: title: ZebraTruth Compliance API version: 1.0.0 description: > AI-powered compliance checking for advertising content. Check text and images against jurisdiction laws, platform policies, and rights clearance requirements. Results include embeddable annotations mapped to content locations (text spans, video timestamps, image regions). contact: name: ZebraTruth Support email: support@zebratruth.ai url: https://developers.zebratruth.ai license: name: MIT url: https://opensource.org/licenses/MIT servers: - url: https://api.zebratruth.ai/v1 description: Production security: - bearerAuth: [] tags: - name: Video Compliance description: > **Primary endpoint.** Async compliance analysis for video ads. 3-step flow: get an upload URL, upload the video bytes, submit for analysis. Poll or receive an HMAC-signed webhook with the report. Returns timestamped findings citing stable evidence IDs (`audio_NNN`, `frame_NNN`, `ocr_NNN`, `signal_NNN`). 3-180 second videos. mp4 / webm / quicktime. Built for ad agencies and creators. - name: Authentication description: Validate API keys and check account status - name: Compliance description: >- Run compliance checks on text + image content (sync). For video, use the Video Compliance endpoints above. - name: Agents description: Discover and invoke individual compliance agents - name: Jobs description: Poll async job status and view execution traces - name: Reports description: Retrieve and replay compliance reports - name: Observability description: Request logs and webhook delivery status - name: Billing description: Subscriptions, plan changes, and credit balance - name: Documents description: Extract text from PDF and Word documents before or as part of a check - name: Check History description: List and retrieve past compliance checks for the workspace - name: Provenance description: Inspect and sign Content Credentials (C2PA) on images and video - name: Corpus description: >- Review queue for proposed changes to the governed legal corpus (dashboard session) - name: Webhooks description: Saved webhook endpoints (dashboard session) and delivery logs paths: /compliance/webhooks/video/secret/rotate: post: tags: - Video Compliance summary: Rotate the tenant's video webhook signing secret description: | Generates a brand-new tenant-level webhook signing secret, replacing any existing value. Returns the new secret in the response (the only time it is exposed). **Important — in-flight deliveries are unaffected.** Each delivery's HMAC signature is computed at enqueue time and stored on the delivery record, so retries for already-queued webhooks continue to verify against the OLD secret. **New** jobs sign with the new secret. **Update your verifier immediately.** After rotation, your receiver must accept the NEW secret on the next job's webhook. Most receivers accept both old + new during a brief grace window — recommended. operationId: rotateVideoWebhookSecret responses: '200': description: Secret rotated content: application/json: schema: $ref: '#/components/schemas/VideoWebhookSecretRotateResponse' '401': $ref: '#/components/responses/Unauthorized' '404': description: Tenant not found components: schemas: VideoWebhookSecretRotateResponse: type: object required: - secret - rotatedAt - previousSecretExisted properties: secret: type: string description: >- The NEW signing secret. The old one is invalidated for any future jobs (in-flight deliveries keep using their pre-stored signature). pattern: ^whsec_[0-9a-f]{48}$ rotatedAt: type: string format: date-time previousSecretExisted: type: boolean description: >- False on first-ever rotation (functionally identical to auto-create on first GET). responses: Unauthorized: description: | Invalid, missing, or expired API key. Standard error envelope — read `message` for the human-readable reason. content: application/json: schema: type: object description: Standard error envelope. required: - statusCode - message properties: error: type: boolean example: true url: type: string format: uri example: https://api.zebratruth.ai/v1/whoami statusCode: type: integer example: 401 statusMessage: type: string example: Invalid API key message: type: string description: Canonical human-readable reason — pattern-match on this field. example: Invalid API key securitySchemes: bearerAuth: type: http scheme: bearer description: | API key starting with `zt_live_` (production) or `zt_test_` (sandbox). Get your key at https://developers.zebratruth.ai ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.