> ## Documentation Index > Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt > Use this file to discover all available pages before exploring further. # Rotate a log stream's verification secret > Add a new webhook verification secret to a verified log stream. The current secret keeps being accepted until the grace period ends, so the sender can switch without rejected deliveries. A stream holds at most two active secrets. Requires the webhook signature verification feature on the organization. ## OpenAPI ````yaml /openapi.json post /log-streams/{streamId}/signature-secrets/rotate openapi: 3.1.1 info: title: Sazabi Public API version: 1.0.0 description: > Public REST API for Sazabi. Authenticate using a secret API key in the Authorization header. ## Pagination This API uses two pagination strategies depending on the endpoint type: ### Cursor-Based Pagination (List Endpoints) List endpoints (threads, messages, keys) use cursor-based pagination for efficient, consistent results: - **Parameters**: `limit` (items per page, default 50, max 100), `cursor` (opaque pagination token) - **Response**: Includes `nextCursor` field - pass this as `cursor` in the next request - **End of results**: When `nextCursor` is `null`, there are no more results - **Example**: `GET /v1/threads?limit=20&cursor=01234567-89ab-cdef-0123-456789abcdef` ### Page-Based Pagination (Search Endpoints) Search endpoints use page-based pagination due to the underlying search engine: - **Parameters**: `limit` (items per page, default 20, max 100), `page` (1-indexed page number) - **Response**: Includes `pagination` object with `page`, `limit`, `totalResults`, `totalPages` - **Example**: `GET /v1/search/threads?q=error&limit=10&page=2` servers: - url: https://api.sazabi.com/v1 description: Production security: [] paths: /log-streams/{streamId}/signature-secrets/rotate: post: tags: - Log Streams summary: Rotate a log stream's verification secret description: >- Add a new webhook verification secret to a verified log stream. The current secret keeps being accepted until the grace period ends, so the sender can switch without rejected deliveries. A stream holds at most two active secrets. Requires the webhook signature verification feature on the organization. operationId: logStreams.rotateSecret parameters: - name: streamId in: path required: true schema: type: string format: uuid description: Log stream ID whose secret to rotate. requestBody: required: true content: application/json: schema: type: object properties: secret: anyOf: - type: object properties: generate: const: true description: >- Have Sazabi mint the secret (32 random bytes, `szvs_` prefix). It is answered once as `generatedSecret`; paste it into the sender. Refused for schemes whose platform mints its own secret (Stripe, Shopify, Linear, Standard Webhooks). required: - generate additionalProperties: false - type: object properties: value: type: string minLength: 1 maxLength: 1024 description: >- The verification secret the platform shows, e.g. Stripe's `whsec_…` signing secret. Standard Webhooks secrets may carry their `whsec_` prefix. required: - value additionalProperties: false description: The new verification secret. gracePeriodSeconds: type: integer minimum: -9007199254740991 maximum: 9007199254740991 default: 86400 description: >- How long the current secret keeps being accepted after the new one is added: 3600 (1 hour) to 604800 (7 days), default 86400 (24 hours), or 0 to stop accepting it immediately. required: - secret additionalProperties: false responses: '200': description: OK content: application/json: schema: type: object properties: signatureVerification: anyOf: - type: object properties: scheme: type: string description: Signature scheme id deliveries are checked with. mode: enum: - enforce - shadow type: string description: >- `enforce`: a delivery whose signature fails is answered 401 and not stored. `shadow`: failures are counted but stored; set only by Sazabi for managed migrations. secrets: type: array items: type: object properties: id: type: string format: uuid description: Verification secret ID. last4: type: string description: Last four characters of the secret. createdAt: type: string format: date-time retiresAt: anyOf: - type: string format: date-time - type: 'null' description: >- When a rotated-out secret stops being accepted. Null for the current secret. required: - id - last4 - createdAt - retiresAt description: >- Active verification secrets, at most two (the current one and one retiring after a rotation). Secret values are never answered. needsSecret: type: boolean description: >- True when a `shadow` stream received a delivery none of its secrets verified: add the secret the platform signs with (for a native Vercel stream, the drain's signature secret). Adding a secret restarts the shadow period. Always false for an enforced stream. required: - scheme - mode - secrets - type: 'null' description: >- The stream's webhook signature verification, or null when deliveries are not verified. generatedSecret: type: string description: >- The secret Sazabi minted for this request. Shown only once: store it now and paste it into the sender. required: - signatureVerification ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.