Replace the signing secret with a new one. Use this on a schedule, or if the secret may have been exposed, and update your verifier before the next delivery. Returns the new secret (shown once) and the new hmac_secret_fingerprint; the old secret stops working immediately.

Prerequisites: a Partner bearer token and the subscription's id (from List your webhooks).

Authentication: Partner token. Only partner users can call it; other tokens get 403. Only your own partner's subscriptions: any other id gets 404.

Rate limit: none.