# Promote signing key

> Make a secondary key the primary.

Source: https://sndr.sh/docs/cranl/webhooks/promote-signing-key

`POST https://api.sndr.sh/api/cranl/v1/webhooks/{id}/signing-keys/{key_id}/promote`

Make a secondary key the primary. The previous primary is retired at once, so update your receiver to the new secret first.

Scope: `send`

**Path parameters**

- `id` (string, required): Webhook ID (wh_...).
- `key_id` (string, required): Secondary key ID (whk_...) from the stage call.

**Request**

```bash
curl -X POST 'https://api.sndr.sh/api/cranl/v1/webhooks/wh_2a7d4e9c-6b1/signing-keys/whk_61d0a9c7-5e4/promote' \
  -H 'Authorization: Bearer sndr_your_access_token'
```

**Response** (200)

```json
{
  "id":     "whk_61d0a9c7-5e4",
  "status": "primary"
}
```

**Errors**

- `unauthenticated` (401): Missing or invalid Bearer token.
- `token_expired` (401): Access token expired — exchange the refresh token for a new pair.
- `token_revoked` (401): Token was explicitly revoked.
- `insufficient_scope` (403): Token is missing the send scope.
- `not_found` (404): Resource does not exist or belongs to a different account.
- `conflict` (409): The key is not a secondary key.