---
title: "Update a webhook"
method: PATCH
path: "/merchants/{merchantId}/webhooks/{webhookId}"
tags: ["Webhooks - merchant level"]
---

# Update a webhook

`PATCH /merchants/{merchantId}/webhooks/{webhookId}`

Make changes to the configuration of the webhook identified in the path. The request contains the new values you want to have in the webhook configuration. The response contains the full configuration for the webhook, which includes the new values from the request.

To make this request, your API credential must have the following [roles](https://docs.adyen.com/development-resources/api-credentials#api-permissions):
* Management API—Webhooks read and write

## Path parameters

- `merchantId` string, required
- `webhookId` string, required

## Request body

- UpdateMerchantWebhookRequest
  - `acceptsExpiredCertificate` boolean — Indicates if expired SSL certificates are accepted. Default value: **false**.
  - `acceptsSelfSignedCertificate` boolean — Indicates if self-signed SSL certificates are accepted. Default value: **false**.
  - `acceptsUntrustedRootCertificate` boolean — Indicates if untrusted SSL certificates are accepted. Default value: **false**.
  - `active` boolean — Indicates if the webhook configuration is active. The field must be **true** for us to send webhooks about events related an account.
  - `additionalSettings` AdditionalSettings
    - `includeEventCodes` string[] — Object containing list of event codes for which the notification will be sent.
    - `properties` object — Object containing boolean key-value pairs. The key can be any [standard webhook additional setting](https://docs.adyen.com/development-resources/webhooks/additional-settings), and the value indicates if the setting is enabled. For example, `includeCaptureDelayHours`: **true** means the standard notifications you get will contain the number of hours remaining until the payment will be captured.
  - `communicationFormat` 'http' | 'json' | 'soap' — Format or protocol for receiving webhooks. Possible values: * **soap** * **http** * **json**
  - `description` string — Your description for this webhook configuration.
  - `networkType` 'local' | 'public' — Network type for Terminal API notification webhooks. Possible values: * **public** * **local** Default Value: **public**.
  - `password` string — Password to access the webhook URL.
  - `populateSoapActionHeader` boolean — Indicates if the SOAP action header needs to be populated. Default value: **false**. Only applies if `communicationFormat`: **soap**.
  - `sslVersion` 'HTTP' | 'TLSv1.2' | 'TLSv1.3' — SSL version to access the public webhook URL specified in the `url` field. Possible values: * **TLSv1.3** * **TLSv1.2** * **HTTP** - Only allowed on Test environment. If not specified, the webhook will use `sslVersion`: **TLSv1.2**.
  - `url` string — Public URL where webhooks will be sent, for example **https://www.domain.com/webhook-endpoint**.
  - `username` string — Username to access the webhook URL.

## Response `200`

OK - the request has succeeded.

- Webhook
  - `_links` WebhookLinks
    - `company` LinksElement
      - `href` string
    - `generateHmac` LinksElement, required
      - `href` string
    - `merchant` LinksElement
      - `href` string
    - `self` LinksElement, required
      - `href` string
    - `testWebhook` LinksElement, required
      - `href` string
  - `acceptsExpiredCertificate` boolean — Indicates if expired SSL certificates are accepted. Default value: **false**.
  - `acceptsSelfSignedCertificate` boolean — Indicates if self-signed SSL certificates are accepted. Default value: **false**.
  - `acceptsUntrustedRootCertificate` boolean — Indicates if untrusted SSL certificates are accepted. Default value: **false**.
  - `accountReference` string — Reference to the account the webook is set on.
  - `active` boolean, required — Indicates if the webhook configuration is active. The field must be **true** for you to receive webhooks about events related an account.
  - `additionalSettings` AdditionalSettingsResponse
    - `excludeEventCodes` string[] — Object containing list of event codes for which the notification will not be sent.
    - `includeEventCodes` string[] — Object containing list of event codes for which the notification will be sent.
    - `properties` object — Object containing boolean key-value pairs. The key can be any [standard webhook additional setting](https://docs.adyen.com/development-resources/webhooks/additional-settings), and the value indicates if the setting is enabled. For example, `includeCaptureDelayHours`: **true** means the standard notifications you get will contain the number of hours remaining until the payment will be captured.
  - `certificateAlias` string — The alias of our SSL certificate. When you receive a notification from us, the alias from the HMAC signature will match this alias.
  - `communicationFormat` 'http' | 'json' | 'soap', required — Format or protocol for receiving webhooks. Possible values: * **soap** * **http** * **json**
  - `description` string — Your description for this webhook configuration.
  - `filterMerchantAccountType` 'allAccounts' | 'excludeAccounts' | 'includeAccounts' — Shows how merchant accounts are included in company-level webhooks. Possible values: * **includeAccounts** * **excludeAccounts** * **allAccounts**: Includes all merchant accounts, and does not require specifying `filterMerchantAccounts`.
  - `filterMerchantAccounts` string[] — A list of merchant account names that are included or excluded from receiving the webhook. Inclusion or exclusion is based on the value defined for `filterMerchantAccountType`. Required if `filterMerchantAccountType` is either: * **includeAccounts** * **excludeAccounts** Not needed for `filterMerchantAccountType`: **allAccounts**.
  - `hasError` boolean — Indicates if the webhook configuration has errors that need troubleshooting. If the value is **true**, troubleshoot the configuration using the [testing endpoint](https://docs.adyen.com/api-explorer/#/ManagementService/v1/post/companies/{companyId}/webhooks/{webhookid}/test).
  - `hasPassword` boolean — Indicates if the webhook is password protected.
  - `hmacKeyCheckValue` string — The [checksum](https://en.wikipedia.org/wiki/Key_checksum_value) of the HMAC key generated for this webhook. You can use this value to uniquely identify the HMAC key configured for this webhook.
  - `id` string — Unique identifier for this webhook.
  - `networkType` 'local' | 'public' — Network type for Terminal API details webhooks.
  - `populateSoapActionHeader` boolean — Indicates if the SOAP action header needs to be populated. Default value: **false**. Only applies if `communicationFormat`: **soap**.
  - `sslVersion` 'HTTP' | 'TLSv1.2' | 'TLSv1.3' — SSL version to access the public webhook URL specified in the `url` field. Possible values: * **TLSv1.3** * **TLSv1.2** * **HTTP** - Only allowed on Test environment. If not specified, the webhook will use `sslVersion`: **TLSv1.2**.
  - `type` string, required — The type of webhook. Possible values are: - **standard** - **account-settings-notification** - **banktransfer-notification** - **boletobancario-notification** - **directdebit-notification** - **ach-notification-of-change-notification** - **direct-debit-notice-of-change-notification** - **pending-notification** - **ideal-notification** - **ideal-pending-notification** - **report-notification** - **terminal-api-notification** - **terminal-settings** - **terminal-boarding** Find out more about [standard webhooks](https://docs.adyen.com/development-resources/webhooks/webhook-types/#event-codes) and [other types of webhooks](https://docs.adyen.com/development-resources/webhooks/webhook-types/#other-webhooks).
  - `url` string, required — Public URL where webhooks will be sent, for example **https://www.domain.com/webhook-endpoint**.
  - `username` string — Username to access the webhook URL.

## Other responses

- `204` — No Content - the request has been successfully processed, but there is no additional content.
- `400` — Bad Request - a problem reading or understanding the request.
- `401` — Unauthorized - authentication required.
- `403` — Forbidden - insufficient permissions to process the request.
- `422` — Unprocessable Entity - a request validation error.
- `500` — Internal Server Error - the server could not process the request.

---

[API](https://skmtc.net/adyen/apis/management-api.md) · [All operations](https://skmtc.net/adyen/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/adyen/management-api/versions/1089ade06e17/schema)