Sign in

1103033ea050

latestOpenAPI 3.0.3Apache-2.02026-08-12131380648.1 KB
Webhooks

Update a webhook

Update a webhook by its ID. At least one field must be provided.

Payload Requirements

  • At least one of name, description, url, auth_token, timeout_ms, or headers must be provided.
  • If name is provided, it must be unique within the organization (409 on conflict).
  • headers replaces the whole header map.
  • auth_type cannot be changed after creation, and the signing secret of an HMAC_SHA256 webhook cannot be rotated — create a new webhook instead.
  • System-managed fields (id, created_at, updated_at) cannot be modified.

<Warning>This endpoint is in alpha, read more here.</Warning>

patch/v2/webhooks/{webhook_id}

Path parameters

webhook_idstring required

A universally unique identifier (base64-encoded opaque string).

Example:RW50aXR5OjEyMzQ1

The unique webhook identifier (base64)

Request body

namestring

Updated name of the webhook (must be unique within the organization)

descriptionstring nullable

Updated description of the webhook. Set to null to clear it.

urlstring uri

Updated HTTPS endpoint events are delivered to

auth_tokenstring

Replacement Authorization header value sent with each delivery request, e.g. Bearer my-token. Sent verbatim — include the Bearer prefix if your endpoint expects one. Only valid when the webhook's auth_type is BEARER. Write-only: never returned in any response.

timeout_msinteger

Updated delivery timeout in milliseconds

headersobject

Replacement custom HTTP headers, as a map of at most 20 header names to values. Replaces the whole header map; headers not included are removed.

Response

A webhook object

idstring required

A universally unique identifier (base64-encoded opaque string).

organization_idstring required

A universally unique identifier (base64-encoded opaque string).

namestring required

Name of the webhook (unique within the organization)

descriptionstring required

A brief description of the webhook's purpose. Defaults to an empty string.

urlstring uri required

The HTTPS endpoint events are delivered to

auth_type'BEARER' | 'HMAC_SHA256' required

How deliveries from this webhook are authenticated.

  • BEARER: the stored auth_token is sent verbatim as the Authorization header of each delivery request.
  • HMAC_SHA256: each delivery is signed with the webhook's signing secret. The X-Arize-Webhook-Signature header carries v1=<hex-encoded HMAC-SHA256> computed over <timestamp>.<raw request body>, where <timestamp> is the Unix-seconds value from the X-Arize-Webhook-Timestamp header and the raw body is the exact bytes received. Deliveries also carry X-Arize-Webhook-Id (event identifier) and X-Arize-Webhook-Event (event type). To verify, recompute the HMAC over the received timestamp and raw body with your stored secret and compare it to the signature.
signing_secret_hintstring

Redacted hint of the signing secret (e.g. whsec_…abcd), useful for identifying which secret the webhook uses. Present only for HMAC_SHA256 webhooks. The full secret is returned exactly once, in the create response, and cannot be retrieved afterwards.

timeout_msinteger required

How long a delivery request may run before it is abandoned, in milliseconds. Defaults to 30000.

headersobject required

Custom HTTP headers sent with each delivery request

created_atstring date-time required

Timestamp for when the webhook was created

updated_atstring date-time required

Timestamp for when the webhook was last updated

created_by_user_idstring

A universally unique identifier (base64-encoded opaque string).

Example response

{
  "id": "RW50aXR5OjEyMzQ1",
  "organization_id": "RW50aXR5OjEyMzQ1",
  "created_by_user_id": "RW50aXR5OjEyMzQ1"
}