---
title: "Update an existing webhook subscription"
method: PUT
path: "/v1/Webhooks/{id}"
tags: ["Webhooks"]
---

# Update an existing webhook subscription

`PUT /v1/Webhooks/{id}`

Updates webhook URL, events, or active status. Set RegenerateSecret=true to rotate signing secret (returned in response). Use IsActive=true to re-enable auto-disabled webhooks after fixing delivery issues. Secret only included if RegenerateSecret=true.

## Path parameters

- `id` string, uuid, required

## Request body

- DebituraDomainModelWebhooksDtosUpdateWebhookRequest — Request to update an existing webhook subscription.
  - `url` string, uri, nullable — The new HTTPS URL where webhook events will be delivered. Optional — only provide if changing the URL.
  - `events` string[], nullable — Updated list of event types to subscribe to. Optional — only provide if changing the events. Note: Not supported by the ExternalCustomerAPI — that endpoint returns 400 if this field is set.
  - `isActive` boolean, nullable — Set to true to enable the webhook, false to disable it. Optional — only provide if changing the active status.
  - `regenerateSecret` boolean — Set to true to regenerate the webhook secret. A new secret will be returned in the response.
  - `isTestMode` boolean, nullable — When set, updates the classification of the subscription. True maps to `DataClassification.Test`; false maps to `DataClassification.Production`. Omit to leave the current classification unchanged.

## Response `200`

Webhook updated successfully

- DebituraDomainModelWebhooksDtosWebhookDto — Represents a webhook subscription configuration.
  - `id` string, uuid — Unique identifier for the webhook subscription.
  - `url` string, nullable — The HTTPS URL where webhook events will be delivered.
  - `events` string[], nullable — Array of event types this subscription is interested in.
  - `isActive` boolean — Whether this webhook subscription is active.
  - `createdUtc` string, date-time — Timestamp when the webhook subscription was created (UTC).
  - `updatedUtc` string, date-time — Timestamp when the webhook subscription was last updated (UTC).
  - `disabledReason` string, nullable — Reason why the webhook was automatically disabled (if IsActive is false).
  - `secret` string, nullable — Secret key for HMAC-SHA256 signature verification. Only returned on creation or secret regeneration — never exposed again for security.
  - `isTestMode` boolean — True when the subscription has `DataClassification.Test` classification; false for all other classifications (Production, Demo). Computed as `Classification != DataClassification.Production`.

## Other responses

- `400` — Invalid request (validation errors)
- `401` — API key is missing or invalid
- `404` — Webhook not found or does not belong to this partner

---

[API](https://skmtc.net/debitura/apis/debitura-referral-partner-api.md) · [All operations](https://skmtc.net/debitura/apis/debitura-referral-partner-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/debitura/debitura-referral-partner-api/versions/9c466e0e2bf4/schema)