---
title: "Set Company Webhook"
method: PUT
path: "/companies/{companyId}/webhook"
tags: ["Company Management"]
---

# Set Company Webhook

`PUT /companies/{companyId}/webhook`

Set or clear the webhook configuration for an existing company. Send `webhook: null` to clear it; otherwise `webhook.url` and `webhook.token` are both required.

If the authenticated user belongs to an organization with `synced_data: true`, only the user with `organization.role: "owner"` can call this endpoint. Other members receive `403 Forbidden`.

## Path parameters

- `companyId` string, required

## Request body

- object
  - `webhook` object, nullable, required — Webhook configuration. Pass null to remove the existing webhook. When setting a webhook, `url` and `token` are required.
    - `url` string, uri, required — HTTPS URL to receive webhook notifications.
    - `token` string, required — Token sent with each webhook request to authenticate it (e.g. a Splunk HEC token or bearer token).
    - `auth_header` string — Name of the HTTP header used to send the token. Defaults to "Authorization" if not specified.

## Response `200`

Updated list of companies for the authenticated user

- object
  - `companies` Company[]
    - `_id` string — ObjectId of the company
    - `name` string — Display name of the company
    - `data` object — Company assets used to scope searches
      - `domains` string[] — Primary domains owned by the company
      - `apks` string[] — Android application package names associated with the company
      - `external_domains` string[] — External (third-party) domains associated with the company
      - `webhook` Webhook, nullable — Webhook configuration for notifying an external endpoint of events related to a company. Null if not configured.
        - `url` string, uri — HTTPS URL to receive webhook notifications.
        - `token` string — Token sent with each webhook request to authenticate it (e.g. a Splunk HEC token or bearer token).
        - `auth_header` string — Name of the HTTP header used to send the token. Defaults to "Authorization" if not specified.

## Other responses

- `400` — Validation error - the request or request body was invalid
- `401` — Unauthorized - the server could not authenticate the request
- `403` — Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `404` — Not found - the server could not find the requested resource
- `500` — Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/versions/5ba0142eec4d/schema)