---
title: "Update an outbound webhook"
method: PATCH
path: "/api/v1/user/webhooks/{id}"
tags: ["User", "Webhooks"]
---

# Update an outbound webhook

`PATCH /api/v1/user/webhooks/{id}`

Revalidates URL/DNS/SSRF on every destination change and accepts only payload-contract 1.0 event types. Wildcards and unknown events fail closed with 400. The secret is not returned.

## Path parameters

- `id` integer, required

## Headers

- `X-CSRF-Token` string, required

## Request body

- OutboundWebhookUpdateRequest
  - `url` string, uri
  - `events` OutboundWebhookEventTypeV1[] — Events with a currently wired durable producer. Contracted-but-unwired event types are not subscribable. An empty input is normalized to alert.triggered; wildcard, inactive and unknown values are rejected.
  - `active` boolean

## Response `200`

Updated metadata

- WebhookUpdatedResponse
  - `ok` boolean, required
  - `webhook` OutboundWebhook, required
    - `id` integer, required
    - `url` string, uri, required
    - `events` OutboundWebhookEventTypeV1[], required — Events with a currently wired durable producer. Contracted-but-unwired event types are not subscribable. An empty input is normalized to alert.triggered; wildcard, inactive and unknown values are rejected.
    - `active` boolean, required
    - `secret_prefix` string, required — Non-secret identification prefix.
    - `key_id` string, nullable — Public identifier of the current HMAC signing key.
    - `secret_storage` 'encrypted' | 'migration_required'
    - `last_success_at` string, date-time, nullable
    - `created_at` string, date-time, required

## Other responses

- `400` — Invalid request
- `401` — Authentication required (no active session)
- `403` — Invalid CSRF token
- `404` — Resource not found
- `429` — Rate limit exceeded
- `503` — Account security or webhook schema unavailable

---

[API](https://skmtc.net/openmercantil/apis/openmercantil-public-api.md) · [All operations](https://skmtc.net/openmercantil/apis/openmercantil-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openmercantil/openmercantil-public-api/versions/996f96a11758/schema)