---
title: "Update subscription"
method: PATCH
path: "/webhooks/{webhookId}"
tags: ["14. Webhooks"]
---

# Update subscription

`PATCH /webhooks/{webhookId}`

## Path parameters

- `webhookId` string, uuid, required

## Request body

- UpdateWebhookSubscriptionRequestView — The webhook subscription request.
  - `url` string — The URL of the customer's webhook listener. Must be a valid URL.
  - `headers` SubscriptionHeaderView[] — Appropriate for the authentication method the customer wants Tango to use when calling their webhook listener.
    - `name` string, required — The name of the header.
    - `value` string, required — The value of the header.
  - `categories` string[] — The categories the customer wants to subscribe to.
  - `eventTypes` string[] — The event types the customer wants to subscribe to.
  - `signingCertificate` string — The public X509 certificate used to sign the webhook payload. The certificate must be base64 encoded.
  - `hmacSharedSecretKey` string — The HMAC secret key used to sign the webhook payload. Required when payloadVerificationMethod is HMAC. The key must be base64 encoded.
  - `payloadVerificationMethod` 'HMAC' | 'X509' | 'NONE' — Method to verify webhook payload integrity

## Response `200`

OK

- UpdateWebhookSubscriptionResponseView — The response from updating a webhook subscription.
  - `webhookId` string, uuid — The ID of the webhook.
  - `url` string — The URL of the customer's webhook listener.
  - `headers` SubscriptionHeaderView[] — Appropriate for the authentication method the customer wants Tango to use when calling their webhook listener.
    - `name` string, required — The name of the header.
    - `value` string, required — The value of the header.
  - `categories` string[] — The categories the customer is subscribed to.
  - `eventTypes` string[] — The event types the customer is subscribed to.
  - `signingCertificate` string — The public X509 certificate used to sign the webhook payload. The certificate is base64 encoded.
  - `createdAt` string, date-time — The date and time the webhook was created.
  - `expiresAt` string, date-time — The date and time the webhook expires.
  - `updatedAt` string, date-time — The date and time when the webhook was last updated.
  - `payloadVerificationMethod` 'HMAC' | 'X509' | 'NONE' — Method to verify webhook payload integrity
  - `hmacSharedSecretKey` string — The HMAC secret key used to sign the webhook payload. Required when payloadVerificationMethod is HMAC. The key must be base64 encoded.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

---

[API](https://skmtc.net/tangocard/apis/tango-api.md) · [All operations](https://skmtc.net/tangocard/apis/tango-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tangocard/tango-api/revisions/324ad9683921/schema)