Sign in

v8

latestOpenAPI 3.1.02026-08-033623795.0 MB
Webhooks

Update Webhook

Updates a webhook endpoint's URL, subscribed events, API version, pinned payload version, or enabled state.

patch/webhooks/{id}

Request body

api_version'v1' | 'v2' | 'v5'

The API version for this webhook.

api_version_datestring nullable

The dated API version (Api-Version-Date) to pin this webhook's payloads to. Only valid for v1 webhooks. Omit to leave the current pin unchanged, or pass null to unpin and track the current payload shape.

child_resource_eventsboolean

Whether or not to send events for child resources.

enabledboolean

Whether or not the webhook is enabled.

eventsstring[]

The events to send the webhook for, in dot form (for example payment.succeeded).

urlstring

The URL to send the webhook to.

Response

webhook updated

api_version'v1' | 'v2' | 'v5' required

The API version used to format payloads sent to this webhook endpoint.

api_version_datestring nullable required

The dated API version (Api-Version-Date) that v1 payloads for this endpoint are pinned to: events serialize exactly like a REST read at this version (the native serializer where the resource has one). Null when unpinned — legacy (v2/v5) webhooks, and v1 webhooks on the legacy payload shape.

child_resource_eventsboolean required

Whether events are sent for child resources. For example, if the webhook is on an account, enabling this sends events only from its connected accounts.

created_atstring required

When the webhook was created, as an ISO 8601 timestamp.

enabledboolean required

Whether this webhook endpoint is currently active and receiving events.

eventsstring[] required
idstring required

Webhook ID, prefixed hook_.

resource_idstring required

ID of the resource (account or app) this webhook is attached to.

testable_eventsstring[] required
urlstring required

Destination URL where webhook payloads are delivered via HTTP POST.

webhook_secretstring nullable required

Secret key used to sign webhook payloads for verification. Include this in your HMAC validation logic. Returned on the create response and to interactive dashboard sessions; null for API-key and OAuth callers on later reads.

Example response

{
  "api_version": "v1",
  "events": [
    "invoice.created"
  ],
  "testable_events": [
    "invoice.created"
  ]
}