---
title: "Update a builder webhook destination"
method: PATCH
path: "/api/v1/webhooks/{id}"
tags: ["Webhooks"]
---

# Update a builder webhook destination

`PATCH /api/v1/webhooks/{id}`

Updates name, HTTPS URL, event types, or enabled state. URL changes force pending_verification and return a new verification token.

## Path parameters

- `id` integer, required

## Headers

- `Idempotency-Key` string

## Request body

- UpdateWebhookRequest
  - `name` string
  - `url` string, uri
  - `event_types` WebhookEventType[]
  - `enabled` boolean

## Response `200`

Webhook destination

- object
  - `object` 'webhook', required
  - `data` WebhookEndpoint, required
    - `id` integer, required
    - `object` 'webhook', required
    - `name` string, required
    - `url` string, uri, required
    - `event_types` WebhookEventType[], required
    - `status` 'pending_verification' | 'active' | 'disabled', required
    - `verified_at` string, date-time, nullable
    - `verification_token_expires_at` string, date-time, required
    - `failure_count` integer, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
    - `retry_policy` WebhookRetryPolicy, required
      - `max_attempts` 8, required
      - `terminal_status` 'dead_letter', required
    - `signing_secret` string — Returned only on create or rotate-secret.
    - `verification` WebhookVerification
      - `token` string, required — One-time verification token returned only on create or URL change.
      - `expires_at` string, date-time, required
  - `meta` ResponseMeta, required
    - `request_id` string, required — Unique request ID (req_ prefix).
    - `cached` boolean, required
    - `cache_age_s` integer, nullable — Cache age in seconds, null if not cached.

## Other responses

- `400` — Invalid request parameter
- `401` — Missing or invalid API key
- `402` — Active Insider subscription required
- `403` — Account access denied
- `404` — Resource not found
- `408` — Request exceeded the server's 30-second transport timeout. The timeout response has an empty body because it is generated before handler-level JSON error shaping.
- `409` — An Idempotency-Key request with the same body is still in progress. Retry shortly with the same key and body.
- `422` — The Idempotency-Key was already used with a different request body.
- `423` — Account is locked
- `429` — Rate limit exceeded (100 req/min; batch endpoints also reserve 100 batch item units/min before execution)
- `500` — Unexpected server error
- `503` — Redis-backed authenticated rate limiter unavailable; retry after the per-process outage cooldown

## Changes

- **2026-06-01** `422bd4dc1611` — 81 warning, 4 info
  - added the new `account_locked` enum value to the `error/code` response property for the response status `400`
  - added the new `account_locked` enum value to the `error/code` response property for the response status `401`
  - added the new `account_locked` enum value to the `error/code` response property for the response status `402`
  - added the new `account_locked` enum value to the `error/code` response property for the response status `403`
  - …81 more
- **2026-05-08** `80e8658e5acf` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/0xinsider/apis/0xinsider-api/changes/api/v1/webhooks/:id/patch.md)

---

[API](https://skmtc.dev/0xinsider/apis/0xinsider-api.md) · [All operations](https://skmtc.dev/0xinsider/apis/0xinsider-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/0xinsider/0xinsider-api/revisions/03edbd4f02bd/schema)