Webhooks

Update a webhook endpoint

Partially update a webhook endpoint. Provide any subset of {url, events, description, is_active, scope}. Updating the URL re-validates SSRF protection. An omitted field is left unchanged — in particular an omitted scope preserves the stored value. The signing secret cannot be rotated via this endpoint — delete and re-register instead.

patch/webhooks/{id}

Request

  • Base URL: https://app.arkova.ai/api/v1
  • URL: https://app.arkova.ai/api/v1/webhooks/{id}
  • Auth: one of:
    • HTTP bearer
    • API key in header X-API-Key

Path parameters

idstring uuid required

Request body

urlstring uri
eventsstring[]
descriptionstring nullable
is_activeboolean
scope'self' | 'self_and_descendants'

Delivery scope (SCRUM-3972). 'self' (default) delivers only this organization's own events. 'self_and_descendants' additionally delivers events owned by organizations whose parent is this organization and whose affiliation is APPROVED — one hop, never upward; such cross-organization payloads always carry org_public_id. Additive and nullable-safe per CLAUDE.md §1.8: omitting it preserves the pre-existing behaviour exactly. The cross-organization delivery it enables is behind a server-side gate that is currently OFF, so an endpoint set to 'self_and_descendants' today behaves exactly like 'self'.

Response

Updated webhook endpoint

idstring uuid
urlstring uri
eventsstring[]
is_activeboolean
descriptionstring nullable
scope'self' | 'self_and_descendants'

Delivery scope (SCRUM-3972). 'self' (default) delivers only this organization's own events. 'self_and_descendants' additionally delivers events owned by organizations whose parent is this organization and whose affiliation is APPROVED — one hop, never upward; such cross-organization payloads always carry org_public_id. Additive and nullable-safe per CLAUDE.md §1.8: omitting it preserves the pre-existing behaviour exactly. The cross-organization delivery it enables is behind a server-side gate that is currently OFF, so an endpoint set to 'self_and_descendants' today behaves exactly like 'self'.

created_atstring date-time
updated_atstring date-time

Changes

No recorded changes to this operation across all 1 revision of this API.