Webhooks

Edit a webhook

Update a webhook in place. Every field is optional, a provided field replaces its value, an omitted field is left unchanged. The source is immutable and the signing secret is preserved (never re-issued).

patch/v1/webhooks/{id}

Request

  • Base URL: https://api.curviate.com
  • URL: https://api.curviate.com/v1/webhooks/{id}
  • Auth: HTTP bearer

Path parameters

idstring required

Webhook id (wh_-prefixed ULID).

Request body

eventsstring[]

Replace the subscribed events (whole-array). Every event must be a canonical event whose source matches the webhook's source.

request_urlstring

Replace the delivery URL. Must be a publicly reachable https host on the default https port.

namestring nullable

Replace the human-readable name (1-100 chars), or null to clear it.

enabledboolean

Enable or disable the webhook. A disabled webhook delivers nothing. Disabling is a stop, not a pause: it takes effect immediately, including for retries that were already queued, and those attempts are abandoned rather than deferred, so re-enabling delivers new events instead of replaying the ones that were dropped.

datastring[]

Replace the field-remapping keys for the delivery payload (whole-array).

account_idsstring[] nullable

Replace the targeted accounts (whole-array, each an acc_ id you own), or null to cover every current and future account (account_status webhooks only).

Response

Webhook updated. The signing secret is preserved, only the prefix is shown, never the full secret.

object'webhook'

Response type discriminator.

idstring

Webhook id (wh_-prefixed ULID).

source'messaging' | 'user' | 'account_status' | 'post'

The event source this webhook subscribes to (immutable).

request_urlstring

The URL that receives delivery POST requests.

namestring nullable

Human-readable label.

account_idsstring[] nullable

Accounts targeted by this webhook (acc_ ids you own), or null when an account_status webhook covers every current and future account.

enabledboolean

A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped.

eventsstring[]

Canonical event names this webhook subscribes to.

datastring[]

Field-remapping keys for the delivery payload (messaging and user sources only; post and account_status have none).

secret_prefixstring

First 8 characters of the signing secret. The full secret is never returned on edit, it is preserved unchanged.

created_atstring

ISO-8601 creation timestamp.

Example response

{
  "safety_warning": {
    "row": "profile_views",
    "reset_at": "2026-09-05T00:00:00.000Z",
    "hint": {
      "parameter": "profile_views.ceiling",
      "message": "This account is at its ceiling for profile_views. This action went through because profile_views.posture is warn, and it counted: 101 of 100 this window. Raise profile_views.ceiling, or wait for the window to reset at 2026-09-05T00:00:00.000Z."
    },
    "reason": "ceiling",
    "blocked": false
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.