---
title: "Edit a webhook"
method: PATCH
path: "/v1/webhooks/{id}"
tags: ["Webhooks"]
---

# Edit a webhook

`PATCH /v1/webhooks/{id}`

## Request

- Base URL: `https://api.curviate.com`
- URL: `https://api.curviate.com/v1/webhooks/{id}`
- Auth: HTTP bearer

Update a webhook in place. Every field is optional, a provided field replaces its value, an omitted field is left unchanged. The source is immutable and the signing secret is preserved (never re-issued).

## Path parameters

- `id` string, required

## Request body

- object
  - `events` string[]: Replace the subscribed events (whole-array). Every event must be a canonical event whose source matches the webhook's source.
  - `request_url` string: Replace the delivery URL. Must be a publicly reachable https host on the default https port.
  - `name` string, nullable: Replace the human-readable name (1-100 chars), or null to clear it.
  - `enabled` boolean: Enable or disable the webhook. A disabled webhook delivers nothing. Disabling is a stop, not a pause: it takes effect immediately, including for retries that were already queued, and those attempts are abandoned rather than deferred, so re-enabling delivers new events instead of replaying the ones that were dropped.
  - `headers` object[]: Replace the custom headers added to each delivery POST (whole-array). Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
    - `key` string, required
    - `value` string, required
  - `data` string[]: Replace the field-remapping keys for the delivery payload (whole-array).
  - `account_ids` string[], nullable: Replace the targeted accounts (whole-array, each an acc_ id you own), or null to cover every current and future account (account_status webhooks only).

## Response `200`

Webhook updated. The signing secret is preserved, only the prefix is shown, never the full secret.

- object
  - `object` 'webhook': Response type discriminator.
  - `id` string: Webhook id (wh_-prefixed ULID).
  - `source` 'messaging' | 'user' | 'account_status' | 'post': The event source this webhook subscribes to (immutable).
  - `request_url` string: The URL that receives delivery POST requests.
  - `name` string, nullable: Human-readable label.
  - `account_ids` string[], nullable: Accounts targeted by this webhook (acc_ ids you own), or null when an account_status webhook covers every current and future account.
  - `enabled` boolean: A disabled webhook is kept but delivers nothing. Disabling takes effect immediately, including for retries that were already queued; those attempts are abandoned, not deferred, so re-enabling delivers new events rather than replaying the ones that were dropped.
  - `headers` object[]: Custom headers added to each delivery POST. Values are encrypted at rest and no read returns one, so a read shows the name and a fingerprint of the value.
    - `key` string: The header name, as configured.
    - `value_fingerprint` string, nullable: A 8-character keyed fingerprint of the configured value. It carries no part of the value and no indication of its length, but it is not a zero-disclosure field: it is deterministic, so two headers in your account with the same fingerprint hold the same value, and a changed fingerprint means a changed value. Use it to confirm a rotation took effect, or to tell whether two of your webhooks carry the same credential. Fingerprints are scoped to your account and are not comparable with another account's. Null for a header configured before fingerprints existed. The header name is what identifies which credential is configured.
  - `events` string[]: Canonical event names this webhook subscribes to.
  - `data` string[]: Field-remapping keys for the delivery payload (messaging and user sources only; post and account_status have none).
  - `secret_prefix` string: First 8 characters of the signing secret. The full secret is never returned on edit, it is preserved unchanged.
  - `created_at` string: ISO-8601 creation timestamp.
  - `safety_warning` SafetyWarning: Present on a successful response when this account crossed an account-safety ceiling while the affected budget row is on the default warn posture. The action still happened. Field-identical to the BUDGET_EXHAUSTED error body except that blocked is false and hint.message describes the outcome, so one branch handles both postures and switching the account to enforce is a configuration change rather than a client rewrite.
    - `row` string, nullable, required: The budget row that breached, for example profile_views or pending_invites. Null when the breach is not about a row: an activity_window warning on an action that spends no budget of its own (editing a message, dismissing a notification, a Recruiter or Sales Navigator admin action) is still governed by the hours the account works in. Read hint.parameter for what to change; whenever this is null it names posture, because the activity window edges are set per action type and this action has none, so the levers that reach it are the account timezone and posture.
    - `reset_at` string, nullable, required: The instant the refusal lifts: the window roll on a ceiling refusal, the next window open on an activity-window one. Null in the two cases no clock frees, the pending_invites gauge and InMail credits (row inmail).
    - `hint` object, required
      - `parameter` string, required: The settable parameter on PATCH /v1/{account_id}/safety-policy.
      - `message` string, required: What the condition is and what changing that parameter would do. This is the one field whose text differs from the BUDGET_EXHAUSTED refusal: here it says the action went through, and on a ceiling breach how far past the ceiling this row now stands, rather than telling you to set posture to warn when it already is. Branch on parameter, reason and blocked, never on this text.
    - `reason` 'ceiling' | 'activity_window', required: Which rule was crossed. ceiling means the row's configured limit is spent; activity_window means the account is outside the hours it works in, which is a different fact with a different remedy. hint.parameter names the right setting for each.
    - `blocked` boolean, required: Always false here. True on the BUDGET_EXHAUSTED refusal carrying the same payload.

## Other responses

- `400`: Invalid request, malformed URL, empty events array, event-source mismatch, a change to the immutable source, or a malformed id.
- `401`: Missing or invalid API key.
- `402`: Payment required, an active subscription is needed.
- `404`: Webhook not found, or one or more account_ids not found for this tenant.
- `413`: Payload too large, the request body exceeds the size limit.
- `429`: Rate limited, slow down and retry after the hinted delay.

---

[API](https://skmtc.dev/curviate/apis/curviate-api.md) · [All operations](https://skmtc.dev/curviate/apis/curviate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/curviate/apis/curviate-api/revisions/eab848801d95?raw)