---
title: "Update webhook"
method: PATCH
path: "/v1/webhooks/{webhook_id}"
tags: ["Webhooks"]
---

# Update webhook

`PATCH /v1/webhooks/{webhook_id}`

## Request

- Base URL: `https://api.deadsimple.email`
- URL: `https://api.deadsimple.email/v1/webhooks/{webhook_id}`
- Auth: HTTP bearer

Partial update. Any of url, events, description, inbox_ids, is_active and endpoint_secret may be supplied; unknown fields are ignored and at least one known field is required. `inbox_ids: []` clears the inbox scope. Setting `is_active` to true also resets the consecutive-failure counter, so an auto-disabled endpoint starts over with a full disable budget.

## Path parameters

- `webhook_id` string, required

## Request body

- object
  - `url` string, uri
  - `events` string[]
  - `description` string
  - `inbox_ids` string[]
  - `is_active` boolean
  - `endpoint_secret` string: The receiving service's own Standard Webhooks secret (`whsec_...`), for endpoints that verify every request against it, such as Grok Automations. Each delivery then also carries `webhook-id` (the delivery id, stable across retries), `webhook-timestamp` and `webhook-signature` (`v1,<base64 HMAC-SHA256 of "id.timestamp.body">`) per standardwebhooks.com. Such receivers answer an unsigned request with HTTP 400. Write-only. A `whsec_` value supplied as `Authorization: Bearer whsec_...` in headers is treated the same way and not sent as a header. `null` removes it.

## Response `200`

Updated webhook

- Webhook
  - `webhook_id` string, uuid
  - `workspace_id` string, uuid
  - `url` string, uri
  - `events` string[]
  - `is_active` boolean
  - `headers` object: Custom delivery headers, values masked (write-only).
  - `endpoint_secret_set` boolean: True when deliveries are also signed with the receiver's own Standard Webhooks secret (see endpoint_secret on create). The secret itself is write-only and never returned.
  - `inbox_ids` string[]: Inboxes this webhook is restricted to. Empty means every inbox.
  - `created_at` string, date-time

## Other responses

- `400`: Invalid field, unknown inbox, or nothing to update

---

[API](https://skmtc.dev/deadsimple/apis/dead-simple-email-api.md) · [All operations](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/revisions/c697881be131?raw)