---
title: "Update an mTLS configuration"
method: PATCH
path: "/webhooks_settings/mtls/{webhookMtlsId}"
tags: ["Webhooks V2"]
---

# Update an mTLS configuration

`PATCH /webhooks_settings/mtls/{webhookMtlsId}`

## Request

- Base URL: `https://api.fireblocks.io/v1`
- URL: `https://api.fireblocks.io/v1/webhooks_settings/mtls/{webhookMtlsId}`
- Auth: none declared
- TypeScript: <https://skmtc.dev/fireblocks/apis/fireblocks-api/docs/webhooks_settings/mtls/:webhookMtlsId/patch.ts> (a function with typed inputs; its response is checked against the schema)

Renames a configuration, replaces its certificate, or both. Only the fields present in the request are changed; anything omitted is left as it is, and a request with neither field is rejected with a `400`.

Replacing `signedCert` switches every webhook and OAuth credentials set using this configuration over to the new certificate in one write, and the private key it was issued for is re-derived from the certificate. A replacement that was not issued for a private key this workspace holds is rejected with a `400`.

Sending `name: null` removes the label.

**Endpoint Permissions:** Owner, Admin, Non-Signing Admin.

## Path parameters

- `webhookMtlsId` string, uuid, required

## Request body

- UpdateWebhookMtlsConfigRequest: At least one property must be provided.
  - `name` string, nullable: A new label for this mTLS configuration, or `null` to remove it. Letters, digits and spaces only.
  - `signedCert` string: A replacement signed certificate PEM. Every webhook and OAuth credentials set using this configuration switches to it, and the private key it was issued for is re-derived from the certificate.

## Response `200`

The updated mTLS configuration

- WebhookMtlsConfig: A signed client certificate stored for the workspace, and the id a webhook or OAuth credentials set references to use it. Several of them may share one configuration, so replacing the certificate here switches all of them at once.
  - `id` string, uuid, required: The unique identifier of the mTLS configuration, to be set as `webhookMtlsId` on a webhook or on OAuth credentials.
  - `name` string: The label given to this mTLS configuration.
  - `signedCert` string, required: The signed client certificate PEM.
  - `expiresAt` integer, required: When the certificate itself expires, in milliseconds since the epoch.
  - `createdAt` integer, required: When the certificate was uploaded, in milliseconds since the epoch.
  - `updatedAt` integer, required: When this configuration was last changed, in milliseconds since the epoch. Differs from createdAt once the certificate has been replaced or the configuration renamed.

## Other responses

- `400`: Neither `name` nor `signedCert` was provided, so there is nothing to change, or the replacement certificate was rejected — it is not valid X.509, or it was not issued for a private key this workspace holds.
- `default`: Error Response

---

[API](https://skmtc.dev/fireblocks/apis/fireblocks-api.md) - [All operations](https://skmtc.dev/fireblocks/apis/fireblocks-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fireblocks/apis/fireblocks-api/revisions/4eba9965659a?raw)