---
title: "Update webhook endpoint URL and metadata"
method: PATCH
path: "/webhooks/endpoints/{id}"
tags: ["Webhooks"]
---

# Update webhook endpoint URL and metadata

`PATCH /webhooks/endpoints/{id}`

## Request

- Base URL: `https://platform-api.homejourney.sg/v1`
- URL: `https://platform-api.homejourney.sg/v1/webhooks/endpoints/{id}`
- Auth: HTTP bearer

Updates the URL and safe metadata for one webhook endpoint registration owned by the authenticated integration client. External URL: `/v1/webhooks/endpoints/{id}`. Current Next.js implementation path: `/api/platform/v1/webhooks/endpoints/[id]`. This mutating route requires `Idempotency-Key`, can update endpoint URL, description, subscribed event names, and active/disabled status, SSRF-validates URL changes before storage, does not issue signing secrets, and does not perform direct delivery or AWS dispatch work.

## Path parameters

- `id` string, uuid, required

## Headers

- `X-Correlation-Id` string
- `Idempotency-Key` string, required

## Request body

- UpdatePlatformWebhookEndpointRequest: Safe webhook endpoint URL and metadata updates. URL changes are SSRF-validated and normalized before storage. Signing-secret issuance, direct delivery, and AWS dispatch are separate future workflows.
  - `url` string, uri: HTTPS webhook endpoint URL. The API normalizes safe URLs, rejects credentials, non-standard ports, and private DNS/IP targets, and never performs direct delivery during update.
  - `description` string, nullable
  - `subscribed_events` PlatformWebhookEventType[]
  - `status` 'active' | 'disabled'

## Response `200`

Webhook endpoint metadata updated.

- PlatformWebhookEndpointResponse
  - `endpoint` PlatformWebhookEndpoint, required
    - `id` string, uuid, required
    - `organization_id` string, uuid, required
    - `client_id` string, uuid, required
    - `environment` 'sandbox' | 'live', required
    - `url` string, uri, required
    - `description` string, nullable, required
    - `subscribed_events` PlatformWebhookEventType[], required
    - `signing_secret_prefix` string, nullable, required: Redacted signing-secret prefix for operator matching. The digest and raw secret are never returned.
    - `status` 'active' | 'disabled' | 'revoked', required
    - `last_delivery_at` string, date-time, nullable, required
    - `failure_count` integer, required
    - `created_at` string, date-time, required
    - `updated_at` string, date-time, required
  - `livemode` boolean, required
  - `request_id` string, required

## Other responses

- `400`: Request validation failed.
- `401`: Missing or invalid platform API key.
- `403`: Credential, environment, or scope is not allowed.
- `404`: Platform API feature or resource is not available.
- `409`: Idempotency key is in progress or conflicts with an earlier request body.
- `429`: Rate limit exceeded.
- `500`: Unexpected platform API failure.

---

[API](https://skmtc.dev/homejourney/apis/homejourney-platform-api.md) · [All operations](https://skmtc.dev/homejourney/apis/homejourney-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/homejourney/apis/homejourney-platform-api/revisions/a2c6fe063db1?raw)