---
title: "Toggle Company Webhook Data Alert"
method: PATCH
path: "/companies/{companyId}/webhook/data-alert"
tags: ["Company Management"]
---

# Toggle Company Webhook Data Alert

`PATCH /companies/{companyId}/webhook/data-alert`

## Request

- Base URL: `https://api.hudsonrock.com/json/v3`
- URL: `https://api.hudsonrock.com/json/v3/companies/{companyId}/webhook/data-alert`
- Auth: API key in header `api-key`
- TypeScript: <https://skmtc.dev/hudsonrock/apis/cavalier-api/docs/companies/:companyId/webhook/data-alert/patch.ts> (a function with typed inputs; its response is checked against the schema)

Enable or disable data alerts (`webhook.data_alert`) on an existing company webhook without resending the webhook URL or token. The company must already have a webhook configured; otherwise `409 Conflict` is returned.

Enabling data alerts switches the webhook from the summary `hudsonrock:alert` event to per-machine `hudsonrock:data` events; the two modes don't run together. See **Set Company Webhook** for the full payload and delivery reference.

If the authenticated user belongs to an organization with `synced_data: true`, only the user with `organization.role: "owner"` can call this endpoint. Other members receive `403 Forbidden`.

## Path parameters

- `companyId` string, required

## Request body

- object
  - `data_alert` boolean, required: `true` to send per-machine data events (`hudsonrock:data`) instead of the summary alert, `false` to go back to the summary alert (`hudsonrock:alert`).

## Response `200`

Updated list of companies for the authenticated user

- object
  - `companies` Company[]
    - `_id` string: ObjectId of the company
    - `name` string: Display name of the company
    - `alerts` boolean: Whether notifications (including webhook deliveries) are enabled for this company. Set to true when the company is created.
    - `data` object: Company assets used to scope searches
      - `domains` string[]: Primary domains owned by the company
      - `apks` string[]: Android application package names associated with the company
      - `external_domains` string[]: External (third-party) domains associated with the company
      - `webhook` Webhook, nullable: Webhook configuration for notifying an external endpoint of events related to a company. Null if not configured.
        - `url` string, uri: HTTPS URL to receive webhook notifications.
        - `token` string: Token sent with each webhook request to authenticate it, exactly as entered (e.g. a Splunk HEC token or bearer token). Include any scheme yourself, e.g. `Bearer <token>` or `Splunk <token>`.
        - `auth_header` string: Name of the HTTP header used to send the token. Defaults to "Authorization" if not specified.
        - `data_alert` boolean: Selects the event mode. `false` (default): one summary event per notification run (`sourcetype: hudsonrock:alert`). `true`: one full-record event per compromised machine per match category (`sourcetype: hudsonrock:data`). The modes are exclusive: data alerts replace the summary alert.

## Other responses

- `400`: Validation error - the request or request body was invalid
- `401`: Unauthorized - the server could not authenticate the request
- `403`: Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `404`: Not found - the server could not find the requested resource
- `409`: Conflict - the request conflicts with the current state of the resource
- `500`: Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

## Changes

- **2026-11-03** `a7ebb4dfd47f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hudsonrock/apis/cavalier-api/changes/companies/:companyId/webhook/data-alert/patch.md)

---

[API](https://skmtc.dev/hudsonrock/apis/cavalier-api.md) - [All operations](https://skmtc.dev/hudsonrock/apis/cavalier-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hudsonrock/apis/cavalier-api/revisions/a7ebb4dfd47f?raw)