---
title: "Update a webhook endpoint"
method: PATCH
path: "/api/v3/webhook_endpoints/{id}/"
tags: ["Webhooks"]
---

# Update a webhook endpoint

`PATCH /api/v3/webhook_endpoints/{id}/`

## Request

- Base URL: `https://embedded.improvado.io`
- URL: `https://embedded.improvado.io/api/v3/webhook_endpoints/{id}/`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `dts_session_id`
- TypeScript: <https://skmtc.dev/improvado/apis/improvado-embedded-api-v3/docs/api/v3/webhook_endpoints/:id/patch.ts> (a function with typed inputs; its response is checked against the schema)

Partially update a webhook endpoint. Either field may be omitted.

- Setting `event_types` **replaces** the full list of subscriptions for this endpoint.
- Updating either field resets the endpoint status to `unverified`; you must call `verify` again before the endpoint will receive events.

## Path parameters

- `id` integer, required

## Request body

- WebhookEndpointUpdateRequest: Partial update payload. Either field may be omitted. Setting `event_types` replaces the full set of subscriptions for the endpoint. Updating either field resets the endpoint to `unverified`.
  - `url` string, uri
  - `event_types` string[]

## Response `200`

Webhook endpoint updated

- WebhookEndpointDetail: Full webhook endpoint representation, including the signing secret and the list of subscriptions. The `secret` is used to compute the `X-Improvado-Signature` header (HMAC-SHA256) on every event delivery and as the verification token during the verify flow. Treat it as sensitive and store it securely.
  - `id` integer
  - `url` string, uri
  - `secret` string: 64-character hex signing secret
  - `status` 'unverified' | 'active'
  - `consecutive_failures` integer
  - `subscriptions` WebhookSubscription[]
    - `id` integer: Subscription ID
    - `event_type_name` string: Name of the event type this subscription receives
    - `is_active` boolean: Whether the subscription is active
    - `created_at` string, date-time: When the subscription was created
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400`: Validation error
- `401`: Authentication credentials were not provided.
- `404`: Webhook endpoint not found

---

[API](https://skmtc.dev/improvado/apis/improvado-embedded-api-v3.md) - [All operations](https://skmtc.dev/improvado/apis/improvado-embedded-api-v3/llms.txt) - [OpenAPI document](https://skmtc.dev/improvado/apis/improvado-embedded-api-v3/revisions/a881099bd6c4?raw)