---
title: "Update Global Webhook Subscription"
method: PATCH
path: "/webhooks/global/subscriptions/{subscription_id}"
tags: ["Webhooks"]
---

# Update Global Webhook Subscription

`PATCH /webhooks/global/subscriptions/{subscription_id}`

## Request

- Base URL: `https://api.meow.com/v1`
- URL: `https://api.meow.com/v1/webhooks/global/subscriptions/{subscription_id}`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/meow/apis/meow-api/docs/webhooks/global/subscriptions/:subscription_id/patch.ts> (a function with typed inputs; its response is checked against the schema)

Updates a global webhook subscription. Returns the updated subscription, including a new signing secret when you request a rotation. New global API keys with business-specific write access cannot use this route. Use the entity-scoped webhook route with x-entity-id for an approved business. Existing global API keys keep their current behavior.

## Path parameters

- `subscription_id` string, uuid, required: The webhook subscription.

## Request body

- UpdateWebhookSubscriptionRequest
  - `name` string, nullable: New label for the subscription. Omit to leave it unchanged.
  - `url` string, uri, nullable: New HTTPS endpoint to POST events to. Omit to leave it unchanged.
  - `event_types` WebhookEventType[], nullable: Replacement list of event types to deliver. Omit to leave the current selection unchanged. An empty list is rejected.
  - `rotate_secret` boolean: Issue a new signing secret. The new plaintext secret is returned once in this response and never again.
  - `expire_previous_secret` boolean: Set to `true` with `rotate_secret` to stop signing with the old secret right away. Use this when you believe the old secret leaked. By default, Meow signs each delivery with both the old and the new secret for 7 days, so you can update your receiver without rejecting any deliveries.
  - `is_enabled` boolean, nullable: Set to `true` to re-enable a subscription Meow disabled after repeated delivery failures, a `410 Gone` response, or an unsafe URL. The subscription keeps its id and delivery history. Omit to leave it unchanged.
  - `payload_mode` 'snapshot' | 'thin'

## Response `200`

Successful Response

- union
  - WebhookSubscriptionResponse
    - `account_id` string, nullable: Bank account whose events this subscription receives. Null means no account filter. Fixed at creation.
    - `id` string, uuid, required: Unique identifier for the subscription.
    - `name` string, required: Label for the subscription.
    - `url` string, required: Endpoint Meow POSTs each event to.
    - `is_enabled` boolean, required: Whether the subscription is currently receiving deliveries. Meow sets this to `false` after repeated delivery failures, a `410 Gone` response, or an unsafe URL; re-enable it with a PATCH.
    - `event_types` WebhookEventType[], nullable, required: Event types this subscription receives. `null` means every event.
    - `payload_mode` 'snapshot' | 'thin', required
    - `created_time` string, date-time, required: When the subscription was created.
    - `updated_time` string, date-time, required: When the subscription was last modified.
  - WebhookSubscriptionWithSecretResponse
    - `account_id` string, nullable: Bank account whose events this subscription receives. Null means no account filter. Fixed at creation.
    - `id` string, uuid, required: Unique identifier for the subscription.
    - `name` string, required: Label for the subscription.
    - `url` string, required: Endpoint Meow POSTs each event to.
    - `is_enabled` boolean, required: Whether the subscription is currently receiving deliveries. Meow sets this to `false` after repeated delivery failures, a `410 Gone` response, or an unsafe URL; re-enable it with a PATCH.
    - `event_types` WebhookEventType[], nullable, required: Event types this subscription receives. `null` means every event.
    - `payload_mode` 'snapshot' | 'thin', required
    - `created_time` string, date-time, required: When the subscription was created.
    - `updated_time` string, date-time, required: When the subscription was last modified.
    - `secret` string, password, required: Signing secret for verifying delivery signatures. Returned only when the subscription is created and when you rotate the secret — Meow cannot show it again, so store it now.

## Other responses

- `400`: The request could not be processed.
- `401`: Authentication failed.
- `403`: The API key is not authorized for this operation, or the user of a global API key is an admin or controller without approved KYC. The KYC case returns the message `KYC is required for controllers and admins.` until that user completes KYC in the Meow dashboard.
- `429`: Too many requests.

---

[API](https://skmtc.dev/meow/apis/meow-api.md) - [All operations](https://skmtc.dev/meow/apis/meow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/meow/apis/meow-api/revisions/ea2d7e25b63b?raw)