---
title: "Update a webhook"
method: PUT
path: "/v1/webhooks/{webhookId}"
tags: ["Webhooks"]
---

# Update a webhook

`PUT /v1/webhooks/{webhookId}`

## Request

- Base URL: `https://api.postzen.dev`
- URL: `https://api.postzen.dev/v1/webhooks/{webhookId}`
- Auth: HTTP bearer

Updates one or more endpoint settings. Omitted fields are unchanged. This endpoint requires a read-write API key.

## Request body

- WebhookUpdateRequest: Include at least one field. Omitted fields keep their stored values.
  - `name` string
  - `url` string, uri
  - `events` WebhookEvent[]
  - `profileAccess` 'all_profiles' | 'selected_profiles'
  - `profileIds` string[]: Replacement profile selection. Must be non-empty for selected_profiles and empty for all_profiles.
  - `secret` string, nullable: Omit to keep the stored secret, send a non-empty string to replace it, or send null to remove it.
  - `customHeaders` WebhookCustomHeader[]: Omit to keep stored headers. Send the complete collection to replace all headers, or [] to remove all headers. Every supplied value is plaintext and is encrypted at rest.
    - `name` string, required: HTTP header name. Content-Type, transport headers, and X-PostZen-* names are reserved.
    - `value` string, required: Plaintext header value. PostZen encrypts it at rest and never returns it.
  - `isActive` boolean: Enable or disable delivery. Re-enabling resets the consecutive exhausted-event count.

## Response `200`

Webhook updated.

- WebhookWriteResponse
  - `message` string, required
  - `webhook` Webhook, required
    - `id` string, required
    - `name` string, required
    - `url` string, uri, required
    - `events` WebhookEvent[], required
    - `profileAccess` 'all_profiles' | 'selected_profiles', required
    - `profileIds` string[], required: Selected profile ids. Empty when profileAccess is all_profiles.
    - `hasSigningSecret` boolean, required: Whether PostZen signs deliveries for this endpoint. The secret itself is never returned.
    - `customHeaderNames` string[], required: Configured custom header names. Header values are never returned.
    - `isActive` boolean, required
    - `disabledReason` 'auto_consecutive_failures' | 'user_disabled'
    - `consecutiveFailures` integer, required
    - `lastDeliveredAt` string, date-time
    - `lastFailedAt` string, date-time
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `400`: Invalid request.
- `401`: Missing or invalid API key.
- `403`: The API key does not have sufficient permission or profile access.
- `404`: Resource not found.
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/postzen/apis/postzen-public-api.md) · [All operations](https://skmtc.dev/postzen/apis/postzen-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postzen/apis/postzen-public-api/revisions/40863e3710ec?raw)