---
title: "Call the updateWebhookEndpoint MCP tool"
method: POST
path: "/api/v1/actions/updateWebhookEndpoint"
tags: ["Actions"]
---

# Call the updateWebhookEndpoint MCP tool

`POST /api/v1/actions/updateWebhookEndpoint`

## Request

- Base URL: `https://app.reachium.io`
- URL: `https://app.reachium.io/api/v1/actions/updateWebhookEndpoint`
- Auth: HTTP bearer

Edit a webhook endpoint OR run one action on it (never both in the same call). Field-edit mode: pass any of url, events, campaign_filters, is_active to patch them (at least one required); re-enabling with is_active:true clears any auto-disable reason and resets the failure streak. Action mode: pass action instead of those fields. "rotate_secret" is refused from this surface (it would invalidate the live secret without showing the new one): rotate in Settings > Developer > Webhooks, where the new value is shown once; the REST API rotates directly. "test" sends a ping event to prove the endpoint is reachable. "redeliver" retries one past delivery (delivery_id from getWebhookEndpoints view:"deliveries"; only failed or dead deliveries can be retried). To permanently remove an endpoint use deleteWebhookEndpoint.

Called through the Actions bridge: the response is that tool's own result, wrapped as `{ data: <tool result> }` under HTTP 200. Billing, daily-cap, and confirm-step outcomes are embedded INSIDE `data`, never remapped to an HTTP status (see the templated `/api/v1/actions/{toolName}` operation above for the full protocol, and `x-mcp-actions` for this tool's machine-readable scope/cap/confirm_behavior fields). Authentication, request-shape, and optional idempotency-protocol failures still use their documented non-200 statuses.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `endpoint_id` string, uuid, required: The endpoint to edit (from getWebhookEndpoints).
  - `url` string, uri: New https url. Field-edit mode only.
  - `events` string[]: Replaces the full event subscription list. Field-edit mode only.
  - `campaign_filters` string[]: Replaces the campaign filter list (must be campaigns already in this workspace). Pass an empty array or omit to receive events for every campaign. Field-edit mode only.
  - `is_active` boolean: Enable or disable the endpoint. Field-edit mode only.
  - `action` 'rotate_secret' | 'test' | 'redeliver': Run one action instead of editing fields.
  - `delivery_id` string, uuid: Required only when action is "redeliver" (from getWebhookEndpoints view:"deliveries").

## Response `200`

The result of calling this tool.

- object
  - `data` unknown, required
  - `error` unknown, required

## Other responses

- `400`: The request body was not a JSON object (code invalid_request), or Idempotency-Key is malformed (code invalid_idempotency_key).
- `401`: Missing or invalid API key. Send `Authorization: Bearer rmcp_...` (code unauthorized).
- `403`: This tool is out of the key’s granted scope (code insufficient_scope).
- `409`: This Idempotency-Key has an unresolved in-flight or ambiguous result (code request_in_flight). Reconcile before using a new key.
- `422`: This Idempotency-Key was already used with a different request body (code idempotency_key_reuse).
- `429`: Rate limited: shared `mcp:ip:{ip}` (600/60s) or `mcp:key:{keyId}` (120/60s) bucket, the SAME buckets the MCP endpoint uses (code rate_limited).
- `500`: Unhandled server error (code internal_error).

---

[API](https://skmtc.dev/reachium/apis/reachium-api.md) · [All operations](https://skmtc.dev/reachium/apis/reachium-api/llms.txt) · [OpenAPI document](https://skmtc.dev/reachium/apis/reachium-api/revisions/80c82dd6c7a1?raw)