---
title: "Update a Webhook Callback"
method: PATCH
path: "/v1/webhook-callbacks/{id}"
tags: ["Webhooks"]
---

# Update a Webhook Callback

`PATCH /v1/webhook-callbacks/{id}`

## Request

- Base URL: `https://gateway.remote.com`
- URL: `https://gateway.remote.com/v1/webhook-callbacks/{id}`
- Auth: one of:
  - OAuth 2
    - Authorization code: `/auth/oauth2/authorize`
    - Token URL: `/auth/oauth2/token` scopes: `https://gateway.remote.com/company.manage`
  - OAuth 2
    - Authorization code: `/auth/oauth2/authorize`
    - Token URL: `/auth/oauth2/token` scopes: `webhook:write`
  - OAuth 2
    - Authorization code: `/auth/oauth2/authorize`
    - Token URL: `/auth/oauth2/token` scopes: `all:write`
  - OAuth 2
    - Client credentials
    - Token URL: `/auth/oauth2/token` scopes: `webhook:write`
  - OAuth 2
    - Client credentials
    - Token URL: `/auth/oauth2/token` scopes: `all:write`
  - HTTP bearer

Update a callback previously registered for webhooks

## Authentication

This endpoint accepts any one of the following token types:

- **Company-scoped access token** (`OAuth2AuthorizationCode`) — obtained by a company manager through the Authorization Code flow or the Refresh Token flow. See [Authentication for partners](https://developer.remote.com/docs/authentication-for-partners).
- **Company-scoped access token (assertion)** (`OAuth2CompanyManagerAssertion`) — obtained through the `urn:ietf:params:oauth:grant-type:jwt-bearer` grant for a company manager. See [OAuth Assertion](https://developer.remote.com/docs/authorization-method-oauth-assertion).
- **Customer API token** (`CustomerAPIToken`) — generated by the customer on their Integration Settings page, with the scopes they choose there. See [Authorization for customers](https://developer.remote.com/docs/authorization-for-customers).

## Scopes

Any one of the scopes in a token type's row is enough. `all:write` works too.

| Token type | Category | Read only Scope | Write only Scope (read access implicit) |
|---|---|---|---|
| Company-scoped access token | Manage company resources (`company_admin`) | - | Manage webhooks (`webhook:write`) |
| Company-scoped access token (assertion) | Manage company resources (`company_admin`) | - | Manage webhooks (`webhook:write`) |
| Customer API token | Manage company resources (`company_admin`) | - | Manage webhooks (`webhook:write`) |

## Path parameters

- `id` string, required

## Request body

- UpdateWebhookCallbackParams: Webhook callback update params. Provide either `subscribed_events` or `subscribe_to_all_events` (they are mutually exclusive). Omitting `subscribe_to_all_events` leaves the current subscription mode unchanged, so resending an event list does not disable all-events delivery. Setting `subscribe_to_all_events: false` requires a non-empty `subscribed_events`.
  - `subscribe_to_all_events` boolean: When true, subscribe this callback to all current and future event types. Cannot be combined with `subscribed_events`.
  - `subscribed_events` string[]
  - `url` string

## Response `200`

Success

- WebhookCallbackResponse: Webhook callback response
  - `data` object, required
    - `webhook_callback` WebhookCallback, required: A registered webhook callback endpoint. Remote sends HTTP POST requests to the configured URL when subscribed events occur.
      - `id` string, required: The unique identifier (UUID) of the webhook callback.
      - `signing_key` string: This key will be used to sign the signature provided with webhook requests we send to the `url` you provided for this webhook callback. The webhook signature will be included in a custom header, `X-Remote-Signature`. You can use this signature to verify that requests are coming from Remote and not some unauthorized third-party.
      - `subscribe_to_all_events` boolean: When true, this callback is subscribed to all current and future event types. `subscribed_events` then lists every currently supported event.
      - `subscribed_events` string[]
      - `url` string, required: The HTTPS URL where Remote will send webhook event payloads.

## Other responses

- `401`: Unauthorized
- `404`: Not Found
- `422`: Unprocessable Entity

---

[API](https://skmtc.dev/remote-com/apis/integrations.md) - [All operations](https://skmtc.dev/remote-com/apis/integrations/llms.txt) - [OpenAPI document](https://skmtc.dev/remote-com/apis/integrations/revisions/1798c3c003d5?raw)