---
title: "Update a webhook"
method: PATCH
path: "/webhooks/{id}"
tags: ["Webhooks"]
---

# Update a webhook

`PATCH /webhooks/{id}`

## Request

- Base URL: `https://shipmail.to/api/v1`
- URL: `https://shipmail.to/api/v1/webhooks/{id}`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://shipmail.to/api/auth/oauth2/authorize`, token URL `https://shipmail.to/api/auth/oauth2/token`)

## Headers

- `X-Shipmail-Organization` string

## Request body

- UpdateWebhookRequest
  - `url` string, uri: HTTPS endpoint URL.
  - `events` WebhookEventType[]: Event types to subscribe to.
  - `description` string, nullable: Human-readable description, or null to clear.
  - `active` boolean: Whether the webhook is active.
  - `mailbox_ids` string[], nullable: Replace the mailbox filter. Omit to leave it unchanged; null or [] clears it.
  - `domain_ids` string[], nullable: Replace the domain filter. Omit to leave it unchanged; null or [] clears it.
  - `authorization` string, nullable: `Authorization` header value sent with every delivery. A string replaces the stored value, null removes it, and omitting the field leaves it unchanged. Printable ASCII only. Stored encrypted and never returned.
  - `standard_webhooks_secret` string, nullable: Standard Webhooks signing secret. A string replaces the stored secret, null stops the signatures, and omitting the field leaves it unchanged. Stored encrypted and never returned.
  - `include_reply_text` boolean: Add `reply_text`, the sender's new text without quoted history or signature, to `message.received` deliveries. Turning it on needs an API key that also grants `messages:read`. Otherwise the request fails with 403. The same check applies to a URL, event, mailbox or domain change on a webhook that includes it. `false` turns it off.
  - `authenticated_senders_only` boolean: Deliver `message.received` only when the sender is authenticated (`sender_authenticated: true`): the sender passed DMARC, or Shipmail's own record shows a Shipmail mailbox sent the message. Other events are unaffected. Use it for agents that act on mail and must not trust a forged From address. `false` delivers every `message.received` again.
  - `allowed_senders` string[], nullable: Replace the senders `message.received` is limited to: addresses (`jane@customer.com`) or exact domains (`customer.com`). Entries are trimmed, lowercased and deduplicated. `null` or `[]` delivers every sender again; omit to keep the list.

## Response `200`

Updated webhook.

- Webhook
  - `object` 'webhook', required
  - `id` string, required
  - `url` string, uri, required
  - `events` WebhookEventType[], required
  - `active` boolean, required
  - `description` string, nullable, required
  - `mailbox_ids` string[], nullable, required: Mailboxes this webhook is limited to, or null. See Scoping in the webhooks guide.
  - `domain_ids` string[], nullable, required: Domains this webhook is limited to, or null. When both lists are null the webhook receives events for every mailbox.
  - `has_authorization` boolean, required: True when deliveries carry an `Authorization` header set through `authorization`. The value itself is never returned.
  - `has_standard_webhooks_secret` boolean, required: True when deliveries carry Standard Webhooks signatures (`webhook-id`, `webhook-timestamp`, `webhook-signature`) from a secret set through `standard_webhooks_secret`. The secret itself is never returned.
  - `include_reply_text` boolean, required: True when `message.received` deliveries carry `reply_text`.
  - `authenticated_senders_only` boolean, required: True when `message.received` is delivered only for messages whose sender is authenticated (`sender_authenticated: true`): the sender passed DMARC, or Shipmail's own record shows a Shipmail mailbox sent the message.
  - `allowed_senders` string[], nullable, required: Addresses and domains `message.received` is limited to, lowercased. Null when every sender is delivered.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `404`: Resource not found.
- `422`: Validation failed.
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/shipmail/apis/shipmail-api.md) · [All operations](https://skmtc.dev/shipmail/apis/shipmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shipmail/apis/shipmail-api/revisions/2c23e59d7e30?raw)