---
title: "Update a dispute webhook"
method: PUT
path: "/api/v1/dispute-webhooks/{id}"
tags: ["Dispute webhooks"]
---

# Update a dispute webhook

`PUT /api/v1/dispute-webhooks/{id}`

## Request

- Base URL: `https://api.tabby.ai`
- URL: `https://api.tabby.ai/api/v1/dispute-webhooks/{id}`
- Auth: HTTP bearer

Updates the specified dispute webhook. The request **replaces the whole object**:
send both `url` and `header`; omitting `header` removes it. The same URL rules
as on registration apply (normalised, unique per merchant).

## Path parameters

- `id` string, uuid, required

## Headers

- `X-Merchant-Code` string, required

## Request body

- DisputeWebhookRequest
  - `url` string, uri, required: Endpoint for dispute notifications (HTTPS recommended). Must be an absolute URL with a publicly resolvable host name — `localhost`, raw IP addresses and hosts that do not resolve are rejected. Normalised before it is stored (lower-case scheme and host, default port and trailing slash removed) and unique per merchant.
  - `header` object: Optional static header Tabby adds to every notification so you can verify its origin. Omit it on `PUT` to remove the header.
    - `title` string, required: Header name (an HTTP token, up to 128 characters).
    - `value` string, required: Header value (up to 1024 characters). Treated as a secret — every response returns it masked.

## Response `200`

Success. Dispute webhook object is returned; `header.value` is masked.

- DisputeWebhook
  - `id` string, required: Unique dispute webhook ID, assigned by Tabby.
  - `url` string, uri, required: Endpoint for dispute notifications, as stored (normalised).
  - `header` object, nullable: The signing header, if one was registered. `value` is masked.
    - `title` string
    - `value` string: Masked — `****` followed by the last 4 characters of the stored value; `****` alone when the value has 8 characters or fewer.

## Other responses

- `400`: One of the required fields is missing or request is not formatted correctly.
- `401`: The request cannot be authorized.
- `403`: Disputes have no test mode — the request was authorized with a test secret key.
- `404`: No dispute webhook with this ID exists for the merchant.
- `500`: Something bad happened. We're notified.

## Changes

- **2026-09-24** `33b6fd80a009`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/tabby/apis/tabby-api-reference/changes/api/v1/dispute-webhooks/:id/put.md)

---

[API](https://skmtc.dev/tabby/apis/tabby-api-reference.md) - [All operations](https://skmtc.dev/tabby/apis/tabby-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/tabby/apis/tabby-api-reference/revisions/ca3b26b83f76?raw)