---
title: "Update a webhook"
method: PUT
path: "/webhook/{webhook_slug}"
tags: ["Webhooks"]
---

# Update a webhook

`PUT /webhook/{webhook_slug}`

Updates the webhook identified by the specified slug.

## Path parameters

- `webhook_slug` string, required

## Headers

- `Accept` 'application/vnd.Creative Force.v2.3+json' | 'application/vnd.Creative Force.v2.3+xml', required
- `x-api-language` string[]

## Request body

- object
  - `method` 'get' | 'post' — HTTP method used to call the webhook URL. Values are case-sensitive.
  - `name` string — Name of the webhook.
  - `url` string, uri — URL that receives the webhook payload.
  - `signing_key` string — Key used to sign outgoing webhook requests so the receiver can validate the payload. Must be alphanumeric (`A`–`Z`, `a`–`z`, `0`–`9`). Omit to keep the existing key. When supplied, it replaces the current key.
  - `notification_emails` union — Email addresses that receive webhook delivery-failure notifications. Accepts either a single address as a string, or multiple addresses as an array of strings.
    - string
    - string[]
  - `form` string, nullable — Slug of the form to scope the webhook to. When set, the webhook only fires for events on that form. Omit or set to `null` for an account-wide webhook.
  - `fields` string[] — Slugs of the fields to include in the webhook payload.
  - `events` string[] — Subscription events that trigger this webhook. For example, `["entry_created", "entry_submitted"]`.

## Response `200`

Webhook updated.

- Webhook
  - `events` string[] — Subscription events that trigger this webhook.
  - `fields` object[] — Fields included in the webhook payload.
    - `slug` string — Short URL-safe identifier for the field.
    - `link` string, uri — Canonical URL for the field resource.
    - `title` object — Plain-text title of the field. Map keyed by locale code (for example, `en_GB` or `fr_FR`). Keys are drawn from the languages enabled on the account. Values are the translated string.
  - `form` string, nullable — Slug of the form the webhook is scoped to. `null` when the webhook is not scoped to a specific form.
  - `method` 'get' | 'post' — HTTP method used to call the webhook URL.
  - `name` string — Name of the webhook.
  - `slug` string — Slug of the webhook.
  - `signing_key` string — Key used to sign outgoing webhook requests so the receiver can validate the payload.
  - `url` string, uri — URL that receives the webhook payload.
  - `created` string, date-time — Date and time the webhook was created.
  - `updated` string, date-time — Date and time the webhook was last updated.

## Other responses

- `400` — Request was rejected before the endpoint could process it. Common causes: invalid `Accept` header, unsupported `x-api-language` code, empty request body on `POST` / `PUT`, invalid JSON in the request body, or an invalid slug format in a path parameter.
- `401` — Missing `x-api-key` header.
- `403` — Authenticated request denied. Common causes: invalid or unknown API key, suspended account, or `api` feature not enabled for the account.
- `404` — Resource identified by the path slug does not exist. Returned when the slug is well-formed but no record matches it.
- `422` — Request was syntactically valid but could not be processed. Returned in two scenarios: - **Field-level validation failure** — one or more request fields violated the endpoint's validation rules. The body includes an `errors` map keyed by field name with one or more validation messages each. - **Resource-state precondition failure** — the request fields were all valid, but the target resource was in a state that does not permit the requested operation. The body carries only `message` and `status_code`; no `errors` map.
- `429` — Rate limit of 60 requests per minute exceeded.
- `503` — Service is temporarily unavailable due to regional maintenance.

## Changes

- **2026-07-08** (v2) `72c39d7099a2` — 1 breaking
  - the request property `form` became not nullable
- **2026-07-07** (v2) `9b9103538ceb` — 2 info
  - api tag `Webhooks` added
  - api tag `Webhook` removed
- **2026-07-01** (v2) `e96a96d4507e` — 8 info
  - added the media type `application/xml` for the response with the status `200`
  - added the media type `application/xml` for the response with the status `400`
  - added the media type `application/xml` for the response with the status `401`
  - added the media type `application/xml` for the response with the status `403`
  - …4 more
- **2026-06-30** (v2) `e2f56a8e1a60` — 4 breaking, 1 warning, 42 info
  - request body became required
  - request property `events/items/` was restricted to a list of enum values
  - the `events` request property's minItems was increased to `1`
  - added the pattern `^[A-Za-z0-9]+$` to the request property `signing_key`
  - …43 more
- **2026-06-30** (v2) `a1f4e2d17c6b` — 1 breaking
  - added the pattern `^[A-Za-z]{8}$` to the `path` request parameter `webhook_slug`

[Full history](https://skmtc.dev/tectonic/apis/award-force-api/changes/webhook/:webhook_slug/put.md)

---

[API](https://skmtc.dev/tectonic/apis/award-force-api.md) · [All operations](https://skmtc.dev/tectonic/apis/award-force-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tectonic/award-force-api/revisions/e2511e46f9f2/schema)