---
title: "Update a webhook"
method: PATCH
path: "/v1/webhooks/{id}"
tags: ["Webhook management"]
---

# Update a webhook

`PATCH /v1/webhooks/{id}`

## Request

- Base URL: `https://api.vatnode.dev`
- URL: `https://api.vatnode.dev/v1/webhooks/{id}`
- Auth: one of:
  - API key in cookie `better-auth.session_token`
  - HTTP bearer

Update the URL and/or status. A webhook cannot be set `active`
directly – it must pass a test (`TEST_REQUIRED`). Changing the URL
drops the webhook back to `disabled` and requires a fresh test.

## Path parameters

- `id` string, required

## Request body

- object
  - `url` string, uri: New publicly reachable HTTPS endpoint.
  - `status` 'disabled': Only `disabled` is accepted; activation happens via a test.

## Response `200`

The updated webhook.

- Webhook
  - `id` string, required
  - `url` string, uri, required
  - `status` 'active' | 'disabled' | 'inactive', required
  - `consecutiveFailures` integer: Consecutive failed deliveries. Present on list/update responses.
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required

## Other responses

- `400`: The request body, query string or path parameters failed structural validation (wrong type, missing required field, out-of-range length, malformed enum, etc.). Returns the standard error envelope with code `INVALID_REQUEST`. This is distinct from a semantically well-formed request that is rejected later (e.g. `INVALID_FORMAT` for a VAT ID that parses but is not a valid VAT number).
- `401`: No valid session (`UNAUTHORIZED`), or the account has been deleted (`ACCOUNT_DELETED`).
- `404`: The addressed resource does not exist, or is not owned by the authenticated caller. Returns the standard error envelope with code `NOT_FOUND`. Ownership and existence are deliberately not distinguished, so a resource belonging to another account is reported as missing rather than forbidden.
- `422`: Attempted to set `active` directly (`TEST_REQUIRED`) or the URL is not a safe public HTTPS endpoint (`INVALID_URL`).
- `500`: An unexpected server error occurred. Returns the standard error envelope with code `INTERNAL_ERROR` and a `requestId` for support correlation. The failing request had no side effects the caller can rely on; retry is safe for idempotent operations.
- `503`: The database is temporarily unavailable (`DB_UNAVAILABLE`).

---

[API](https://skmtc.dev/vatnode/apis/vatnode-api.md) · [All operations](https://skmtc.dev/vatnode/apis/vatnode-api/llms.txt) · [OpenAPI document](https://skmtc.dev/vatnode/apis/vatnode-api/revisions/c65828db2037?raw)