Skip to main content
PUT
Update

Update Webhook

This endpoint allows updating the URL, the events and the signing secret of a registered webhook.
  • The webhook is identified by its url and the optional account_id, both sent in the request body. The path never carries the URL
  • To move the webhook to another address, send the new address in new_url
  • events replaces the whole list: to stop receiving an event on this URL, send the list without it; to start receiving one, add it
Registering, updating or removing a webhook may take up to 5 minutes to take effect. Until then, webhooks keep being delivered to the previous destination.

Request Body

string
required
Current URL of the webhook that will be updated. Together with account_id, it identifies the webhook. If the account has no webhook with this URL, the request fails with 404.Maximum length: 120 charactersExample: https://my-url.requestcatcher.com/test
string
New endpoint URL for the webhook. When omitted, the URL stays the same.It must not be registered on another webhook of the account (URLs that differ only in letter case count as the same URL); otherwise the request fails with 422 and the webhook_url_already_exists code.Maximum length: 120 charactersExample: https://my-url.requestcatcher.com/new
string[]
required
Complete list of events the webhook will receive after the update. Send at least one event, without repeating any.Allowed values: onboarding, payin, payout, kycEach event can be on only one webhook per account: sending an event that another webhook of the account already receives fails with 422 and the webhook_already_exists code on that item (for example events.0). Remove it from the other webhook first.Example: ["payin", "payout"]
string
Secret used to sign the payin, payout and kyc webhooks with HMAC-SHA256. When provided, every webhook delivered to this URL includes the x-webhook-wp-signature header.Maximum length: 255 characters. Use a long, randomly generated value.Example: whsec_9f8e7d6c5b4a3210
integer
ID of the account whose webhook will be updated: your own merchant or one of its subaccounts.When omitted, the webhook of your merchant (the authenticated account) is updated.If the account does not exist or is not linked to your merchant, the request fails with 422 and the invalid_account code.Example: 4521
Without account_id, the update always targets your merchant, even if the webhook you want to change was listed by Query under a subaccount. Send the account_id returned with the webhook to update the right one.
The update replaces the whole configuration. If secret is omitted or null, the current secret is removed and the webhooks are no longer signed. Always send the secret you want to keep.
An event left out of events stops being delivered to this URL. On a subaccount, it then goes to the main account’s webhook for that event, if there is one — see Subaccounts without a webhook.
To rotate the secret, send the new value in secret. Changes may take up to 5 minutes to take effect, so accept signatures computed with either the old or the new secret during this period.

Response

integer
ID of the account the webhook belongs to.Example: 4521
string[]
Events the webhook receives after the update.Allowed values: onboarding, payin, payout, kycExample: ["payin", "payout"]
string
Endpoint URL of the webhook after the updateExample: https://my-url.requestcatcher.com/new
string
Secret used to sign the webhooks delivered to this URL, or null if none is set.Example: whsec_9f8e7d6c5b4a3210

Request Example