Cowdidocs
API ReferenceWebhooks

Update a webhook

PATCH
/v1/webhooks/{webhookId}

Changes the URL, status, timeout, or the set of events this webhook receives. events is the complete set, so it is also how an event is added or removed. Omitted fields are left as they are. Requires the org:connect:write permission. Returns 400 when the URL is invalid or an events entry is not in the published vocabulary, 404 when the caller's organization has no webhook with this id, and 409 when the new URL already belongs to another webhook.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

webhookId*string

Unique identifier of the webhook.

Formatuuid

Request Body

application/json

Request to update a webhook. Every field is optional; an omitted field is left as it is.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PATCH "https://example.com/v1/webhooks/550e8400-e29b-41d4-a716-446655440000" \  -H "Content-Type: application/json" \  -d '{}'
{  "id": "550e8400-e29b-41d4-a716-446655440000",  "name": "sales-app",  "description": "Order updates for the sales app",  "url": "https://sales.example.com/hooks/cowdi",  "status": "ACTIVE",  "events": [    "approval.outcome"  ],  "timeout": "PT5S",  "signing_keys": [    {      "id": "550e8400-e29b-41d4-a716-446655440001",      "masked_secret": "whsec_...a1b2",      "created_at": "2026-09-01T10:15:30Z"    }  ],  "created_at": "2026-09-01T10:15:30Z",  "updated_at": "2026-10-15T14:22:00Z"}
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Get a webhook GET

Reads one webhook of the caller's organization, with its signing key fingerprints. Requires the `org:connect:read` permission. Returns 404 when the caller's organization has no webhook with this id.

Delete a webhook DELETE

Deletes the webhook and its signing keys. Existing delivery records stay available. An active delivery finishes before deletion returns. Requires the `org:connect:write` permission. Returns 404 when the caller's organization has no webhook with this id.