Update a webhook endpoint
Partial update — every field on the request body is optional and omitted fields are left untouched. metadata follows Stripe-style merge semantics ({}/null clears, empty-string values delete a key). The signing secret cannot be rotated through this endpoint; use the dedicated rotate-secret endpoint instead.
Authorizations
Path Parameters
UUID of the webhook endpoint. Returned as the id field on every endpoint response.
22^[23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]{22}$Body
Request body for PATCH /webhooks/endpoints/{endpoint_id}/.
All fields are optional. Omitted fields are left untouched (Stripe-style
partial update). metadata follows the standard Stripe-equivalent
merge rules — see :class:MetadataWriteMixin.
Developer-attached key/value data. Send {} or null to clear. Empty-string values delete that key. Omitted keys are preserved.
Target URL the webhook payload will be POSTed to. HTTPS is required in production; http:// is accepted only by the local development server. Maximum 2048 characters. The request body is the raw event JSON; the signature lives in the X-Closient-Signature header (see signing_secret for the verification recipe).
2048Optional human-readable label for this endpoint. Surfaced in the brand portal's webhooks list alongside the URL — useful when a single account has separate staging / production endpoints. Maximum 255 characters. Has no effect on delivery.
255Event types this endpoint subscribes to, drawn from the catalog at GET /webhooks/event-types/. Two forms are accepted: a full wire value (recall.opened) or a domain prefix (recall), which subscribes to every event in that domain including ones added after you subscribe — the recommended form for safety-critical domains. Values outside the catalog are rejected with 422 rather than silently accepted, so a typo cannot leave you subscribed to nothing. An empty list means every event type (fail-open); use is_active=false to pause delivery instead.
Whether this endpoint should receive deliveries. false pauses delivery without deleting historical records or losing the signing secret — useful while debugging a customer-side outage. New events are not enqueued for inactive endpoints.
Envelope version this endpoint receives. Pinned when the endpoint is created and never moved by Closient — shipping a new envelope version does not change what an existing endpoint gets, so an integration can keep running untouched indefinitely. PATCH this field when your parser is ready for a newer shape. v1 is the pre-catalog envelope (event_type / version / event_id / timestamp / data); 2026-07-01 is the current CloudEvents-shaped envelope (type / specversion / id / time / source / data) and additionally carries the cursor used for replay-on-reconnect. Setting this takes effect on the next event delivered; deliveries already queued keep the version they were built at.
v1, 2026-07-01 Response
OK
A webhook endpoint as read from the API.
Returned by GET /webhooks/endpoints/{endpoint_id}/, the list view,
and the rotate-secret/test endpoints. signing_secret is masked
except on the initial create response and on the rotate-secret
response — see :data:_SIGNING_SECRET_READ_DESC.
UUID identifier of the endpoint. Use this in path params and the deliveries-list endpoint_id filter.
22^[23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]{22}$Target URL the webhook payload will be POSTed to. HTTPS is required in production; http:// is accepted only by the local development server. Maximum 2048 characters. The request body is the raw event JSON; the signature lives in the X-Closient-Signature header (see signing_secret for the verification recipe).
2048HMAC-SHA256 signing secret for verifying the X-Closient-Signature header on inbound deliveries. Returned in full only on creation and rotation; subsequent GET/LIST responses return a masked form (<first-8-chars>...). Verification recipe: compute HMAC-SHA256(secret, f"{timestamp}.{raw_body}") where timestamp is the t= portion of the header, then hmac.compare_digest against the v1= portion. Reject if the timestamp is older than 5 minutes (replay protection). During a 24-hour rotation grace period the header carries an additional v1old= signature using the prior secret — accept either.
Whether this endpoint should receive deliveries. false pauses delivery without deleting historical records or losing the signing secret — useful while debugging a customer-side outage. New events are not enqueued for inactive endpoints.
Envelope version this endpoint receives. Pinned when the endpoint is created and never moved by Closient — shipping a new envelope version does not change what an existing endpoint gets, so an integration can keep running untouched indefinitely. PATCH this field when your parser is ready for a newer shape. v1 is the pre-catalog envelope (event_type / version / event_id / timestamp / data); 2026-07-01 is the current CloudEvents-shaped envelope (type / specversion / id / time / source / data) and additionally carries the cursor used for replay-on-reconnect.
v1, 2026-07-01 Server-side ISO 8601 timestamp (UTC) of when the resource was first persisted.
Server-side ISO 8601 timestamp (UTC) of the resource's last modification.
Developer-attached key/value data attached to this object. Up to 50 keys; key max 40 chars, value max 500 chars.
Optional human-readable label for this endpoint. Surfaced in the brand portal's webhooks list alongside the URL — useful when a single account has separate staging / production endpoints. Maximum 255 characters. Has no effect on delivery.
255Event types this endpoint subscribes to, drawn from the catalog at GET /webhooks/event-types/. Two forms are accepted: a full wire value (recall.opened) or a domain prefix (recall), which subscribes to every event in that domain including ones added after you subscribe — the recommended form for safety-critical domains. Values outside the catalog are rejected with 422 rather than silently accepted, so a typo cannot leave you subscribed to nothing. An empty list means every event type (fail-open); use is_active=false to pause delivery instead.