Skip to main content
PATCH
Update a webhook endpoint

Authorizations

Authorization
string
header
required

Project-scoped secret API key (sk_…). Pass in the Authorization: Bearer <key> header. Grants access to the project the key was issued for.

Path Parameters

endpointId
integer | null

Numeric webhook endpoint identifier.

Example:

17

Body

application/json

Partial update of a webhook endpoint. To rotate the signing secret, use POST /webhooks/{endpointId}/rotate-secret instead.

name
string

Human-readable name shown in dashboards.

Required string length: 1 - 255
description
string | null

Optional free-text note describing the endpoint.

url
string<uri>

HTTPS URL the signed event payload will be POSTed to.

status
enum<string>

Set to active to receive deliveries; inactive to pause without losing config. disabled is reserved for the system to set after repeated delivery failures.

Available options:
active,
inactive,
disabled
Example:

"active"

event_types
enum<string>[]

Replace the set of subscribed events. At least one is required.

Minimum array length: 1

Event the endpoint is subscribed to. Each event identifies a queue, delivery, reputation, or infrastructure signal. See the events reference for full descriptions.

Available options:
queue.queue-message-authenticated,
queue.rescheduled,
queue.quota-exceeded,
delivery.concurrency-limit-exceeded,
delivery.attempt-start,
delivery.attempt-end,
delivery.completed,
delivery.delivered,
delivery.dsn-perm-fail,
delivery.dsn-temp-fail,
delivery.failed,
delivery.mail-from-rejected,
delivery.message-rejected,
delivery.rcpt-to-rejected,
delivery.rcpt-to-failed,
delivery.mx-lookup-failed,
delivery.ip-lookup-failed,
delivery.null-mx,
delivery.connect-error,
delivery.greeting-failed,
delivery.ehlo-rejected,
delivery.start-tls-error,
delivery.start-tls-unavailable,
delivery.implicit-tls-error,
incoming-report.abuse-report,
incoming-report.fraud-report,
incoming-report.virus-report

Response

The updated webhook endpoint.

Configured destination that receives signed event payloads when subscribed events fire. Verify each delivery using the Spotzee-Signature header — t=<unix-ts>,v1=<hex-hmac-sha256> — with HMAC-SHA-256 over "<unix-ts>.<raw-request-body>" keyed by the signing secret. Reject signatures whose timestamp is more than 5 minutes from now.

id
integer
required

Numeric webhook endpoint identifier.

Example:

17

project_id
integer
required

Identifier of the owning project.

Example:

42

name
string
required

Human-readable name shown in dashboards.

Example:

"Order events to billing service"

url
string<uri>
required

HTTPS URL the signed event payload will be POSTed to.

Example:

"https://api.example.com/spotzee/webhooks"

status
enum<string>
required

Lifecycle state of the endpoint. active receives events; inactive is paused by the user; disabled was suspended by the system after repeated delivery failures.

Available options:
active,
inactive,
disabled
Example:

"active"

event_types
enum<string>[]
required

Events the endpoint is subscribed to.

Event the endpoint is subscribed to. Each event identifies a queue, delivery, reputation, or infrastructure signal. See the events reference for full descriptions.

Available options:
queue.queue-message-authenticated,
queue.rescheduled,
queue.quota-exceeded,
delivery.concurrency-limit-exceeded,
delivery.attempt-start,
delivery.attempt-end,
delivery.completed,
delivery.delivered,
delivery.dsn-perm-fail,
delivery.dsn-temp-fail,
delivery.failed,
delivery.mail-from-rejected,
delivery.message-rejected,
delivery.rcpt-to-rejected,
delivery.rcpt-to-failed,
delivery.mx-lookup-failed,
delivery.ip-lookup-failed,
delivery.null-mx,
delivery.connect-error,
delivery.greeting-failed,
delivery.ehlo-rejected,
delivery.start-tls-error,
delivery.start-tls-unavailable,
delivery.implicit-tls-error,
incoming-report.abuse-report,
incoming-report.fraud-report,
incoming-report.virus-report
Example:
has_secret
boolean
required

Whether a signing secret is currently configured. The plaintext secret itself is only returned on create and on rotate — never re-fetched.

created_at
string | null
required

Time the endpoint was created. ISO 8601.

updated_at
string | null
required

Time the endpoint was last modified. ISO 8601.

description
string | null

Optional free-text note describing the endpoint.