> ## Documentation Index
> Fetch the complete documentation index at: https://developer.hubmessage.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Update webhook

> Update the configuration of an existing webhook

## Overview

Partially updates a webhook's configuration. Only the fields sent in the body are updated — the rest remain unchanged.

### Updating events

When sending the `events` field, the list **replaces all** existing events:

```json theme={null}
{ "events": ["MESSAGE_RECEIVED", "MESSAGE_STATUS", "CONNECTED"] }
```

### Enabling or rotating HMAC signing

If you send `signing: true`, a new `secret` is generated and returned in this response. Use this also to **rotate** the secret without recreating the webhook.

```json theme={null}
{ "signing": true }
```

<Warning>
  The new `secret` is returned **only in this response**. Store it before closing the session.
</Warning>

### Temporarily disabling

```json theme={null}
{ "status": "DISABLED" }
```

The webhook stops receiving events while `DISABLED`. To reactivate:

```json theme={null}
{ "status": "ENABLED" }
```

<Note>
  This endpoint requires the **ENTERPRISE** role on your account.
</Note>

<Note>
  The `webhookId` is obtained from the [Create webhook](/en/webhooks/create-webhook) or [List webhooks](/en/webhooks/list-webhooks) endpoint.
</Note>


## OpenAPI

````yaml en/webhooks/openapi.json PATCH /v1/channels/{channelId}/webhooks/{webhookId}
openapi: 3.1.0
info:
  title: Hub Message - Webhooks API
  description: >-
    API to create and manage webhook endpoints per channel. Requires ENTERPRISE
    role.
  version: 1.0.0
servers:
  - url: https://api.hubmessage.io
security:
  - bearerAuth: []
paths:
  /v1/channels/{channelId}/webhooks/{webhookId}:
    patch:
      tags:
        - Webhooks
      summary: Update webhook
      description: >-
        Partially updates the webhook configuration. Only the fields sent are
        updated.
      operationId: updateWebhook
      parameters:
        - name: channelId
          in: path
          required: true
          description: Channel ID
          schema:
            type: string
            example: 019E4C54B1B375A28970B605CA9B03C3
        - name: webhookId
          in: path
          required: true
          description: Webhook ID
          schema:
            type: string
            example: A1B2C3D4E5F6789012345678901234AB
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWebhookRequest'
            examples:
              disable:
                summary: Disable webhook
                value:
                  status: DISABLED
              reenable:
                summary: Re-enable webhook
                value:
                  status: ENABLED
              updateUrlAndEvents:
                summary: Update URL and events
                value:
                  url: https://new-url.yourcompany.com/webhooks/hubmessage
                  events:
                    - MESSAGE_RECEIVED
                    - MESSAGE_STATUS
                    - CONNECTED
                    - DISCONNECTED
              enableSignature:
                summary: Enable / rotate HMAC signature
                value:
                  signing: true
              updateAuth:
                summary: Update authentication to Bearer
                value:
                  auth:
                    type: BEARER
                    token: new-secret-token
      responses:
        '200':
          description: >-
            Webhook updated successfully. The `secret` field is returned
            **only** when `signing` was enabled in this update.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookCreatedResponse'
              examples:
                afterEnableSigning:
                  summary: After enabling signature (secret returned)
                  value:
                    id: A1B2C3D4E5F6789012345678901234AB
                    channelId: 019E4C54B1B375A28970B605CA9B03C3
                    instanceId: 019E4C54B1B375A28970B605CA9B03C3
                    url: https://app.yourcompany.com/webhooks/hubmessage
                    description: Main production webhook
                    events:
                      - MESSAGE_RECEIVED
                      - MESSAGE_STATUS
                    status: ENABLED
                    signing: true
                    secret: >-
                      d4e5f6789012345678901234abcdef0123456789abcdef0123456789ab12c3d4
                    auth:
                      type: BEARER
                      configured: true
                    payloadFormat: DEFAULT
                    customAttributes: {}
                    createdAt: 2025-01-15T10:30:00.000+0000
                    updatedAt: 2025-01-20T14:00:00.000+0000
                afterDisable:
                  summary: After disabling (no secret)
                  value:
                    id: A1B2C3D4E5F6789012345678901234AB
                    channelId: 019E4C54B1B375A28970B605CA9B03C3
                    instanceId: 019E4C54B1B375A28970B605CA9B03C3
                    url: https://app.yourcompany.com/webhooks/hubmessage
                    description: Main production webhook
                    events:
                      - MESSAGE_RECEIVED
                      - MESSAGE_STATUS
                    status: DISABLED
                    signing: true
                    auth:
                      type: BEARER
                      configured: true
                    payloadFormat: DEFAULT
                    customAttributes: {}
                    createdAt: 2025-01-15T10:30:00.000+0000
                    updatedAt: 2025-01-20T15:00:00.000+0000
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                error: 400
                message: Validation error
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: Webhook not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                error: 404
                message: Webhook not found
        '422':
          description: Business rule violation — account does not have ENTERPRISE role
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                error: 422
                message: This action requires ENTERPRISE role
components:
  schemas:
    UpdateWebhookRequest:
      type: object
      description: All fields are optional — only the fields sent are updated.
      properties:
        url:
          type: string
          description: New destination URL
          example: https://new-url.yourcompany.com/webhooks/hubmessage
        description:
          type: string
          description: New description
        events:
          type: array
          description: New event list — replaces all existing events
          items:
            type: string
            enum:
              - MESSAGE_RECEIVED
              - MESSAGE_DELIVERY
              - MESSAGE_STATUS
              - RECEIVED_STATUS
              - RECEIVED_AND_DELIVERY
              - CONNECTED
              - DISCONNECTED
              - PRESENCE_CHAT
              - INITIAL_DATA
              - BLOCK
        status:
          type: string
          enum:
            - ENABLED
            - DISABLED
          description: '`DISABLED` pauses event delivery without deleting the webhook'
        signing:
          type: boolean
          description: >-
            Enables or rotates the HMAC signature. Generates a new `secret`
            returned in the response.
        auth:
          $ref: '#/components/schemas/WebhookAuth'
        payloadFormat:
          type: string
          enum:
            - DEFAULT
        customAttributes:
          type: object
          additionalProperties: true
    WebhookCreatedResponse:
      allOf:
        - $ref: '#/components/schemas/WebhookResponse'
        - type: object
          properties:
            secret:
              type: string
              description: >-
                64-character hex HMAC secret — returned **only** when `signing`
                is enabled on create or update. Store it securely; it cannot be
                retrieved later.
              example: a3f1c2d4e5b6789012345678901234abcdef0123456789abcdef0123456789ab
    Error:
      type: object
      properties:
        error:
          type: integer
        message:
          type: string
    WebhookAuth:
      type: object
      description: Configures how Hub Message authenticates when calling your URL
      properties:
        type:
          type: string
          enum:
            - NONE
            - BEARER
            - API_KEY
            - BASIC
            - CUSTOM_HEADER
          description: Authentication type
          example: BEARER
        token:
          type: string
          description: >-
            Token for `BEARER` authentication — sent in the `Authorization:
            Bearer <token>` header
          example: my-secret-token
        key:
          type: string
          description: Key for `API_KEY` authentication
        username:
          type: string
          description: Username for `BASIC` authentication
        password:
          type: string
          description: Password for `BASIC` authentication
        headerName:
          type: string
          description: Header name for `CUSTOM_HEADER`
          example: X-Api-Key
        headerValue:
          type: string
          description: Header value for `CUSTOM_HEADER`
    WebhookResponse:
      type: object
      properties:
        id:
          type: string
          description: Unique webhook ID
          example: A1B2C3D4E5F6789012345678901234AB
        channelId:
          type: string
          description: ID of the channel this webhook belongs to
          example: 019E4C54B1B375A28970B605CA9B03C3
        instanceId:
          type: string
          deprecated: true
          description: Deprecated — use `channelId` instead
          example: 019E4C54B1B375A28970B605CA9B03C3
        url:
          type: string
          description: Event destination URL
          example: https://app.yourcompany.com/webhooks/hubmessage
        description:
          type: string
          nullable: true
          description: Webhook description
          example: Main production webhook
        events:
          type: array
          description: Configured event types
          items:
            type: string
          example:
            - MESSAGE_RECEIVED
            - MESSAGE_STATUS
        status:
          type: string
          enum:
            - ENABLED
            - DISABLED
          description: Current webhook status
          example: ENABLED
        signing:
          type: boolean
          description: Indicates whether HMAC signing is enabled
          example: true
        auth:
          $ref: '#/components/schemas/WebhookAuthInfo'
        payloadFormat:
          type: string
          enum:
            - DEFAULT
          description: Delivered payload format
          example: DEFAULT
        customAttributes:
          type: object
          additionalProperties: true
          description: Configured extra attributes
          example: {}
        createdAt:
          type: string
          format: date-time
          description: Creation date
          example: 2025-01-15T10:30:00.000+0000
        updatedAt:
          type: string
          format: date-time
          description: Last update date
          example: 2025-01-15T10:30:00.000+0000
    WebhookAuthInfo:
      type: object
      description: >-
        Summary of configured authentication — credentials are not returned for
        security
      properties:
        type:
          type: string
          enum:
            - NONE
            - BEARER
            - API_KEY
            - BASIC
            - CUSTOM_HEADER
          example: BEARER
        configured:
          type: boolean
          description: '`true` when credentials are configured'
          example: true
  responses:
    Unauthorized:
      description: Invalid or missing token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error: 401
            message: Unauthorized
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Secret Key generated in the Hub Message Security panel

````