Update webhook subscription

PUT

https://client.api.corpx.com/v1/webhooks/:subscriptionId

PUT

/v1/webhooks/:subscriptionId

curl -X PUT https://client.api.corpx.com/v1/webhooks/subscriptionId \
     -H "X-Content-SHA256: X-Content-SHA256" \
     -H "X-Request-Signature: X-Request-Signature" \
     -H "X-Request-Timestamp: X-Request-Timestamp" \
     -H "X-Tenant-Id: X-Tenant-Id" \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "url": "https://example.com/webhooks/corpx",
  "eventTypes": [
    "pix.in.completed"
  ],
  "active": true,
  "authType": "HMAC",
  "secret": "whsec_9f8e7d6c5b4a3f2e1d0c"
}'

{
  "subscriptionId": "8c1f6a2e-4d3b-4b9a-9f0e-1a2b3c4d5e6f",
  "tenantId": "tn_7f3a9c",
  "url": "https://example.com/webhooks/corpx",
  "active": true,
  "eventTypes": [
    "pix.in.completed"
  ],
  "authType": "HMAC",
  "hmacSecretSet": true,
  "createdAt": "2026-02-20T08:33:39Z",
  "updatedAt": "2026-02-20T08:33:39Z",
  "accountId": "2e6b725b-84a0-400d-8740-22a5ba0f23e6"
}

Updates an existing webhook subscription.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Path parameters

subscriptionIdstringRequired

Webhook subscription ID.

Headers

X-Content-SHA256stringRequired

Lowercase hex SHA-256 of the body. An empty body hashes the empty string, so the header is always present. Mismatch returns 400 body_hash_mismatch.

Request

This endpoint expects an object.

urlstringOptionalformat: "uri"

eventTypeslist of stringsOptional

activebooleanOptional

Enable or disable the subscription.

authTypeenumOptional

Omit to leave authentication untouched. Send NONE to delete the stored HMAC key and stop signing deliveries. Any value other than HMAC or NONE is rejected.

Allowed values:

secretstringOptional

New HMAC key. The current key is never returned, so leaving this out keeps it as is — send a value only to rotate the key.

Response

Webhook subscription updated.

subscriptionIdstring

Unique subscription identifier.

tenantIdstring

Tenant that owns this subscription.

urlstringformat: "uri"

URL that receives webhook events.

activeboolean

Whether the subscription is active.

eventTypeslist of stringsOptional

Event types this subscription receives.

authTypeenumOptional

Authentication applied to delivery.

hmacSecretSetbooleanOptional

Whether an HMAC key is stored. The key itself is never returned by any endpoint.

createdAtdatetimeOptional

updatedAtdatetimeOptional

accountIdstring or nullOptional

Account this subscription is bound to. null means tenant-wide: it receives every account’s events.

Errors

400

Bad Request Error

404

Not Found Error

500

Internal Server Error