Update webhook endpoint

Changes the address, the note or the subscribed events of a webhook endpoint. Sends no messages and keeps the signing secret. Send only the fields that change.

PATCH /v1/webhook-endpoints/{endpoint_id}

Permission	`webhooks:write` (all permissions)
Risk	Write (no outside effect)
Idempotency-Key	Not needed (how it works)
Safe to repeat	Safe by nature: the end state is the same when you repeat it, so no key is needed.
Rate limit class	`write` (120 requests per minute per key)
Confirmation	None
MCP tool	Not available in MCP
Since version	2026-10-25

#What it does

Changes data in your account. It does not send messages to contacts.
Safe to repeat by nature; it needs no Idempotency-Key.

#Request

Path parameters

Name	Type	Description
`endpoint_id`	string	Webhook endpoint ID.

Body (JSON)

Name	Type	Required	Description
`url`	string	no	New HTTPS address (same rules as when creating). up to 2000 characters
`description`	string	no	New note. up to 200 characters
`enabled_events`	array of string	no	Event types to receive (see the events page) or ["*"] for all available events. Planned events are rejected. Your key needs the read permission of each event. up to 30 items

#Examples

curlPythonTypeScript

curl -X PATCH "https://api.smartchat.marketing/v1/webhook-endpoints/whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234" \
  -H "Authorization: Bearer $SMARTCHAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "Order system (new)"
}'

import os
import requests

response = requests.patch(
    "https://api.smartchat.marketing/v1/webhook-endpoints/whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234",
    headers={"Authorization": "Bearer " + os.environ["SMARTCHAT_API_KEY"]},
    json={
        "description": "Order system (new)",
    },
)
response.raise_for_status()
print(response.json())

const response = await fetch("https://api.smartchat.marketing/v1/webhook-endpoints/whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.SMARTCHAT_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "description": "Order system (new)"
  }),
});
if (!response.ok) throw new Error(await response.text());
console.log(await response.json());

Response (200):

{
  "object": "webhook_endpoint",
  "id": "whe_0f8c1a2e4b7d4c3e9a5b6d7e8f901234",
  "url": "https://example.com/hooks/smartchat",
  "description": "Order system (new)",
  "enabled_events": [
    "contact.created",
    "message.received"
  ],
  "status": "active",
  "disabled_reason": null,
  "secret_hint": "whsec_...x9Qa",
  "consecutive_failures": 0,
  "last_success_at": "2026-10-25T09:45:00Z",
  "last_failure_at": null,
  "secret_previous_expires_at": null,
  "created_at": "2026-10-25T09:41:07Z",
  "updated_at": "2026-10-25T09:45:00Z"
}

#Response

Status 200. Every response has the headers Request-Id, SmartChat-Version and X-RateLimit-*.

Name	Type	Description
`object`	string	Always "webhook_endpoint". always `webhook_endpoint`
`id`	string	Webhook endpoint ID.
`url`	string	HTTPS address that receives the events. up to 2000 characters
`description`	string	Your own note about this endpoint. up to 200 characters
`enabled_events`	array of string	Event types this endpoint receives, or ["*"] for all available events. up to 30 items
`status`	string	active and degraded receive events. paused and disabled do not; call enable_webhook_endpoint. one of: `active`, `degraded`, `paused`, `disabled`
`disabled_reason`	string or null	Why the endpoint was paused or disabled. Null while it is working. up to 60 characters
`secret_hint`	string	Last 4 characters of the signing secret, for example whsec_...abcd. up to 20 characters
`consecutive_failures`	integer	Failed delivery attempts in a row since the last success. 0 to 1000000
`last_success_at`	string or null	Time of the last successful delivery. up to 40 characters; format date-time
`last_failure_at`	string or null	Time of the last failed delivery attempt. up to 40 characters; format date-time
`secret_previous_expires_at`	string or null	While a secret rotation is running: when the old secret stops signing. Otherwise null. up to 40 characters; format date-time
`created_at`	string	When the endpoint was created. up to 40 characters; format date-time
`updated_at`	string	When the endpoint was last changed. up to 40 characters; format date-time

#Errors

Code	Status	When
`api_key_expired`	401	This API key has expired.
`api_key_invalid`	401	This API key is not valid.
`api_key_revoked`	401	This API key was revoked.
`authentication_required`	401	No API key was sent. Send 'Authorization: Bearer <key>'.
`insufficient_scope`	403	This key lacks a required permission.
`ip_not_allowed`	403	This IP address is not allowed for this key.
`endpoint_not_found`	404	No webhook endpoint with this ID exists in this account.
`conflict`	409	The state of the object does not allow this.
`validation_failed`	422	A field is not valid.
`webhook_url_invalid`	422	The URL is not allowed. Only https, port 443 and no internal networks.
`rate_limited`	429	Too many requests. Wait and try again.
`internal_error`	500	Something went wrong on our side.

All errors use one format.