# PUT /api/webhooks/{id}

> Webhooks - Update a Webhook

Partial update: only the fields present in the request are written, everything else keeps its current value. The same validation as create applies, including the SSRF check on a new URL. The signing secret cannot be set by the caller. Send rotate_secret as true to have the server mint a new one; the replacement is returned in this response and, like the original, in no other response ever. A rotation invalidates the previous secret immediately, so update your receiver first or let it accept both for a short window.

- **Endpoint:** `PUT /api/webhooks/{id}`
- **Group:** Webhooks
- **Since:** v1.0.0
- **Defined in:** `RestApi/Controllers/WebhooksController.php`

## Headers

| Field | Type | Description |
| --- | --- | --- |
| `authtoken` | String | Authentication token, generated from admin area |

## Parameters

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | Number | yes | Webhook unique ID |
| `name` | String | no | Optional Human readable name |
| `url` | String | no | Optional New target URL, validated exactly as sent and re-checked against the SSRF policy |
| `events` | String[] | no | Optional Replacement subscription list, array or comma separated string |
| `headers` | Object | no | Optional Replacement custom headers. Send an empty object or null to clear them |
| `active` | Number | no | Optional 1 to enable, 0 to disable |
| `timeout` | Number | no | Optional Per attempt timeout in seconds, 1 to 30 |
| `retry_count` | Number | no | Optional Extra attempts after a failed one, 0 to 3 |
| `rotate_secret` | Boolean | no | Optional Mint a new signing secret and return it once |

## Request example

```bash
curl -X PUT "https://yoursite.com/index.php/api/webhooks/123" \
  -H "authtoken: YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "field": "value" }'
```

## Responses

### Success - Success-Response:

```json
HTTP/1.1 200 OK
{
  "status": 200,
  "messages": { "success": "Record saved" },
  "data": {
    "id": 3,
    "name": "Ops sync",
    "url": "https://hooks.example.com/rise",
    "events": ["invoices.created", "invoices.updated"],
    "active": 1,
    "timeout": 15,
    "has_secret": true
  }
}
```

### Success - Secret-Rotated:

```json
HTTP/1.1 200 OK
{
  "status": 200,
  "messages": { "success": "Record saved" },
  "secret": "whsec_8b2100000000000000000000000000000000000000000000000000000000edf4",
  "secret_notice": "Store this secret now. It is shown once and cannot be retrieved again.",
  "signature_header": "X-Rise-Signature",
  "data": { "id": 3, "has_secret": true }
}
```

### Error - Not-Found:

```json
HTTP/1.1 404 Not Found
{ "status": false, "messages": { "error": "No data were found" } }
```

### Error - Nothing-To-Update:

```json
HTTP/1.1 400 Bad Request
{ "status": false, "messages": { "error": "No updatable field was provided." } }
```

---

Part of the [REST API for RISE CRM](https://risecrm.themesic.com/apiguide/) documentation.
Full page: https://risecrm.themesic.com/apiguide/webhooks/update-webhook/