Management

Update a webhook endpoint

Experimental. This endpoint is still settling — its request and response shape may change without a deprecation cycle.

Changes the URL, the subscribed event types, the label or active. Only the fields sent change; the signing secret stays as issued.

patch/management/webhooks/{webhookEndpointReference}

Authorization

Authorization: Bearer {token} — an OAuth2 access token from the client-credentials flow. How authentication works

Path parameters

webhookEndpointReferencestringrequired

Webhook endpoint reference, as returned by GET /management/webhooks.

Request body

application/json · required

urlstring · uri

eventTypesarray of string

Replaces the subscription list. Values from GET /catalog/webhook-event-types.

descriptionstring

activeboolean

False keeps the endpoint but stops deliveries to it.

Responses

200The updated endpointapplication/json

Show response body

dataobjectrequired

Show properties

webhookEndpointReferencestringrequired

Identifies the endpoint in GET /management/webhooks/{webhookEndpointReference}/deliveries.

urlstring · urirequired

Destination Firsty posts events to.

eventTypesarray of stringrequired

Event types delivered to this endpoint. Values this client subscribed to before an event type was retired are returned as stored, so an entry may be absent from GET /catalog/webhook-event-types.

descriptionstring | nullrequired

Free-text label for the endpoint.

activebooleanrequired

Whether events are delivered to this endpoint.

createdAtstring · date-timerequired

updatedAtstring · date-timerequired

400Bad request - invalid parameters 401Unauthorized - missing or invalid API key 404Resource not found 429Rate limit exceeded 500Internal server error

Request

curl 'https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "url": "https://example.com",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "active": true
}'

fetch('https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}', {
  method: 'PATCH',
  headers: {
    Authorization: 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    url: 'https://example.com',
    eventTypes: ['string'],
    description: 'string',
    active: true
  })
})

requests.patch(
    "https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}",
    headers={
      "Authorization": "Bearer YOUR_ACCESS_TOKEN",
      "Content-Type": "application/json"
    },
    json={
      "url": "https://example.com",
      "eventTypes": [
        "string"
      ],
      "description": "string",
      "active": True
    }
)

$client = new GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}', [
  'headers' => [
    'Authorization' => 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type' => 'application/json'
  ],
  'json' => [
    'url' => 'https://example.com',
    'eventTypes' => [
      'string'
    ],
    'description' => 'string',
    'active' => true
  ]
]);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	requestUrl := "https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}"

	payload := strings.NewReader(`{
  "url": "https://example.com",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "active": true
}`)

	req, _ := http.NewRequest("PATCH", requestUrl, payload)

	req.Header.Add("Authorization", "Bearer YOUR_ACCESS_TOKEN")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}"))
    .header("Authorization", "Bearer YOUR_ACCESS_TOKEN")
    .header("Content-Type", "application/json")
    .method("PATCH", HttpRequest.BodyPublishers.ofString("{\n  \"url\": \"https://example.com\",\n  \"eventTypes\": [\n    \"string\"\n  ],\n  \"description\": \"string\",\n  \"active\": true\n}"))
    .build();
HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

curl 'https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "url": "https://example.com",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "active": true
}'

fetch('https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}', {
  method: 'PATCH',
  headers: {
    Authorization: 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    url: 'https://example.com',
    eventTypes: ['string'],
    description: 'string',
    active: true
  })
})

requests.patch(
    "https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}",
    headers={
      "Authorization": "Bearer YOUR_ACCESS_TOKEN",
      "Content-Type": "application/json"
    },
    json={
      "url": "https://example.com",
      "eventTypes": [
        "string"
      ],
      "description": "string",
      "active": True
    }
)

$client = new GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}', [
  'headers' => [
    'Authorization' => 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type' => 'application/json'
  ],
  'json' => [
    'url' => 'https://example.com',
    'eventTypes' => [
      'string'
    ],
    'description' => 'string',
    'active' => true
  ]
]);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	requestUrl := "https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}"

	payload := strings.NewReader(`{
  "url": "https://example.com",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "active": true
}`)

	req, _ := http.NewRequest("PATCH", requestUrl, payload)

	req.Header.Add("Authorization", "Bearer YOUR_ACCESS_TOKEN")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}"))
    .header("Authorization", "Bearer YOUR_ACCESS_TOKEN")
    .header("Content-Type", "application/json")
    .method("PATCH", HttpRequest.BodyPublishers.ofString("{\n  \"url\": \"https://example.com\",\n  \"eventTypes\": [\n    \"string\"\n  ],\n  \"description\": \"string\",\n  \"active\": true\n}"))
    .build();
HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

Response

{
  "data": {
    "webhookEndpointReference": "K7Q2M9XA",
    "url": "https://partner.example.com/firsty/webhooks",
    "eventTypes": [
      "package.created",
      "package.usage.threshold"
    ],
    "description": "Production",
    "active": true,
    "createdAt": "2026-01-15T09:30:00Z",
    "updatedAt": "2026-01-15T09:30:00Z"
  }
}

{
  "type": "https://developers.firsty.app/errors/validation-failed",
  "title": "Validation failed",
  "status": 400,
  "detail": "Request contains invalid fields",
  "errors": [
    {
      "field": "planReference",
      "detail": "Must be a valid 14-character plan reference"
    }
  ]
}