ManagementExperimental

Update a webhook endpoint

Changes the URL, the subscribed event types, the label or active. Only the fields sent change; the signing secret stays as issued.

patch/management/webhooks/{webhookEndpointReference}

Authorization

Authorization: Bearer {token} — an OAuth2 access token from the client-credentials flow. How authentication works

Path parameters

webhookEndpointReferencestringrequired

Webhook endpoint reference, as returned by GET /management/webhooks.

Request body

application/json · required

urlstring · uri

eventTypesarray of string

Replaces the subscription list. Values from GET /catalog/webhook-event-types.

descriptionstring

activeboolean

False keeps the endpoint but stops deliveries to it.

Responses

200The updated endpointapplication/json

Show response body

dataobject

Show properties

webhookEndpointReferencestring

Identifies the endpoint in GET /management/webhooks/{webhookEndpointReference}/deliveries.

urlstring · uri

Destination Firsty posts events to.

eventTypesarray of string

Event types delivered to this endpoint. Values this client subscribed to before an event type was retired are returned as stored, so an entry may be absent from GET /catalog/webhook-event-types.

descriptionstring | null

Free-text label for the endpoint.

activeboolean

Whether events are delivered to this endpoint.

createdAtstring · date-time

updatedAtstring · date-time

400Bad request - invalid parameters 401Unauthorized - missing or invalid API key 404Resource not found 429Rate limit exceeded. A `429` can also arrive without these headers or this body; handle it by its status code.500Internal server error

Request

curl 'https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "url": "https://example.com",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "active": true
}'

fetch('https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}', {
  method: 'PATCH',
  headers: {
    Authorization: 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    url: 'https://example.com',
    eventTypes: ['string'],
    description: 'string',
    active: true
  })
})

requests.patch(
    "https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}",
    headers={
      "Authorization": "Bearer YOUR_ACCESS_TOKEN",
      "Content-Type": "application/json"
    },
    json={
      "url": "https://example.com",
      "eventTypes": [
        "string"
      ],
      "description": "string",
      "active": True
    }
)

$client = new GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}', [
  'headers' => [
    'Authorization' => 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type' => 'application/json'
  ],
  'json' => [
    'url' => 'https://example.com',
    'eventTypes' => [
      'string'
    ],
    'description' => 'string',
    'active' => true
  ]
]);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	requestUrl := "https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}"

	payload := strings.NewReader(`{
  "url": "https://example.com",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "active": true
}`)

	req, _ := http.NewRequest("PATCH", requestUrl, payload)

	req.Header.Add("Authorization", "Bearer YOUR_ACCESS_TOKEN")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://connect.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}"))
    .header("Authorization", "Bearer YOUR_ACCESS_TOKEN")
    .header("Content-Type", "application/json")
    .method("PATCH", HttpRequest.BodyPublishers.ofString("{\n  \"url\": \"https://example.com\",\n  \"eventTypes\": [\n    \"string\"\n  ],\n  \"description\": \"string\",\n  \"active\": true\n}"))
    .build();
HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

curl 'https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "url": "https://example.com",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "active": true
}'

fetch('https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}', {
  method: 'PATCH',
  headers: {
    Authorization: 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    url: 'https://example.com',
    eventTypes: ['string'],
    description: 'string',
    active: true
  })
})

requests.patch(
    "https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}",
    headers={
      "Authorization": "Bearer YOUR_ACCESS_TOKEN",
      "Content-Type": "application/json"
    },
    json={
      "url": "https://example.com",
      "eventTypes": [
        "string"
      ],
      "description": "string",
      "active": True
    }
)

$client = new GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}', [
  'headers' => [
    'Authorization' => 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type' => 'application/json'
  ],
  'json' => [
    'url' => 'https://example.com',
    'eventTypes' => [
      'string'
    ],
    'description' => 'string',
    'active' => true
  ]
]);

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	requestUrl := "https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}"

	payload := strings.NewReader(`{
  "url": "https://example.com",
  "eventTypes": [
    "string"
  ],
  "description": "string",
  "active": true
}`)

	req, _ := http.NewRequest("PATCH", requestUrl, payload)

	req.Header.Add("Authorization", "Bearer YOUR_ACCESS_TOKEN")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://connect.test.firsty.app/api/v3/management/webhooks/{webhookEndpointReference}"))
    .header("Authorization", "Bearer YOUR_ACCESS_TOKEN")
    .header("Content-Type", "application/json")
    .method("PATCH", HttpRequest.BodyPublishers.ofString("{\n  \"url\": \"https://example.com\",\n  \"eventTypes\": [\n    \"string\"\n  ],\n  \"description\": \"string\",\n  \"active\": true\n}"))
    .build();
HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

Response

{
  "data": {
    "webhookEndpointReference": "K7Q2M9XA",
    "url": "https://partner.example.com/firsty/webhooks",
    "eventTypes": [
      "package.created",
      "package.usage.threshold"
    ],
    "description": "Production",
    "active": true,
    "createdAt": "2026-01-15T09:30:00Z",
    "updatedAt": "2026-01-15T09:30:00Z"
  }
}

{
  "type": "https://developers.firsty.app/errors/validation_failed",
  "code": "validation_failed",
  "title": "Validation failed",
  "status": 400,
  "detail": "Request contains invalid fields",
  "errors": [
    {
      "field": "planReference",
      "detail": "Must be a valid 14-character plan reference"
    }
  ]
}