Skip to content
LeadPattern
Reference/Webhooks/Edit Webhook

Edit Webhook

PUThttps://public.leadpattern.com/v2/webhook/:webhookId
Plan: webhooksapplication/json60 req/min

Update the name, URL, event subscriptions, custom headers, authorization or signing secret of a registered webhook. Send at least one field. Omit headers / authorization to keep the stored values (send headers: null to remove all headers, authorization: null or { type: "NONE" } to remove authorization) — except when the URL changes: saved headers and credentials are never sent to a new URL, so re-send them in full or they are dropped. Send secret to set your own signing secret, or removeSecret: true to stop signing deliveries; omit both to keep the current secret. Use Rotate Signing Secret to get a new generated secret.

  • Changing url, headers, authorization, secret or removeSecret on an active webhook re-runs the endpoint check: a signed test event must get a 2xx response or the edit is rejected (422) and nothing changes. Name / event-only edits skip it.
  • Send at least one field. Omit headers / authorization to keep the stored values; headers: null removes all custom headers; authorization: null or { type: "NONE" } removes the Authorization header.
  • Changing the URL (to any other URL) never carries saved credentials over: headers and authorization that are not re-sent in the same request are dropped, and sending the masked "••••••" values returns 400.
  • https:// is recommended. http:// URLs are accepted, but deliveries — including custom headers and authorization credentials — are sent unencrypted; the response then includes a warnings array and the webhook has insecure: true.
  • secret replaces the signing secret with your own; removeSecret: true makes deliveries unsigned. They can't be combined. Omitting both keeps the current secret — a URL change does not affect it. Either one ends any rotation grace period immediately (no -Previous signatures).

Headers

1 field
Authorizationstring
required
Your API key. Sent raw (e.g. 'lp_...'). No Bearer prefix required.

Path Parameters

1 field
webhookIdstring
required
Webhook ID.

Body Parameters

11 fields
namestring
optional
Updated webhook name.
urlstring
optional
Updated endpoint URL — https:// recommended, http:// accepted with a warning; private / internal addresses return 400 (409 if another webhook already uses it). On any URL change the saved headers and authorization are not carried over: re-send them in full, or they are dropped. Sending masked "••••••" values with a new URL returns 400.
webhookEventsarray<enum>
optional
Updated event subscriptions (replaces the list).
secretstring
optional
Set or replace the signing secret with your own (16–128 characters). Omit to keep the current one. Changing the URL does not change the secret.
removeSecretboolean
optional
true → remove the signing secret; deliveries are sent unsigned. Mutually exclusive with secret.
headersobject
optionalnullable
Replaces the stored custom headers; omit to keep them, or send null (or {}) to remove them all. A value of "••••••" keeps that header's saved value — except when the URL changes (see Edit Webhook). Custom HTTP headers sent with every delivery, as a name → value map (max 20), e.g. { "X-Source": "crm" }. Reserved and rejected: Host, Content-Length, Content-Type, User-Agent, Expect, Proxy-Authorization, the hop-by-hop headers Connection / Keep-Alive / Transfer-Encoding / Upgrade, and any X-Webhook-* header.
authorizationobject
optionalnullable
Replaces the stored authorization; omit to keep it. { "type": "NONE" } or null removes it. Sent as the Authorization header on every delivery. Over http:// it travels unencrypted — use https://.
typeenum
required
BEARER → `Authorization: Bearer <payload>`. BASIC → `Authorization: Basic base64(<payload>)`. NONE → no Authorization header (clears a saved one).
Allowed values:
BEARERBASICNONE
payloadstring
optional
Required for BEARER / BASIC. BEARER: the token. BASIC: `username:password`.
methodenum
optional
Compatibility only — deliveries are always POST. Any other value returns 400.
Allowed values:
POST
bodyFormatenum
optional
Compatibility only — deliveries are always JSON. Any other value returns 400.
Allowed values:
JSON
retryOnTimeoutboolean
optional
Compatibility only — true is accepted and ignored (timeouts are always retried). false returns 400.
wabaNumbersarray<string>
optional
Compatibility only — accepted and ignored (a workspace has one WhatsApp number). invalidWabaNumbers in the response is always empty.

Responses

JSON Response
{
  "type": "success",
  "data": {
    "id": "664abc123def456789012345",
    "name": "Updated Webhook",
    "url": "https://example.com/new-hook",
    "events": [
      "message_received",
      "conversation_closed",
      "tag_added"
    ],
    "isActive": true,
    "hasSecret": true,
    "insecure": false,
    "headers": {
      "X-Source": "••••••"
    },
    "authorization": {
      "type": "BEARER",
      "configured": true
    },
    "invalidWebhooks": []
  }
}

Sample Request Body

{
  "name": "Updated Webhook",
  "url": "https://example.com/new-hook",
  "webhookEvents": [
    "message_received",
    "conversation_closed",
    "tag_added"
  ],
  "headers": {
    "X-Source": "leadpattern"
  },
  "authorization": {
    "type": "BEARER",
    "payload": "your-secret-token"
  }
}
← Previous Endpoint
Get Webhook
Next Endpoint →
Toggle Webhook