Update webhook subscription
Partial update — only provided fields are modified.
COMMON OPERATIONS: - Re-enable a DISABLED subscription: set status to ACTIVE (resets consecutive_failures) - Pause delivery: set status to PAUSED - Rotate signing secret: provide new signing_secret value - Change event types: provide new event_types array (replaces, does not merge)
TENANT-OWNED CATEGORY BOUNDARY (NORMATIVE): the admin-write-path half of the cross-plane WEBHOOK SUBSCRIPTION INVARIANT 2 (info.description; part of the conformance surface). The owning tenant is resolved from the target subscription's stored tenant_id. When that owning tenant is a CONCRETE tenant (tenant_id != "system"), any provided event_types / event_categories MUST satisfy the same tenant-accessible boundary the tenant self-service path enforces (budget / reservation / tenant only); an admin-only event type or category (api_key, policy, webhook, system) MUST be rejected with 400 INVALID_REQUEST. See createTenantWebhook (TENANT-ACCESSIBLE BOUNDARY) for the exact sets and createWebhookSubscription (TENANT-OWNED CATEGORY BOUNDARY) for the rationale — a tenant owns the delivery URL + signing secret of any row under its tenant_id, so admin-only categories there leak admin telemetry to a tenant-controlled endpoint. This holds regardless of auth context (admin key or admin-on-behalf-of). Subscriptions whose owning tenant is "system" are not tenant-owned and admin-only categories remain permitted.
EVENTS (document revision 0.1.25.33): - On every successful PATCH the server MUST emit exactly one
Event, typed by the nature of the change:
* Status unchanged, any other field(s) mutated →
webhook.updated. changed_fields lists the mutated
field names.
* Status ACTIVE → PAUSED → webhook.paused.
* Status PAUSED → ACTIVE → webhook.resumed.
* Status DISABLED → ACTIVE (operator re-enable) →
webhook.resumed.
When a single PATCH both changes status AND mutates other
fields, the server emits the status-typed event
(webhook.paused / webhook.resumed) and changed_fields
lists the non-status mutations for operator visibility.
A no-op PATCH (zero fields mutated) MUST NOT emit an Event.
- Payload conforms to EventDataWebhookLifecycle.
correlation_id =webhook_update:<subscription_id>:<request_id>. - Auto-disable after failure threshold produces
webhook.disabledvia the dispatcher, not via this PATCH
path. See WebhookSubscription.FAILURE HANDLING.
Authorizations
Administrative API key with full system access. Also accepted as an alternative to ApiKeyAuth on an explicit per-operation allowlist — the authoritative list is the union of operations whose security: block declares AdminKeyAuth (consult per-operation security blocks rather than this prose, which has historically drifted as the dual-auth surface expanded). When using AdminKeyAuth on list or fund endpoints, a tenant scoping parameter (typically tenant or tenant_id) is required for scoping (400 if missing) — the per-operation description specifies which. Lookup-style endpoints that uniquely identify a resource by non-tenant key (e.g. GET /v1/admin/budgets/lookup, where the (scope, unit) pair is unique) do NOT require a tenant parameter. Allowlisting is per-operation (exact method:path matching — no prefix matching, no wildcards) so new endpoints do not accidentally inherit admin-accessible status.
Parameters
Path Parameters
Request Body
Responses
Subscription updated