Skip to navigation
API ReferenceWebhooksWebhook endpoints

Update a webhook endpoint

Authentication

AuthorizationBearer

A secret key (rl_sk_test_..., rl_sk_live_...) or a restricted key with limited scopes (rl_rk_test_..., rl_rk_live_...). A restricted key can carry agent: true and an expires_at, and is what a coding agent should hold. Keys end in a checksum so secret scanners can recognize them. People create, roll and revoke keys in the dashboard; GET /v1/api_keys lists them, masked.

Path parameters

webhook_endpoint_idstringRequired

The webhook endpoint ID (we_...).

Request

This endpoint expects an object.
urlstringOptionalformat: "uri"
descriptionstring or nullOptional
enabled_eventslist of stringsOptional
statusenumOptional
Allowed values:
metadatamap from strings to stringsOptional
Up to 50 keys of your own, with keys up to 40 characters and values up to 500 characters.

Response

The updated webhook endpoint.
idstring
object"webhook_endpoint"
urlstringformat: "uri"
enabled_eventslist of strings
statusenum

An endpoint that fails every delivery for 5 days is disabled automatically. Events it missed are not replayed when you enable it again; redeliver them one by one with POST /v1/webhook_events/{webhook_event_id}/redeliver.

Allowed values:
api_versionstring
metadatamap from strings to strings
Up to 50 keys of your own, with keys up to 40 characters and values up to 500 characters.
livemodeboolean
created_atdatetime
descriptionstringOptional
secretstringOptional

The signing secret (whsec_...). Only in create and rotate responses.

last_success_atdatetimeOptional
When the endpoint last acknowledged a delivery.
last_failure_atdatetimeOptional
When a delivery to the endpoint last failed.
failing_sincedatetimeOptional
When the current run of failures began. Left out while deliveries succeed.
disables_atdatetimeOptional

When Runledger will disable the endpoint if it keeps failing, 5 days after failing_since.

actorobjectOptional

Who made a change. Runledger fills it in from the credential, so a client can’t claim to be someone else: an API key always acts as itself, the dashboard calls the API as the signed-in person, and the MCP server passes the client’s name and the person it acts for. A request that sends a Runledger-Actor header is refused with 400 parameter_unknown.

Errors

400
Bad Request Error
401
Unauthorized Error
403
Forbidden Error
404
Not Found Error
429
Too Many Requests Error
500
Internal Server Error