Update an endpoint

Partial update: omitted fields stay as they are. Two field-specific rules: forwardUrl omitted/null = unchanged, empty string = cleared; responseHeaders as an empty object {} = cleared.

Authorization

apiKey

AuthorizationBearer <token>

API key in the Authorization header: Authorization: Bearer wv_live_…. Keys are created on the API keys page in the app, shown once, and scoped to your workspace. X-Api-Key: wv_live_… is accepted as a fallback for tools that can't set Authorization.

In: header

Path Parameters

endpointId*string

The endpoint id (also the capture token in its URL).

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

name?|

Lengthlength <= 200

responseStatusCode?|

3xx statuses are refused: a capture response never redirects.

Range100 <= value <= 599

responseContentType?|

One media type from the capture response allowlist (JSON and +json types, problem+json, text/plain, text/csv, application/xml, text/xml, application/soap+xml, form-encoded, octet-stream). HTML, images and scripts are refused. Response headers may not set Content-Type, cookies, redirects, security policies or transport headers.

responseHeaders?|null

responseBody?string|null

isActive?|

false turns the endpoint off: senders get 410.

forwardingEnabled?|Deprecated

Deprecated: switch an action on or off instead (PUT /api/v1/endpoints/{id}/actions/{actionId} with isActive). Still honoured: it switches the endpoint's first forward action, never a notify or a subrequest. When the endpoint has no forward action and no forwardUrl is sent, true is refused (400) because there is no forward to switch on, and false is accepted and changes nothing, because nothing forwards already.

forwardUrl?|Deprecated

Deprecated: edit the forward action instead (PUT /api/v1/endpoints/{id}/actions/{actionId}). Still honoured: it changes the endpoint's first forward action (adding one when there is none), an empty string removes that forward action, and omitted leaves it unchanged. A notify or a subrequest is never changed or removed through this field.

provider?|

Provider slug; empty string clears it, omitted leaves it unchanged.

signingSecret?|

Write-only. Omitted = unchanged, empty string = cleared (stored verdicts are removed), value = replaced (history re-verified in the background).

forwardSigningSecret?stringDeprecated

Deprecated: set signingSecret on the forward action instead (PUT /api/v1/endpoints/{id}/actions/{actionId}). Still honoured, and applied to the endpoint's first forward action; refused when the endpoint has no forward action and no forwardUrl is sent. Sent on its own, it does not re-check the forward's URL, so a rotation never depends on the receiver's DNS. Secret used to SIGN forwards to forwardUrl, so the receiver can verify the delivery came from WebhookVault. Write-only: stored protected and never returned. At least 16 characters. Same convention as forwardUrl on an update: omitted leaves it unchanged, an empty string stops signing. Not to be confused with signingSecret, which VERIFIES what arrives.

handshakeToken?|

Omitted = unchanged, empty string = cleared.

signatureHeader?|

Manual scheme header; empty string removes the manual scheme.

signatureAlgorithm?|

Manual scheme digest. The rsa- and ed25519 entries change what signingSecret holds: a PUBLIC key the provider publishes rather than a shared secret.

Value in"sha1" | "sha256" | "sha512" | "rsa-sha256" | "rsa-sha512" | "ed25519" | null

signatureEncoding?|

Value in"hex" | "base64" | null

signaturePrefix?string|null

Response Body

`application/json`

`application/problem+json`

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "name": "string",
  "url": "string",
  "isActive": true,
  "suspendedByPlan": true,
  "createdAt": "2019-08-24T14:15:22Z",
  "lastRequestAt": "2019-08-24T14:15:22Z",
  "expiresAt": "2019-08-24T14:15:22Z",
  "storedRequestCount": 0,
  "responseStatusCode": 0,
  "responseContentType": "string",
  "responseHeaders": {
    "property1": "string",
    "property2": "string"
  },
  "responseBody": "string",
  "provider": "string",
  "forwardingEnabled": true,
  "forwardUrl": "string",
  "forwardSigning": {
    "signed": true,
    "setAt": "2019-08-24T14:15:22Z"
  },
  "verification": {
    "source": "preset",
    "scheme": "string",
    "family": "string",
    "secretLabel": "string",
    "secretSet": true,
    "secretSetAt": "2019-08-24T14:15:22Z",
    "handshakeTokenSet": true,
    "handshakeTokenNeeded": true,
    "manual": {
      "header": "string",
      "algorithm": "sha1",
      "encoding": "hex",
      "prefix": "string"
    }
  }
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

Authorization

Path Parameters

Request Body

Response Body

200application/json

400application/problem+json

401application/problem+json

403application/problem+json

404application/problem+json

409application/problem+json

429application/problem+json

On this page

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`