Fac-360
Webhooks

Change a subscription's destination, events or status

Partial update. status=PAUSED stops the fan-out without deleting the subscription or its secret; paused subscriptions receive no new deliveries and are not selected when an event is published. A new url is revalidated by the same anti-SSRF gate as creation.

PATCH
/api/v2/webhooks/subscriptions/{id}

Partial update. status=PAUSED stops the fan-out without deleting the subscription or its secret; paused subscriptions receive no new deliveries and are not selected when an event is published. A new url is revalidated by the same anti-SSRF gate as creation.

Authorization

bearerAuth
AuthorizationBearer <token>

Tenant-bound, scoped and expiring Apifact credential. Migrated legacy credentials are accepted only on deprecated v1 writes and tenant-scoped v2 read, poll and download routes. Each operation names the single scope it requires in x-required-scope; the scope array of the security requirement itself is empty because OpenAPI 3.0 requires it to be for a non-oauth2 scheme.

In: header

Path Parameters

id*string
Formatuuid

Header Parameters

Idempotency-Key*string
Match^[!-~]+$
Length1 <= length <= 200

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Properties1 <= properties

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PATCH "https://example.com/api/v2/webhooks/subscriptions/497f6eca-6276-4993-bfeb-53cbbbba6f08" \  -H "Idempotency-Key: b6a2f0e4-1c3d-4a5b-8e7f-9d0c1b2a3e4f" \  -H "Authorization: Bearer apf_v2_tu_credencial" \  -H "Content-Type: application/json" \  -d '{    "status": "PAUSED"  }'
{  "subscriptionId": "d079718b-ff63-45dd-947b-4950c023750f",  "url": "http://example.com",  "events": [    "document.accepted"  ],  "status": "ACTIVE",  "description": "string",  "secretVersion": 1,  "createdAt": "2019-08-24T14:15:22Z",  "updatedAt": "2019-08-24T14:15:22Z",  "schemaVersion": "2.0",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "resourceId": "026d60bb-63a8-407e-bf67-01dcfc6022e6",  "replay": true}

Register a signed webhook destination for this tenant POST POST

Registers an HTTPS destination and the versioned events it should receive, and mints the HMAC signing secret. The secret is returned EXACTLY ONCE, in this response: the API's database role holds no read privilege on the column that stores it, so it cannot be retrieved later by any route. A replay of the same Idempotency-Key answers 200 with replay=true and no secret. Destinations are admitted by an anti-SSRF gate: https only, default port only, no credentials in the URL, no fragment, and the host must be a public DNS name whose last label is alphabetic, which refuses every IP literal in every base as well as localhost, .internal, .local and cloud metadata names.

Delete a subscription and everything still aimed at it DELETE DELETE

Deletes the subscription, its secret versions and its pending and dead-lettered deliveries. Stored events survive, because an event may still be owed to another subscription.