Change an endpoint's URL, event types or description, re-enable it, or rotate its signing secret.

PATCHhttps://api.appgoat.ai/v1/webhooks/{id}

FreeoperationId updateWebhook

Request

curl -X PATCH "https://api.appgoat.ai/v1/webhooks/123" \
  -H "x-api-key: $APPGOAT_API_KEY" \
  -H "content-type: application/json" \
  -d '{"url":"string","event_types":["new_version"],"description":"string","active":false,"github_token":"string","rotate_secret":false}'

const res = await fetch("https://api.appgoat.ai/v1/webhooks/123", {
  method: 'PATCH',
  headers: {
    "x-api-key": process.env.APPGOAT_API_KEY,
    "content-type": "application/json",
  },
  body: JSON.stringify({"url":"string","event_types":["new_version"],"description":"string","active":false,"github_token":"string","rotate_secret":false}),
});
const { data, meta } = await res.json();

import os, requests

res = requests.patch(
    "https://api.appgoat.ai/v1/webhooks/123",
    headers={"x-api-key": os.environ["APPGOAT_API_KEY"]},
    json={"url":"string","event_types":["new_version"],"description":"string","active":False,"github_token":"string","rotate_secret":False}
)
body = res.json()

Path parameters

idintegerrequired

Request body

JSON, required.

urlstring

event_typesEventType[] | null

descriptionstring | null

activeboolean

github_tokenstring

rotate_secretboolean

true = new secret, returned in this response only.

Response

200 with data: WebhookEndpoint. See the envelope for meta.

idinteger

kind"webhook" | "slack" | "github"

urlstring

github: owner/repo; slack: shortened (the URL is a credential).

descriptionstring | null

event_typesEventType[] | null

activeboolean

disabled_reasonstring | null

failure_countinteger

Consecutive failed attempts.

last_success_atstring | null

last_failure_atstring | null

secretstring

kind webhook: the signing secret, only in the create / rotate response.

secret_hintstring

created_atstring

updated_atstring

Example

{
  "data": {
    "id": 1,
    "kind": "webhook",
    "url": "string",
    "description": "string",
    "event_types": [
      "new_version"
    ],
    "active": false,
    "disabled_reason": "string",
    "failure_count": 1,
    "last_success_at": "2026-10-22T10:00:00Z",
    "last_failure_at": "2026-10-22T10:00:00Z",
    "secret": "string",
    "secret_hint": "string",
    "created_at": "2026-10-22T10:00:00Z",
    "updated_at": "2026-10-22T10:00:00Z"
  },
  "meta": {
    "credits_used": 0,
    "credits_remaining": 9981,
    "request_id": "req_123"
  }
}

Status codes

200

The updated endpoint.

400invalid_param

A parameter is missing or invalid (error.param names it).

401invalid_api_key

Missing or invalid API key.

402insufficient_creditsplan_limit

insufficient_credits (the call costs more than you have left; nothing was done) or plan_limit (a feature of a higher plan).

404not_found

Not found.

429rate_limited

Too many requests per second for your plan.