Partial update of a webhook, identified by [webhookId], following JSON Merge Patch (RFC 7396) semantics.

Fields omitted from the request body keep their stored value.

null on signature or authentication explicitly clears the stored value (the attribute is dropped from the record). [eventType] and [url] may not be null — they're required to have a value once the webhook exists.

Endpoint:

HTTP Method: PATCH

Path: /v2/webhooks/{webhookId}

Server URL: https://api.propelus.com

Developer Docs: https://propelus.com/developer/webhooks/PatchWebhookById

Authentication

Two header-based authentication methods are required:

Header	Type	In	Description
x-api-key	token	header	API key credential
x-client-id	token	header	Client identifier credential

Path Parameters

Parameter	Type	Required	Description
webhookId	string (UUID)	Yes	Unique identifier for the webhook.

Request Body

Content type: application/json

Partial webhook update body. Follows JSON Merge Patch (RFC 7396) semantics: every field is optional, and omitted fields keep their stored value. null on signature or authentication explicitly clears the stored value. Changing url or authentication re-runs the activation handshake and returns updated_not_verified.

Field	Type	Required	Description / Constraints
eventType	string	No	Type of event that triggers the webhook.
url	string	No	URL endpoint where webhook notifications will be sent. Format: uri. Length ≤ 2048.
signature	object \| null	No	Signature configuration for webhook verification.
authentication	object \| null	No	Authentication configuration for webhook endpoint.

eventType allowed values:

"credentialVerified" | "credentialsBatchCompleted" | "credentialMonitored" |

"monitoredCredentialChanged" | "automationStatusChanged" | "entityMonitored" |

"monitoredEntityChanged"

Example Request — JSON

const body = JSON.stringify({
  "signature": {
    "key": "a3f8c92e5d1b4f7a9e6c2d8b3f5a1c4e"
  }
})
 
fetch("https://api.propelus.com/v2/webhooks/628fc8e2-ee7e-4779-9eb7-d980e7a92f3a", {
  method: "PATCH",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": "<your-api-key>",
    "x-client-id": "<your-client-id>"
  },
  body
})

Example Request — cURL

curl -X PATCH "https://api.propelus.com/v2/webhooks/628fc8e2-ee7e-4779-9eb7-d980e7a92f3a" \
  -H "x-api-key: <your-api-key>" \
  -H "x-client-id: <your-client-id>" \
  -H "Content-Type: application/json" \
  -d '{
    "signature": {
      "key": "a3f8c92e5d1b4f7a9e6c2d8b3f5a1c4e"
    }
  }'

Responses

200 — Success

When reactivation is required the code is updated_not_verified (shown below); when no reactivation is required the code is updated.

{
  "status": 200,
  "code": "updated_not_verified",
  "detail": "string",
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"
}

Error Responses

Standardized error bodies. Validation-style errors (400, 401, 403, 404, 4XX) include an errors array; each item contains detail, pointer, parameter, header, and code: https://propelus.com/developer/webhooks/PatchWebhookById#response-body

400 — Bad Request

401 — Unauthorized

403 — Forbidden

404 — Not Found

4XX — Client Error

429 — Rate Limited

5XX — Server Error

Reactivation is triggered when any of the following holds:

the request changes url,
the request changes authentication (including clearing it via null), or
the stored record's status is failed (in which case PATCH re-runs the activation handshake even when nothing about the configuration changes — this is the recovery path from a POST that returned created_failed, or from a previous PATCH whose handshake failed).

When reactivation is triggered, the activation POST is re-run against the target URL. On a 2xx response the webhook moves back to pending and the response carries code: updated_not_verified; on a non-2xx response the request returns 400 and the stored record is left untouched (the prior active / pending / failed state is preserved). When no reactivation is required, the response carries code: updated and the stored status is unchanged.