Skip to main content
PATCH
Update a webhook
Leaving out secret_hash erases the stored secret. It is not treated as “leave it alone”. After that, deliveries arrive with "secret_hash": null and your receiver can no longer tell a real delivery from a forged one. Always send endpoint_url and secret_hash together, even when you only mean to change one.

Rules

  • endpoint_url is required on every call, and must be a valid URL starting with lowercase https://.
  • Send secret_hash every time. To rotate a secret, send the new one here and then switch your receiver over.
  • The event cannot be changed. To listen for a different event, register a second webhook.
  • Keep the trailing slash on the path. Without it the API redirects, and most HTTP clients drop the request body when they follow a redirect.
  • The body is checked before the webhook is looked up, so an invalid body returns 400 even for an ID that does not exist.
  • The call returns 404 with Webhook not found when no webhook exists with this ID.
Changing the address does not change how deliveries are retried. Most events are sent once. Only exam_evaluation_student_answer_sheet_evaluation is retried, once after 5 seconds, when your endpoint does not answer 200 or 201, so that is the one event whose delivery can arrive twice.
There is no endpoint to delete a webhook. To stop deliveries, point endpoint_url at an address you control and ignore them, or contact CrazyGoldFish to have the webhook disabled.

Next step

Handle deliveries

Compare secret_hash and answer within 5 seconds.

Authorizations

Authorization
string
header
required

Access token from Get an access token.

Path Parameters

id
string<uuid>
required

Unique ID of the webhook, from Register a webhook or List your webhooks.

Body

application/json
endpoint_url
string<uri>
required

New address for this webhook. Required on every call, even when you only want to change the secret.

Example:

"https://example.com/hooks/v2/crazygoldfish"

secret_hash
string

The secret to store. Leaving it out erases the stored secret instead of keeping it, so send it every time.

Example:

"a-long-random-string-you-generate"

Response

The updated webhook.

A registered webhook. The secret is never returned by these endpoints.

id
string<uuid>

Unique ID of the webhook. Use it in Get a webhook and Update a webhook.

Example:

"c5a71f30-6b82-4d19-9e4a-8f0d3b6c2157"

api_template
object

The event this webhook listens for, expanded. It cannot be changed after registration.

endpoint_url
string<uri>

The HTTPS address CrazyGoldFish posts the event to.

Example:

"https://example.com/webhooks/crazygoldfish"