> ## Documentation Index > Fetch the complete documentation index at: https://docs.kordless.ai/llms.txt > Use this file to discover all available pages before exploring further. # Update a webhook endpoint > Partial update; omitted fields keep their stored values. Disabling an endpoint pauses new fan-out and claims; re-enabling resumes both. Requires the `webhooks:manage` permission. ## OpenAPI ````yaml /api-reference/openapi.yaml patch /v1/webhook-endpoints/{endpointId} openapi: 3.1.0 info: title: Kordless API version: 1.0.0 description: | The Kordless API creates deterministic quotes against published Book Versions and returns immutable Quote Receipts. The same pipeline serves headless API-key traffic, Business-member sessions, and anonymous end-customer surfaces. ## Authentication Headless routes require a secret API key as a bearer token: ``` Authorization: Bearer sk_test_... ``` Test keys use the `sk_test_` prefix; Live keys use `sk_live_`. The key binds a Workspace, Project, and one Environment — a Test key can never address Live data. Member routes under `/v1/businesses/{businessId}` authenticate the caller's session and Business membership. The `/v1/public_quotes` routes are anonymous by design. ## Idempotency Quote creation accepts an optional `idempotencyKey` in the request body. Retrying with the same key and the same payload replays the original Quote; the same key with a different payload returns `409 idempotency_conflict`. When omitted, the server generates an `auto_` key. ## Envelopes and request IDs Success responses are `{ "data": …, "requestId": … }`; failures are `{ "error": { "code", "message", "requestId", "details?" } }`. Every response also carries an `x-request-id` header, echoed on created Quotes as `requestCorrelationId`. servers: - url: https://your-kordless-instance.com description: Replace with your Kordless instance base URL security: - BearerAuth: [] tags: - name: Quotes description: Headless quote creation and retrieval with an API key. - name: Public quotes description: Anonymous end-customer quotes against the Live-published Book. - name: Business portal description: Member-session routes used by the hosted Business Portal. - name: API keys description: >- Workspace-session routes for the API-key lifecycle (create, rotate, revoke). - name: Webhooks description: >- Workspace-session routes for webhook endpoints, deliveries, test events, and replay. - name: Request logs description: Workspace-session log search and Quote Intent traces. - name: Status description: Anonymous liveness signal. paths: /v1/webhook-endpoints/{endpointId}: patch: tags: - Webhooks summary: Update a webhook endpoint description: | Partial update; omitted fields keep their stored values. Disabling an endpoint pauses new fan-out and claims; re-enabling resumes both. Requires the `webhooks:manage` permission. operationId: updateWebhookEndpoint parameters: - name: endpointId in: path required: true schema: type: string format: uuid description: The webhook endpoint ID. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateWebhookEndpointRequest' responses: '200': description: The updated endpoint. content: application/json: schema: $ref: '#/components/schemas/WebhookEndpointResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/WebhookEndpointNotFound' '422': $ref: '#/components/responses/InvalidRequest' security: [] components: schemas: UpdateWebhookEndpointRequest: type: object additionalProperties: false description: At least one field is required; omitted fields keep their stored values. properties: url: type: string maxLength: 500 description: type: string maxLength: 200 eventTypes: type: array maxItems: 32 items: type: string enum: - business.created - business.onboarding_completed - business_membership.created - book_version.published - book_publication.rolled_back - quote_intent.requires_input - quote_intent.succeeded - quote_intent.failed status: type: string enum: - active - disabled WebhookEndpointResponse: type: object required: - data - requestId properties: data: $ref: '#/components/schemas/WebhookEndpoint' requestId: type: string WebhookEndpoint: type: object description: >- Endpoint metadata. Signing secrets are never retrievable after creation/rotation. properties: id: type: string format: uuid workspaceId: type: string format: uuid projectId: type: string format: uuid environmentId: type: string format: uuid url: type: string description: HTTPS only, without credentials or fragments. description: type: string eventTypes: type: array items: type: string description: Subscribed event types; an empty array subscribes to all. secretPrefix: type: string lastFour: type: string status: type: string enum: - active - disabled createdByClerkUserId: type: string disabledAt: type: string format: date-time nullable: true createdAt: type: string format: date-time updatedAt: type: string format: date-time ErrorEnvelope: type: object required: - error properties: error: type: object required: - code - message - requestId properties: code: type: string message: type: string requestId: type: string details: type: object description: >- Optional structured context, for example `fields` on validation failures. responses: Unauthorized: description: No authenticated Workspace session. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' example: error: code: unauthorized message: Authentication is required. requestId: req_9f8e7d6c Forbidden: description: The Workspace role lacks the required permission. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' example: error: code: forbidden message: Your Workspace role cannot perform this action. requestId: req_9f8e7d6c WebhookEndpointNotFound: description: The webhook endpoint does not exist in the active Workspace. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' example: error: code: webhook_endpoint_not_found message: The webhook endpoint does not exist in the active Workspace. requestId: req_9f8e7d6c InvalidRequest: description: >- The request body or query failed validation; `details.fields` lists the offending fields. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' example: error: code: invalid_request message: The request failed validation. requestId: req_9f8e7d6c details: fields: url: - Expected an HTTPS URL without credentials or fragments securitySchemes: BearerAuth: type: http scheme: bearer description: >- Secret API key (`sk_test_…` or `sk_live_…`). The key binds a Workspace, Project, and Environment. ````