> This page is for API. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.spreadspace.app/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.spreadspace.app/_mcp/server. # Update webhook PATCH https://api.spreadspace.app/api/webhooks/{id} Content-Type: application/json Updates a webhook endpoint. Only the fields you send change. Requires the `webhooks:write` scope. Rate limit: 200 requests per minute per key (the `api` lane). Reference: https://docs.spreadspace.app/api/api-reference/webhooks/update ## Authentication - `Authorization` header (bearer token, required) — Bearer token. Use `ss_live_…` for live data or `ss_test_…` for the sandbox (test mode). See [Authentication](https://docs.spreadspace.app/api/authentication). ## Request ### Path parameters - `id` (string, required) — The webhook endpoint's id. ### Headers - `Idempotency-Key` (string, optional) — Idempotency token. Retries that reuse the key within 24h replay the original response. Up to 255 characters; a UUID is typical. See [Idempotency](https://docs.spreadspace.app/api/idempotency). - `SpreadSpace-Version` (string, optional) — Pin the API version, e.g. `2026-10-07`. Omit to get the latest. See [Versioning](https://docs.spreadspace.app/api/versioning). ### Body (application/json) This endpoint expects an UpdateWebhookEndpointRequest. - `description` (string, optional, nullable) - `status` (enum, optional) — Status update. Null = unchanged. Only `"active"` or `"paused"` are accepted; `"revoked"` is reached exclusively via DELETE. - Allowed values: `active`, `paused` - `subscribed_events` (list of enum, optional, nullable) - Allowed values: `document.failed`, `document.processed`, `embed.session.created`, `embed.session.revoked`, `export.cancelled`, `export.failed`, `export.succeeded`, `extraction.mapped`, `extraction.ready`, `extraction.updated`, `job.completed`, `loan.classified`, `memo.finalized`, `memo.reopened`, `memo_render.cancelled`, `memo_render.failed`, `memo_render.succeeded`, `spread.finalized`, `spread.reopened`, `*` ## Response ### 200 OK - `id` (string, required) - `url` (string, required) - `status` (enum, required) — `active`, `paused` or `revoked`. - Allowed values: `active`, `paused`, `revoked` - `subscribed_events` (list of enum, required) - Allowed values: `document.failed`, `document.processed`, `embed.session.created`, `embed.session.revoked`, `export.cancelled`, `export.failed`, `export.succeeded`, `extraction.mapped`, `extraction.ready`, `extraction.updated`, `job.completed`, `loan.classified`, `memo.finalized`, `memo.reopened`, `memo_render.cancelled`, `memo_render.failed`, `memo_render.succeeded`, `spread.finalized`, `spread.reopened`, `*` - `created_at` (datetime, required) - `description` (string, optional, nullable) - `signing_secret_prefix` (string, optional, nullable) — First few characters of the active signing secret (e.g. `whsec_abc1`), enough to tell two secrets apart without exposing either. Null when the endpoint has no current signing secret. - `revoked_at` (datetime, optional, nullable) ## Errors ### 400 Bad Request Error Bad request: validation failed, the cursor is malformed, or the API version is unknown. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 401 Unauthorized Error Unauthorized: the bearer token or API key is missing or invalid. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 402 Payment Required Error Payment required: the standard error envelope with `type` `subscription_required` when the workspace has no active or trialing subscription, or `billing_required` where a plan entitlement applies. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 403 Forbidden Error Forbidden: authentication succeeded but the caller is not permitted to perform this action, for example an API key missing the required scope, an embed session reaching a loan it was not minted for, or a feature outside the workspace's plan. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 404 Not Found Error Not found: the resource does not exist or is not visible to the calling tenant. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 409 Conflict Error Conflict: a version mismatch, where `details.current_version` carries the version the resource is actually at so the client can reload and re-apply, or an idempotency key reused with a different request body. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 429 Too Many Requests Error Too many requests: the rate limit was hit, or an idempotency-key replay is still in progress. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ### 500 Internal Server Error Internal server error: an unexpected failure. Quote the `request_id` in support tickets. A mutation sent with an `Idempotency-Key` replays this fault under that key rather than re-running; confirm the resource state before resending with a new key. - `error` (ApiErrorBody, required) — Inner body of the canonical API error envelope. ## Types ### ApiErrorBody Inner body of the canonical API error envelope. - `type` (string, required) — Stable error type identifier. Pattern-match on this value, not the human-readable message. - `message` (string, required) — Human-readable error message. Subject to wording changes; do not parse. - `request_id` (string, optional, nullable) — Per-request correlation ID (matches `X-Request-ID` response header). Quote in support tickets. - `details` (map from string to string, optional, nullable) — Structured detail. Some error types populate documented keys in every environment: a version conflict (409) carries `current_version`, the version the resource is actually at, so the client can reload and re-apply. Free-form diagnostic detail beyond those keys appears in development environments only. An `insufficient_credits` 402 carries `balance_usd`, `reserved_usd`, `in_flight_docs`, `incoming_docs` and `per_doc_reservation_usd` as decimal strings. ## Examples **Request** ```json { "description": "Production document events", "subscribed_events": [ "document.processed", "job.completed" ] } ``` **Response** ```json { "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "url": "https://webhooks.example.com/receive", "status": "active", "subscribed_events": [ "document.processed", "job.completed" ], "created_at": "2024-01-15T09:30:00.125293+00:00", "description": "Production document events", "signing_secret_prefix": "whsec_a1b2c", "revoked_at": null } ``` **SDK Code** ```python import requests url = "https://api.spreadspace.app/api/webhooks/3fa85f64-5717-4562-b3fc-2c963f66afa6" payload = { "description": "Production document events", "subscribed_events": ["document.processed", "job.completed"] } headers = { "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.patch(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://api.spreadspace.app/api/webhooks/3fa85f64-5717-4562-b3fc-2c963f66afa6'; const options = { method: 'PATCH', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"description":"Production document events","subscribed_events":["document.processed","job.completed"]}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://api.spreadspace.app/api/webhooks/3fa85f64-5717-4562-b3fc-2c963f66afa6" payload := strings.NewReader("{\n \"description\": \"Production document events\",\n \"subscribed_events\": [\n \"document.processed\",\n \"job.completed\"\n ]\n}") req, _ := http.NewRequest("PATCH", url, payload) req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://api.spreadspace.app/api/webhooks/3fa85f64-5717-4562-b3fc-2c963f66afa6") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Patch.new(url) request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"description\": \"Production document events\",\n \"subscribed_events\": [\n \"document.processed\",\n \"job.completed\"\n ]\n}" response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.patch("https://api.spreadspace.app/api/webhooks/3fa85f64-5717-4562-b3fc-2c963f66afa6") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"description\": \"Production document events\",\n \"subscribed_events\": [\n \"document.processed\",\n \"job.completed\"\n ]\n}") .asString(); ``` ```php request('PATCH', 'https://api.spreadspace.app/api/webhooks/3fa85f64-5717-4562-b3fc-2c963f66afa6', [ 'body' => '{ "description": "Production document events", "subscribed_events": [ "document.processed", "job.completed" ] }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://api.spreadspace.app/api/webhooks/3fa85f64-5717-4562-b3fc-2c963f66afa6"); var request = new RestRequest(Method.PATCH); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"description\": \"Production document events\",\n \"subscribed_events\": [\n \"document.processed\",\n \"job.completed\"\n ]\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = [ "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = [ "description": "Production document events", "subscribed_events": ["document.processed", "job.completed"] ] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://api.spreadspace.app/api/webhooks/3fa85f64-5717-4562-b3fc-2c963f66afa6")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "PATCH" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```