APG PayAPG Paydocs

Webhooks

Update webhook

PATCH/webhooks/{webhookId}

Update a subscription's url, event types, description or status, or rotate its signing secret. Fields you omit are left unchanged.

3 actionsWebhookUpdateAttributesWebhookUpdateRotateSecretWebhookUpdateStatus

Permissions

Required permission
webhookSubscriptions:update

Requires the `update` action on `webhookSubscriptions` for the supplied runtime context

Path parameters

webhookIdstring
required

Request body

This body is a typed union. Pick a variant to see its fields and a matching example.

Discriminated by type
type = "WebhookUpdateAttributes"
urlstringrequired

Where to deliver from now on, by the same rules as on create. Deliveries already owed go to the new url, as do redeliveries.

Example https://example.com/callback

eventsarray of WebhookEventTyperequired

The event types to deliver from now on, at least one, replacing the whole list.

MerchantCreatedMerchantActivatedMerchantSuspendedMerchantAvailableBalanceUpdatedMerchantBankAccountAddedMerchantPrimaryBankAccountUpdatedPayPlanCreatedPayPlanActivatedPayPlanCompletedPayPlanInDefault
+27 more

PayInFullCreated, PayInFullAccepted, PayInFullAuthorised, PayInFullCompleted, TransactionPaid, TransactionFailed, DisputeCreated, DisputeUpdated, PayoutCreated, PayoutPending, PayoutFailed, PayoutPaid, PayoutReversed, InvoiceIssued, InvoiceDue, InvoicePaymentFailed, InvoicePaid, PaymentSourceCreated, PaymentSourceMethodUpdated, PaymentSourceDeleted, LoanCreated, LoanStatementCreated, LoanStatementIssued, LoanStatementDue, LoanStatementPaid, LoanPaymentFailed, Unknown

descriptionstring

What this subscription is for, in your own words. Omit it to leave it unchanged; an empty string clears it.

curl -X PATCH https://api.tst.au.apgpay.dev/webhooks/{webhookId} \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "type": "WebhookUpdateAttributes",
  "url": "https://example.com/callback",
  "events": [
    "MerchantCreated"
  ],
  "description": "string"
}'

Responses

The response is a tagged shape: type is always "WebhookUpdateRspAttributes". Switch on it; subtypes can be added, and a client that already reads it will not break.

Discriminated by type
type = "WebhookUpdateRspAttributes"

The resource as it stands after the change.

Example
{
  "type": "WebhookUpdateRspAttributes",
  "updated": {
    "type": "WebhookViewAttributes",
    "webhookId": "webhook_9f2Kd8QpLzXw",
    "merchantId": "mcht_9f2Kd8QpLzXw",
    "marketplaceId": "mktp_9f2Kd8QpLzXw",
    "url": "https://example.com/callback",
    "status": "Active",
    "events": [
      "MerchantCreated"
    ],
    "description": "string",
    "metadata": {
      "yourKey": {}
    },
    "readable": true,
    "consecutiveFailures": 1250,
    "lastDeliveryAt": "2026-08-19T04:21:07Z",
    "lastDeliveryStatus": "Pending",
    "createdAt": "2026-08-19T04:21:07Z",
    "updatedAt": "2026-08-19T04:21:07Z"
  }
}

Error responses