Update a webhook endpoint

PATCH/v1/webhook_endpoints/{id}

Changes a webhook endpoint: its URL, the event types it gets, its authentication or its senders.

Path parameters

idstringrequired

The webhook endpoint's ID, starting whk_.

Body

Optional

urlstring

HTTPS on port 443, public host (A).
event_typesarray of string

Empty = every type, including types added later.
One of delivery.created delivery.rejected delivery.notified delivery.opened delivery.email_opened delivery.auth_failed delivery.confirmed delivery.downloaded delivery.delivered delivery.reminded delivery.bounced delivery.expired delivery.revoked delivery.consignment_failed delivery.evidence_sealed delivery.evidence_timestamp_deferred delivery.evidence_timestamp_recovered delivery.paper_pending_approval delivery.paper_dispatched delivery.paper_failed document.previewed batch.finalized batch.completed lookup.completed consent.granted consent.withdrawn invitation.sent link.opened otp.sent otp.verified otp.locked secret.attached secret.available secret.revealed secret.copied secret.expired secret.exhausted secret.revoked request.sent request.opened request.fulfilled request.expired request.closed request.reopened deletion.scheduled recipient_domain.verified recipient_domain.degraded recipient_domain.failed member.suspended member.restored member.removed batch.cancelled batch.policy_changed delivery.policy_changed email_sender.verified email_sender.degraded email_sender.failed email_sender.restored
descriptionstring · nullable

Your own note about the endpoint, up to 500 characters; null clears it.
at most 500 characters
authobject

How Parasend authenticates to your endpoint, in addition to the HMAC signature, which is always sent. Secrets are write-only: accepted on create and update, never returned. The endpoint shows mode, the settings that are not secret, and whether a secret is set.
3 fields of auth
- auth.modestringrequired
  
  none = HMAC only. static_bearer = an Authorization header carrying Bearer <token> with a customer-supplied token. oauth2_client_credentials = a token obtained from the customer's IdP by the client-credentials grant, cached until expiry, sent as the bearer.
  One of none static_bearer oauth2_client_credentials
  Default "none"
- auth.static_bearerobject · nullable
  
  With mode: static_bearer: the token Parasend sends as Authorization: Bearer <token>, at most 4,096 characters (write-only; responses show token_set). null for any other mode.
  1 field of static_bearer
  - auth.static_bearer.tokenstring
    
    Never returned. Rotate by writing a new value.
- auth.oauth2object · nullable
  
  With mode: oauth2_client_credentials: your token endpoint (token_url, HTTPS), client_id, client_secret (write-only; responses show client_secret_set), optional scope and audience, and auth_style. null for any other mode.
  6 fields of oauth2
  - auth.oauth2.token_urlstring · uri
    
    HTTPS only.
  - auth.oauth2.client_idstring
  - auth.oauth2.client_secretstring
    
    Never returned.
  - auth.oauth2.scopestring · nullable
  - auth.oauth2.audiencestring · nullable
  - auth.oauth2.auth_stylestring
    
    One of client_secret_basic client_secret_post
    Default "client_secret_basic"
statusstring

disabled pauses the endpoint: new events are not queued for it and pending retries are cancelled when they come due.
One of enabled disabled
delivery_sourcesobject · nullable

null: every delivery's events. A change applies to events queued from then on; retries already queued go ahead.

Returns

200 application/json. Updated. See the WebhookEndpoint object.

Errors have one shape; see Errors for every code.

curl -X PATCH "https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA" \ -H "Authorization: Bearer $PARASEND_KEY" \ -H "Content-Type: application/json" \ -d '{ "event_types": [ "delivery.confirmed", "delivery.bounced", "delivery.expired" ] }'

const res = await fetch('https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA', { method: 'PATCH', headers: { Authorization: `Bearer ${process.env.PARASEND_KEY}`, 'Content-Type': 'application/json', }, body: JSON.stringify({ event_types: ['delivery.confirmed', 'delivery.bounced', 'delivery.expired'], }), }); const data = await res.json();

import os, requests res = requests.patch( "https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA", headers={ "Authorization": f"Bearer {os.environ['PARASEND_KEY']}", }, json={ "event_types": ["delivery.confirmed", "delivery.bounced", "delivery.expired"], }, ) data = res.json()

using var http = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Patch, "https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA"); request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("PARASEND_KEY")); request.Content = new StringContent(""" { "event_types": [ "delivery.confirmed", "delivery.bounced", "delivery.expired" ] } """, Encoding.UTF8, "application/json"); var response = await http.SendAsync(request); var body = await response.Content.ReadAsStringAsync();

var json = """ { "event_types": [ "delivery.confirmed", "delivery.bounced", "delivery.expired" ] } """; var request = HttpRequest.newBuilder(URI.create("https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA")) .header("Authorization", "Bearer " + System.getenv("PARASEND_KEY")) .header("Content-Type", "application/json") .method("PATCH", HttpRequest.BodyPublishers.ofString(json)) .build(); var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());

$client = new GuzzleHttp\Client(); $response = $client->request('PATCH', 'https://api.parasend.com/v1/webhook_endpoints/whk_01M6R27T4KCSN7M0CHFGVH7JRA', [ 'headers' => [ 'Authorization' => 'Bearer ' . getenv('PARASEND_KEY'), ], 'json' => [ 'event_types' => ['delivery.confirmed', 'delivery.bounced', 'delivery.expired'], ], ]); $data = json_decode($response->getBody(), true);

{ "id": "whk_01M6R27T4KCSN7M0CHFGVH7JRA", "object": "webhook_endpoint", "url": "https://hooks.fyrirtaeki.example/parasend", "event_types": [ "delivery.confirmed", "delivery.bounced", "delivery.expired" ], "description": "Case system", "secret": null, "auth": { "mode": "none", "static_bearer": null, "oauth2": null }, "delivery_sources": null, "status": "enabled", "livemode": false, "exhausted_events": 0, "last_exhausted_at": null, "retrying_events": 0, "last_attempt": null, "created_by": { "user_id": "usr_01M6R27SYD4B50414S0BZ4KBKR", "name": "Jóna Jónsdóttir", "via": "api_key" }, "previous_secret_expires_at": null, "created": "2026-11-06T09:15:05.746Z" }