> ## Documentation Index > Fetch the complete documentation index at: https://docs.beinfi.com/llms.txt > Use this file to discover all available pages before exploring further. # Update a webhook > Changes the events, or turns the endpoint on or off. Send `isActive`, `events` or both; what is not sent stays as it is. `events` replaces the whole list. The URL and the secret do not change here (the secret changes with `rotate-secret`). ## OpenAPI ````yaml /api-reference/openapi.en.json patch /account/webhooks/{endpointID} openapi: 3.1.0 info: title: Infi API version: 0.0.1 description: > The Infi REST API: catalog, customers, usage metering, subscriptions, invoices, payments and checkout. **Authentication.** Send your secret key as `Authorization: Bearer sk_test_…` (sandbox) or `sk_live_…` (production). The key prefix selects the environment. Checkout routes (`/pay/*`) and `/public/*` take no key: they run in the payer's browser. **Idempotency.** Every request that changes data requires an `Idempotency-Key` header. A retry with the same key returns the original response instead of running again. **Amounts.** Money and quantities travel as decimal strings (`"150.00"`, `"0.0001"`), never as floating-point numbers. **Errors.** The body carries `error_code` (stable, branch on it), `message` (for humans) and `tracer_id` (send it to support). Rate-limit and idempotency errors are nested under `error`, with `code` and `request_id`. servers: - url: https://api-sandbox.beinfi.com description: Sandbox - url: https://api.beinfi.com description: Production security: - bearerAuth: [] tags: - name: Catalog - name: Customers - name: Metering - name: Subscriptions - name: Invoices - name: Payments - name: Checkout - name: Coupons - name: Billing - name: Account - name: Webhooks - name: Test account paths: /account/webhooks/{endpointID}: parameters: - name: endpointID in: path required: true schema: $ref: '#/components/schemas/WebhookEndpointId' patch: tags: - Webhooks summary: Update a webhook description: > Changes the events, or turns the endpoint on or off. Send `isActive`, `events` or both; what is not sent stays as it is. `events` replaces the whole list. The URL and the secret do not change here (the secret changes with `rotate-secret`). operationId: patchWebhook parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object properties: isActive: type: boolean description: >- `true` turns it on, `false` off. While off, the endpoint receives no deliveries. events: type: array minItems: 1 items: $ref: '#/components/schemas/WebhookEventType' description: The new list of events. At least one. active: type: boolean deprecated: true description: Older spelling of `isActive`, still accepted. responses: '200': content: application/json: schema: $ref: '#/components/schemas/WebhookEndpoint' description: The updated endpoint. '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationFailed' components: schemas: WebhookEndpointId: type: string pattern: ^we_[0-9A-Za-z]{22}$ example: we_3Tz8yU1oI4pA7sD0fG2hJk WebhookEventType: type: string enum: - checkout.session.created - checkout.session.completed - checkout.session.expired - customer.created - customer.converted - invoice.finalized - invoice.sent - invoice.paid - invoice.voided - invoice.uncollectible - invoice.auto_collection_failed - payment.confirmed - payment.failed - payment.refunded - payment.refund_reversed - payment.chargeback - payment.chargeback_reversed - plan.changed - usage.threshold_reached - credit.balance_low - credit.balance_depleted - subscription.cancel_scheduled - subscription.cancel_unscheduled - subscription.canceled - subscription.past_due - refund_request.created - payment.duplicate_detected - payment.duplicate_refunded - refund_request.declined WebhookEndpoint: type: object required: - id - url - events - isActive - createdAt properties: id: $ref: '#/components/schemas/WebhookEndpointId' url: type: string format: uri description: URL that receives deliveries. events: type: array items: type: string description: >- Subscribed events. Any emitted event can be subscribed to by name, including ones without a documented payload yet. isActive: type: boolean description: Whether the endpoint is receiving deliveries. createdAt: type: string format: date-time Error: type: object required: - message - error_code - tracer_id properties: message: type: string description: Human-readable sentence. error_code: $ref: '#/components/schemas/ErrorCode' description: Stable error code. Branch on it. tracer_id: type: string description: Request id. Include it when contacting support. description: >- The standard error body. It is flat (no `error` wrapper) and the trace id is `tracer_id`. NotFoundError: type: object required: - message - error_code - tracer_id - resource properties: message: type: string error_code: $ref: '#/components/schemas/ErrorCode' tracer_id: type: string resource: type: string ValidationError: type: object required: - message - error_code - tracer_id - errors properties: message: type: string error_code: $ref: '#/components/schemas/ErrorCode' tracer_id: type: string errors: type: array items: type: object required: - field - value - constraint - description properties: field: type: string value: type: string constraint: type: string description: type: string description: >- Per-field detail (`field`, `description`). Always present on a `422`; may be empty. description: >- Body of a `422`. Same shape as `Error`, plus `errors[]` with per-field detail. That is where the sentence telling you what to fix lives (for example, "product has no published version"). ErrorCode: type: string examples: - internal_error - validation_failed - bad_request - unauthorized - forbidden - not_found - conflict - rate_limited description: >- Stable error code. The list is open: besides the generic codes, each area defines its own (`coupon_expired`, `insufficient_balance`, `version_not_draft`, `idempotency_key_reused`…). Handle a code you do not recognize by its HTTP status and show `message`; do not fail parsing the response. parameters: IdempotencyKey: name: Idempotency-Key in: header required: false schema: type: string description: >- A unique key per operation (a UUID works). Retrying with the same key returns the original response. responses: BadRequest: content: application/json: schema: $ref: '#/components/schemas/Error' description: Malformed request. Unauthorized: content: application/json: schema: $ref: '#/components/schemas/Error' description: Missing or invalid API key. NotFound: content: application/json: schema: $ref: '#/components/schemas/NotFoundError' description: Resource not found. ValidationFailed: content: application/json: schema: $ref: '#/components/schemas/ValidationError' description: One or more fields are invalid. Per-field detail is in `errors[]`. securitySchemes: bearerAuth: type: http scheme: bearer description: >- Your account's secret key: `Authorization: Bearer sk_test_…` or `sk_live_…`. Server-side only. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.