BioFlow / API docs / updateWebhookEndpoint

Update a webhook endpoint.

PATCH /v1/webhook-endpoints/{endpoint_id}

scope: webhooks:writeCreator & Pro plansquota cost: 1

Change the URL (re-verified with a signed test event first), the subscribed event types, or enable/disable delivery. Re-enabling resets the consecutive-failure counter; missed events can then be re-queued with Replay failed deliveries.

Requires scope: webhooks:write. Plan entitlement: public_api (Creator and Pro).

Open in Claude ↗Open in ChatGPT ↗

Try it

Request.

curl "https://app.getbioflow.com/v1/webhook-endpoints/ENDPOINT_ID" \
  -X PATCH \
  -H "Authorization: Bearer bf_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/hooks/bioflow",
    "event_types": [
      "contact.created"
    ],
    "enabled": true
  }'

Parameters

Path & query parameters.

Parameters accepted by updateWebhookEndpoint
Name	In	Type	Required	Description
`endpoint_id`	path	string	yes	Endpoint ID from List webhook endpoints

Request body

JSON body (application/json).

Request-body fields for updateWebhookEndpoint
Field	Type	Required	Description
`url`	string	no	New URL — re-verified with a signed test event first
`event_types`	array<contact.created \| page.published \| sale.paid \| sale.refunded>	no	—
`enabled`	boolean	no	true re-enables a disabled endpoint (and resets its failure count); false disables it

Response

200 — The updated endpoint.

Fields of the 200 response for updateWebhookEndpoint
Field	Type	Description
`id`	string	Stable opaque endpoint ID
`url`	string	—
`status`	ACTIVE \| DISABLED	—
`disabled_reason`	string \| null	—
`event_types`	array<contact.created \| page.published \| sale.paid \| sale.refunded>	—
`consecutive_failures`	integer	—
`last_success_at`	string (ISO 8601) \| null	—
`last_failure_at`	string (ISO 8601) \| null	—
`previous_secret_expires_at`	string (ISO 8601) \| null	While set, the pre-rotation secret still signs deliveries (second signature)
`created_at`	string (ISO 8601)	—
`updated_at`	string (ISO 8601)	—

Every response also carries X-Request-Id plus the IETF draft-11 RateLimit / RateLimit-Policy headers.

Errors

What can go wrong here.

Problem codes this operation can return
Code	Status	Meaning
`invalid_request`	400	The request body or parameters failed validation
`invalid_api_key`	401	Missing, malformed, unknown, disabled, or expired API key
`insufficient_scope`	403	The API key was not granted the required scope
`feature_not_enabled`	403	The workspace plan does not include public API access
`test_key_read_only`	403	Test-mode keys are restricted to read operations
`rate_limited`	429	Per-key rate limit exceeded
`quota_exhausted`	429	Monthly API quota exhausted
`internal_error`	500	Something went wrong on our side

All errors are RFC 9457 application/problem+json — branch on code, quote request_id to support. Full registry on the API docs hub; interactive playground in the API reference.