> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atollhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update outbound webhook

> Owner/admin only. Omitted fields are preserved. URL, Bearer, or Standard Webhooks secret changes create a private destination version; queued deliveries retain their pinned version. Omit or leave a Bearer secret blank to preserve it; select none to clear it. For `standard_webhooks`, omit the object to preserve it, set `enabled: true` with a blank secret to preserve an existing secret, provide a nonblank valid `whsec_` secret to replace it, or set `enabled: false` to clear it. Responses never include private URLs or secrets.



## OpenAPI

````yaml /openapi.json patch /api/webhooks/{id}
openapi: 3.1.0
info:
  title: Atoll API
  version: 1.0.0
  description: >-
    REST API for Atoll project management, agent collaboration, strategy
    tracking, and integrations.
servers:
  - url: https://atollhq.com
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Authentication
  - name: Organizations
  - name: Projects
  - name: Project access
  - name: Issues
  - name: Issue details
  - name: Milestones
  - name: Artifacts
  - name: Strategy
  - name: Members and agents
  - name: Planning
  - name: Setup
  - name: Integrations and billing
  - name: Notifications and public
  - name: Private inbox
  - name: Agent executions
  - name: Human attention
paths:
  /api/webhooks/{id}:
    patch:
      tags:
        - Integrations and billing
      summary: Update outbound webhook
      description: >-
        Owner/admin only. Omitted fields are preserved. URL, Bearer, or Standard
        Webhooks secret changes create a private destination version; queued
        deliveries retain their pinned version. Omit or leave a Bearer secret
        blank to preserve it; select none to clear it. For `standard_webhooks`,
        omit the object to preserve it, set `enabled: true` with a blank secret
        to preserve an existing secret, provide a nonblank valid `whsec_` secret
        to replace it, or set `enabled: false` to clear it. Responses never
        include private URLs or secrets.
      operationId: patch_api_webhooks_id
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookUpdateInput'
      responses:
        '200':
          description: Updated safe webhook metadata
          content:
            application/json:
              schema:
                type: object
                properties:
                  webhook:
                    type: object
                    additionalProperties: true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
      security:
        - bearerAuth: []
components:
  schemas:
    WebhookUpdateInput:
      type: object
      properties:
        url:
          type: string
          format: uri
          description: >-
            HTTPS DNS receiver URL. IP literals, `localhost`, `.local` hosts,
            URL credentials, and fragments are rejected at creation. Delivery
            refuses private, loopback, link-local, documentation, multicast, or
            otherwise non-public DNS results and does not follow redirects.
        events:
          type: array
          items:
            type: string
        enabled:
          type: boolean
        purpose:
          type: string
          enum:
            - subscription
            - automation
            - both
        auth:
          type: object
          properties:
            type:
              type: string
              enum:
                - none
                - bearer
            secret:
              type: string
              writeOnly: true
              description: >-
                Printable ASCII only; control characters and non-ASCII
                characters are rejected.
          additionalProperties: false
          required:
            - type
        standard_webhooks:
          type: object
          properties:
            enabled:
              type: boolean
              description: >-
                Omit the object to preserve. Set false to clear; set true to
                preserve with blank secret or replace with a nonblank valid
                secret.
            secret:
              type: string
              writeOnly: true
              pattern: ^whsec_[A-Za-z0-9+/]+={0,2}$
              description: >-
                Receiver-supplied Standard Webhooks secret. Canonical standard
                Base64 after whsec_, decoding to 24-64 bytes.
          required:
            - enabled
          additionalProperties: false
      additionalProperties: true
      description: >-
        Partial update. All omitted fields are preserved. Bearer secret omitted
        or blank preserves an existing token; type none clears it. Switching
        from none to bearer requires a token or returns HTTP 400.
    Error:
      type: object
      description: >-
        Common error responses contain error. Shared missing-auth and
        unknown-API responses also contain a stable code.
      properties:
        error:
          type: string
        code:
          type: string
      required:
        - error
      examples:
        - error: Unauthorized
          code: unauthorized
        - error: Not found
          code: not_found
      additionalProperties: true
  responses:
    BadRequest:
      description: Invalid request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Missing or invalid authentication
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: Authenticated but not allowed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: Resource not found or not visible
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ServerError:
      description: Unexpected server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: sk_atoll_<key>

````