> ## Documentation Index
> Fetch the complete documentation index at: https://docs.warmr.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Update a webhook (partial). Requires webhooks:write.

> Patches any of url / events / active; at least one must be supplied (422 otherwise).
A new url is re-checked by the SSRF guard. `events: []` is rejected with 422 —
it would silently WIDEN the subscription to ALL events; to quiet a webhook set
`active: false` instead. Never returns the signing secret.




## OpenAPI

````yaml /api/openapi.yaml patch /v1/webhooks/{id}
openapi: 3.1.0
info:
  title: Warmr Cloud API
  version: '1.2'
  summary: Enqueue and read iPhone-fleet automation work (warmups + posts).
  description: >
    The business-facing REST surface for Warmr. **Bring-your-own-fleet**: API
    keys

    *enqueue* work and read org-scoped state; your own connected iPhones
    *execute* it.

    A server-side **airlock** prevents an API session from ever driving a
    device.


    Auth is a two-step flow: exchange a `wk_live_` API key at the exchange
    endpoint for a

    short-lived org session, then call `/v1` with `Authorization: Bearer
    <access_token>`.


    Every `/v1` response is wrapped in an envelope `{ "schema": "1.0", ... }`;
    errors are

    `{ "schema": "1.0", "error": { "code", "message", "data"? } }`. The exchange
    endpoint

    uses a flatter `{ "error": "<code>" }` body.


    NOTE: the public base URL is deployment-specific and is NOT asserted here.
    Replace the

    `app.warmr.so` / `<project-ref>` placeholders below with your deployment's
    values.
  license:
    name: UNLICENSED
servers:
  - url: https://{origin}
    description: Substitute your Warmr deployment origin. app.warmr.so is a placeholder.
    variables:
      origin:
        default: app.warmr.so
        description: Your Warmr deployment host, no scheme, e.g. app.example.com
security:
  - bearerAuth: []
tags:
  - name: auth
    description: Exchange an API key for an org session.
  - name: runs
    description: >-
      Enqueue and read units of automation work (warm_up or post); your
      connected iPhones execute them.
  - name: schedules
    description: >-
      Standing recurring post schedules (one account each). The materializer
      turns them into runs.
  - name: accounts
    description: Register and list the social account handles in your org.
  - name: content
    description: >-
      Signed direct-to-storage uploads for post clips (issue → upload →
      confirm).
  - name: usage
    description: Org storage and run counts for a billing period.
  - name: devices
    description: The iPhones your runner(s) have reported to the org.
  - name: webhooks
    description: >-
      Subscribe to run.completed / run.failed events and manage deliveries.
      Opt-in, secret-bearing (webhooks:read / webhooks:write).
  - name: keys
    description: >-
      List your org's API keys — metadata only, the secret is never returned.
      Opt-in keys:read.
  - name: health
    description: Lightweight org-scoped readiness probe. Opt-in health:read.
paths:
  /v1/webhooks/{id}:
    parameters:
      - $ref: '#/components/parameters/WebhookId'
    patch:
      tags:
        - webhooks
      summary: Update a webhook (partial). Requires webhooks:write.
      description: >
        Patches any of url / events / active; at least one must be supplied (422
        otherwise).

        A new url is re-checked by the SSRF guard. `events: []` is rejected with
        422 —

        it would silently WIDEN the subscription to ALL events; to quiet a
        webhook set

        `active: false` instead. Never returns the signing secret.
      operationId: updateWebhook
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWebhookRequest'
      responses:
        '200':
          description: The updated webhook (never the secret).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEnvelope'
        '400':
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Error'
        '403':
          $ref: '#/components/responses/Error'
        '404':
          $ref: '#/components/responses/Error'
        '422':
          $ref: '#/components/responses/Error'
components:
  parameters:
    WebhookId:
      name: id
      in: path
      required: true
      schema:
        type: string
  schemas:
    UpdateWebhookRequest:
      type: object
      description: >
        Partial patch — supply at least one of url/events/active (422
        otherwise). events:[] is rejected with 422 (it would widen to ALL
        events); set active:false to quiet a webhook instead.
      properties:
        url:
          type: string
          format: uri
          description: A public https:// URL (re-checked by the SSRF guard).
        events:
          type: array
          minItems: 1
          items:
            type: string
        active:
          type: boolean
    WebhookEnvelope:
      allOf:
        - $ref: '#/components/schemas/Envelope'
        - type: object
          required:
            - webhook
          properties:
            webhook:
              $ref: '#/components/schemas/Webhook'
    Envelope:
      type: object
      required:
        - schema
      properties:
        schema:
          type: string
          const: '1.0'
    Webhook:
      type: object
      properties:
        webhook_id:
          type: string
        url:
          type: string
        events:
          type: array
          items:
            type: string
        active:
          type: boolean
        created_at:
          type: string
        updated_at:
          type: string
    ErrorEnvelope:
      allOf:
        - $ref: '#/components/schemas/Envelope'
        - type: object
          required:
            - error
          properties:
            error:
              type: object
              required:
                - code
                - message
              properties:
                code:
                  type: string
                message:
                  type: string
                data: {}
  responses:
    Error:
      description: A /v1 error envelope.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: The access_token from the exchange endpoint.

````