# Change a Webhook Endpoint

Its address, its event types, its label, its status or its mutual TLS. The rest stays, and so does the secret.

## Overview

- Send only what changes: at least one of `url`, `eventTypes`, `description`, `status` and `mtls`. An empty body answers `400` `Name at least one of url, eventTypes, description or status`. The environment never changes: add an endpoint in the other one instead.
- `mtls`, where your tenant has mutual TLS on deliveries [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md): `true` or `false` ([Mutual TLS](https://docs.aureahub.com/docs/guide-events.md)). Otherwise `true` answers `409` `WEBHOOK_MTLS_UNAVAILABLE` and nothing changes.
- Each field follows the rules of [Add an Endpoint](https://docs.aureahub.com/docs/webhook-endpoint-add.md), with the same `400` `WEBHOOK_ENDPOINT_INVALID` refusals. `"description": null` or `""` clears the label.
- `"status": "disabled"` stops the deliveries: those still waiting finish as `skipped`, and changes that happen meanwhile are not sent later. `"active"` starts them again with the same secret.
- Deliveries already queued go to the endpoint as it is when they are sent: a new address receives them, and an endpoint that no longer asks for their type skips them.
- `404` `WEBHOOK_ENDPOINT_NOT_FOUND` for an endpoint that is not this tenant's. Same roles as Add an Endpoint; written to the tenant's activity log with what it replaced.

> Note: **Your tenant's quorum** [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md) — where it holds administrators' actions (a tenant on the institutional security profile by its profile; every other tenant's records them only): this call answers `202` `{ "state": "awaiting_quorum", "requestId" }` — the **202** tab below — and nothing is done until another administrator of your tenant approves it; the answer it would have given is then read once by who asked ([Read the Answer](https://docs.aureahub.com/docs/quorum-request-result.md)). With no other administrator able to approve it, it is done at once. [Your Tenant's Quorum](https://docs.aureahub.com/docs/guide-tenant-quorum.md). Every other tenant gets the answers below, unchanged.

## Endpoint

### `PATCH /v1/admin/tenants/{id}/webhook-endpoints/{endpointId}`

Authentication: bearer token required.

Changes what the body names; the secret stays.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | yes | Tenant UUID |
| `endpointId` | string | yes | The endpoint's id |

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `url` | string | no | A new address |
| `eventTypes` | string[] | no | The types it receives, any of the published types ([Webhooks & Events › Event Types](https://docs.aureahub.com/docs/guide-events.md)); empty: the five `ramp.*` types only |
| `description` | string \| null | no | Your label; `null` or empty clears it |
| `status` | string | no | `active` or `disabled` |
| `mtls` | boolean | no | Where your tenant has mutual TLS (on request): whether deliveries present Aurea's client certificate |

**Responses**

`200` Changed

```json
{
  "endpoint": {
    "id": "8a3c5e71-2b4d-4f60-9e1a-7c2d4b6f8e01",
    "environment": "production",
    "url": "https://ledger.example.com/aurea/events",
    "description": "Ledger service",
    "eventTypes": [],
    "status": "active",
    "secretHint": "Zt4w",
    "secretRotatedAt": "2026-10-06T08:12:40.511Z",
    "createdAt": "2026-10-06T08:12:40.511Z",
    "updatedAt": "2026-10-06T09:30:02.118Z"
  }
}
```

`202` Awaiting quorum

```json
{
  "state": "awaiting_quorum",
  "requestId": "4e2b9c17-8a3d-4f60-b5e1-7c9d0a2f6b38"
}
```

`404` Not found

```json
{
  "statusCode": 404,
  "error": "NotFoundError",
  "message": "This tenant has no such webhook endpoint",
  "details": { "code": "WEBHOOK_ENDPOINT_NOT_FOUND" }
}
```

---

Web version: https://docs.aureahub.com/#webhook-endpoint-change