Meet the new Scripe, live on October 7.Register

OpenAPI reference · Webhooks

Update webhook endpoint

PATCH/webhook-endpoints/{endpointId}

Patch any subset of name, URL, events, isActive, projectId. Anything not present is left unchanged. Changing the URL re-pins the resolved IP (and re-runs the SSRF check). Setting isActive: true on an auto-disabled endpoint clears disabledReason.

Requires the webhooks:manage scope.

Authorization

  • Authorizationstringrequired

    Bearer token in the Authorization header.

    Pass Authorization: Bearer scripe_sk_live_<...> (or scripe_sk_test_<...> for test keys) on every request. Keys are scoped to a single workspace and can be revoked from the Scripe dashboard.

    The same header also accepts an OAuth 2.1 access token (scripe_oat_*); both credentials share one scope vocabulary and every operation below documents the scope it requires. An API key can hold every scope named on this surface except webhooks:manage, which is grantable to OAuth tokens only today — the webhook-endpoint operations answer 403 scope_missing to every API key. Operations that name no scope accept any valid token of the workspace.

Path parameters

  • endpointIdstringrequired

Header parameters

  • Scripe-Api-Versionstring

    Pin the API version. Format YYYY-MM-DD. Omit to receive the currently rolling default. Unknown versions return 400 version_unsupported.

Request bodyapplication/json

  • namestring
  • urlstring <uri>
  • eventsstring[]
  • isActiveboolean
  • projectIdstring | null

Responses

  • 200

    Endpoint updated.

  • 400

    Malformed request (bad cursor, bad limit, etc.).

  • 401

    Missing, malformed, expired, or revoked API key.

  • 403

    Plan not eligible, scope missing, or workspace mismatch.

  • 404

    Resource not found in this workspace.

  • 429

    Sliding-window rate limit exceeded.

Example request

bash
curl --request PATCH \
  --url 'https://api.scripe.io/v1/webhook-endpoints/{endpointId}' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "string",
  "url": "https://example.com",
  "events": [
    "note.created"
  ],
  "isActive": true,
  "projectId": "string"
}'

Example response (200)

json
{
  "data": {
    "id": "whe_a1b2c3d4e5f6g7h8",
    "url": "https://hooks.example.com/scripe",
    "name": "Production CRM",
    "events": [
      "post.created",
      "job.completed"
    ],
    "isActive": true,
    "disabledReason": "string",
    "projectId": "string",
    "secretLast4": "string",
    "createdAt": "2026-08-10T09:00:00Z",
    "updatedAt": "2026-08-10T09:00:00Z"
  }
}