Skip to main content
PATCH
Update Webhook Endpoint

Authorizations

Authorization
string
header
required

Send the credential as Authorization: Bearer <key>.

Scoped partner credentials use the exclusive nxsk_v1_... namespace. Each scoped key is bound at issuance to one organization, one canonical named environment, an explicit engine set, and a least-privilege capability set. A malformed, unknown, rotated, or revoked nxsk_ key fails closed and is never retried as a legacy key.

Capabilities used by this API are runs:write, runs:read, engines:read, catalog:read, webhooks:manage, runs:defensibility:read, runs:test, and converse:use. Operation descriptions name the required capability. Grandfathered nx_live_... and nx_test_... keys retain their existing broad access during the compatibility window.

Path Parameters

endpointID
string<uuid>
required

Webhook endpoint UUID.

Body

application/json

At least one field is required.

url
string<uri>
events
enum<string>[]
Minimum array length: 1
Available options:
run.completed,
run.failed,
run.superseded
description
string
Maximum string length: 256
active
boolean
auth_token
string

Set to null to clear the bearer token.

Maximum string length: 1024
payload_mode
enum<string>

Delivery body shape. Omit to keep the current mode; an empty value is rejected.

Available options:
full,
thin

Response

Updated endpoint.

id
string<uuid>
required

Endpoint identifier.

url
string<uri>
required

Delivery target URL.

environment
enum<string>
required

Environment this endpoint receives events from.

Available options:
test,
live
events
enum<string>[]
required

Subscribed event types.

Available options:
run.completed,
run.failed,
run.superseded
active
boolean
required

Whether the endpoint is active.

auth_token_configured
boolean
required

Whether an auth token is set (the token value is never returned).

webhook_version
string
required

Payload version string (e.g. 2026-03-22).

created_at
string<date-time>
required

RFC 3339 creation timestamp.

description
string

Human-readable description.

payload_mode
enum<string>

Delivery body shape. full (default) carries the complete run; thin carries only run identifiers and terminal status.

Available options:
full,
thin
previous_secret_expires_at
string<date-time>

Exact instant when the previous secret stops being valid.

deactivated_at
string<date-time>

Present only while the system has deactivated the endpoint after a consecutive dead-letter streak. Cleared on re-enable.

deactivated_by
string

Actor that deactivated the endpoint (system for the automatic dead-letter streak deactivation). Present only while deactivated.

deactivated_reason
string

Why the endpoint was deactivated, including the triggering delivery ID. Present only while deactivated.

updated_at
string<date-time>

RFC 3339 last-update timestamp.