Update a webhook endpoint

curl --request PATCH \
  --url https://api.mercemur.com/api/v1/webhook-endpoints/{webhookEndpointId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '
{
  "url": "<string>",
  "subscribed_events": [],
  "is_active": true
}
'

const options = {
  method: 'PATCH',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({url: '<string>', subscribed_events: [], is_active: true})
};

fetch('https://api.mercemur.com/api/v1/webhook-endpoints/{webhookEndpointId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.mercemur.com/api/v1/webhook-endpoints/{webhookEndpointId}"

payload = {
    "url": "<string>",
    "subscribed_events": [],
    "is_active": True
}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.mercemur.com/api/v1/webhook-endpoints/{webhookEndpointId}"

	payload := strings.NewReader("{\n  \"url\": \"<string>\",\n  \"subscribed_events\": [],\n  \"is_active\": true\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.mercemur.com/api/v1/webhook-endpoints/{webhookEndpointId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'url' => '<string>',
    'subscribed_events' => [
        
    ],
    'is_active' => true
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "Idempotency-Key: <idempotency-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "data": {
    "auto_disabled_at": null,
    "created_at": "<string>",
    "id": "<string>",
    "is_active": true,
    "subscribed_events": [
      "<string>"
    ],
    "updated_at": "<string>",
    "url": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

PATCH

api

webhook-endpoints

{webhookEndpointId}

Update a webhook endpoint

curl --request PATCH \
  --url https://api.mercemur.com/api/v1/webhook-endpoints/{webhookEndpointId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '
{
  "url": "<string>",
  "subscribed_events": [],
  "is_active": true
}
'

const options = {
  method: 'PATCH',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({url: '<string>', subscribed_events: [], is_active: true})
};

fetch('https://api.mercemur.com/api/v1/webhook-endpoints/{webhookEndpointId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.mercemur.com/api/v1/webhook-endpoints/{webhookEndpointId}"

payload = {
    "url": "<string>",
    "subscribed_events": [],
    "is_active": True
}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.mercemur.com/api/v1/webhook-endpoints/{webhookEndpointId}"

	payload := strings.NewReader("{\n  \"url\": \"<string>\",\n  \"subscribed_events\": [],\n  \"is_active\": true\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.mercemur.com/api/v1/webhook-endpoints/{webhookEndpointId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'url' => '<string>',
    'subscribed_events' => [
        
    ],
    'is_active' => true
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "Idempotency-Key: <idempotency-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "data": {
    "auto_disabled_at": null,
    "created_at": "<string>",
    "id": "<string>",
    "is_active": true,
    "subscribed_events": [
      "<string>"
    ],
    "updated_at": "<string>",
    "url": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "resource": "<string>",
    "field": "<string>"
  }
}

Authorizations

Authorization

string

header

required

A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.

Headers

Idempotency-Key

string

required

A unique key per logical write. Replaying a request with the same key returns the first response byte for byte instead of applying the write twice.

Path Parameters

webhookEndpointId

string

required

Body

application/json

Every field is optional and an omitted one keeps its stored value. The response is the endpoint resource, WITHOUT the signing secret; changing a subscription does not change the secret.

url

string

Same address policy as the create.

subscribed_events

enum<string>[]

REPLACES the whole subscription rather than adding to it, so send the list you want rather than a diff. A present but empty array is refused: omit the key to leave the subscription alone. A changed list is re-checked against the read scope of every family it names.

An event type an endpoint can subscribe to.

SUBSCRIBING COSTS TWO GRANTS. write_webhooks reaches the endpoint routes themselves; each topic is then checked against its own family's read scope, so an endpoint receiving orders/paid needs read_orders as well. The 403 names the scope that is missing.

customers/created requires read_customers
customers/deleted requires read_customers
customers/updated requires read_customers
fulfillments/created requires read_fulfillment
fulfillments/updated requires read_fulfillment
inventory/updated requires read_inventory
orders/cancelled requires read_orders
orders/fulfilled requires read_orders
orders/paid requires read_orders
orders/refunded requires read_orders
products/created requires read_products
products/deleted requires read_products
products/updated requires read_products
reviews/created requires read_reviews
reviews/updated requires read_reviews

* subscribes to every topic listed above, including ones added after you subscribe, and therefore requires every read scope named here rather than the ones your key happens to hold.

A few events the platform dispatches internally sit outside this taxonomy and cannot be subscribed to with an API key. They are absent from this list rather than refused after you send them.

Available options:

*,

customers/created,

customers/deleted,

customers/updated,

fulfillments/created,

fulfillments/updated,

inventory/updated,

orders/cancelled,

orders/fulfilled,

orders/paid,

orders/refunded,

products/created,

products/deleted,

products/updated,

reviews/created,

reviews/updated

is_active

boolean

false stops deliveries and is REVERSIBLE, which is what this API offers instead of deleting. An endpoint the platform disabled itself after sustained failure reads back with auto_disabled_at set, so you can tell "the merchant turned this off" from "your receiver stopped answering".

Response

Success

data

object

Show child attributes

Overview

Endpoints

Update a webhook endpoint

Authorizations

Headers

Path Parameters

Body

Response