> ## Documentation Index
> Fetch the complete documentation index at: https://arize-ax.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Update a webhook

> Update a webhook by its ID. At least one field must be provided.

**Payload Requirements**
- At least one of `name`, `description`, `url`, `auth_token`,
  `timeout_ms`, or `headers` must be provided.
- If `name` is provided, it must be unique within the organization
  (409 on conflict).
- `headers` replaces the whole header map.
- `auth_type` cannot be changed after creation, and the signing secret
  of an `HMAC_SHA256` webhook cannot be rotated — create a new webhook
  instead.
- System-managed fields (`id`, `created_at`, `updated_at`) cannot be
  modified.

<Warning>This endpoint is in alpha, read more [here](https://arize.com/docs/ax/rest-reference#api-version-stages).</Warning>




## OpenAPI

````yaml https://api.arize.com/v2/spec.yaml patch /v2/webhooks/{webhook_id}
openapi: 3.0.3
info:
  title: Arize REST API
  version: 2.0.0
  description: |
    API specification for the backend data server. The API is hosted globally
    at https://api.arize.com/v2 or in your own environment.
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
  - description: Global
    url: https://api.arize.com
  - description: Regional
    url: https://api.{region}.arize.com
    variables:
      region:
        default: eu-west-1a
        enum:
          - eu-west-1a
          - ca-central-1a
  - description: Custom Host
    url: https://{host}
    variables:
      host:
        default: api.arize.com
security:
  - bearerAuth: []
tags:
  - name: AI Integrations
    description: |
      AI integrations configure access to external LLM providers (e.g. OpenAI,
      Azure OpenAI, AWS Bedrock, Vertex AI). Integrations can be scoped to the
      entire account, a specific organization, or a specific space.
  - name: Annotation Configs
    description: >
      Annotation configs allow you to define consistent annotation schemas that

      can be reused across your workspace, ensuring evaluations are structured
      and

      comparable over time.
  - name: Annotation Queues
    description: >
      Annotation queues help you organize and manage human evaluation workflows.

      Use queues to assign spans or examples to annotators for review and
      labeling.
  - name: API Keys
    description: >
      API keys are used to authenticate requests to the Arize API. List your
      keys

      to view metadata; the raw secret is never returned after creation.
  - name: Audit Logs
    description: >
      Audit logs record authenticated user actions within an account, providing
      a

      chronological trail for security and compliance review. Access requires

      account admin privileges and audit logging to be enabled.
  - name: Datasets
    description: |
      Datasets are structured, version-controlled example collections you use to
      run, evaluate, and track LLM experiments.
  - name: Evaluators
    description: >
      Evaluators are reusable evaluation configurations used to assess the
      quality

      of LLM outputs. They can be template-based (using LLM judges) or
      code-based.
  - name: Experiments
    description: >
      Experiments let you systematically test prompt/model changes using
      datasets,

      tasks, and evaluators.
  - name: Integrations
    description: >
      Integrations configure access to external LLM providers (e.g. OpenAI,

      Azure OpenAI, AWS Bedrock, Vertex AI), notifications services (e.g.
      PagerDuty, Slack), and

      your own agents. Integrations can be scoped to the entire account, a
      specific

      organization, or a specific space.
  - name: Monitors
    description: >
      Monitors continuously track a metric over your model or LLM application
      data

      and alert you when it crosses a threshold. Each monitor watches a single

      metric - data quality, model performance, drift, a custom metric, or a

      tracing metric - and moves between statuses as the metric passes in and
      out of its 

      healthy range.
  - name: Organizations
    description: >
      Organizations are top-level containers within an Arize AX account for
      grouping spaces.
  - name: Projects
    description: |
      Projects represent LLM applications being monitored in Arize where you can
      observe traces and spans.
  - name: Prompts
    description: >
      Prompts are reusable, versioned templates for LLM interactions. Use
      prompts

      to standardize and manage how you interact with LLMs across your
      application.
  - name: Resource Restrictions
    description: |
      Endpoints for restricting and unrestricting resources (projects, models).
  - name: Role Bindings
    description: |
      Role bindings assign a role to a user on a resource. REST currently
      supports space- and project-scoped bindings.
  - name: Roles
    description: >
      Roles define sets of permissions that can be assigned to users within an

      account. Create custom roles to tailor access control to your team's
      needs.
  - name: Spaces
    description: >
      Spaces are containers within an organization for grouping related
      projects,

      datasets, and experiments, enabling collaboration or isolated
      experimentation

      with role-based access control.
  - name: Spans
    description: |
      Spans represent individual operations within a trace. A span captures the
      timing, status, and attributes of a single operation in your application.
  - name: Tasks
    description: |
      Tasks are configurable units of work that tie one or more evaluators to a
      data source (project or dataset). Use tasks to automate evaluation of LLM
      outputs, with support for continuous evaluation and backfill runs.
  - name: Traces
    description: |
      A trace is the collection of spans sharing a trace ID, representing a
      single end-to-end request through an LLM application. Use the Traces
      endpoint to retrieve traces with all of their spans in one call.
  - name: Users
    description: >
      Users represent members of an account. The Users endpoints allow creating,

      listing, updating (display name), and removing users from the account
      programmatically.
  - name: Webhooks
    description: >
      Webhooks are organization-owned destinations that receive event deliveries

      over HTTPS. Deliveries are authenticated with a bearer token or signed
      with

      an HMAC signing secret — the secret is returned exactly once, when the

      webhook is created. Delivery attempts are recorded and can be listed for

      debugging. To choose which events a webhook receives, manage its

      subscriptions through the prompt and evaluator webhook-subscription

      endpoints.
paths:
  /v2/webhooks/{webhook_id}:
    patch:
      tags:
        - Webhooks
      summary: Update a webhook
      description: >
        Update a webhook by its ID. At least one field must be provided.


        **Payload Requirements**

        - At least one of `name`, `description`, `url`, `auth_token`,
          `timeout_ms`, or `headers` must be provided.
        - If `name` is provided, it must be unique within the organization
          (409 on conflict).
        - `headers` replaces the whole header map.

        - `auth_type` cannot be changed after creation, and the signing secret
          of an `HMAC_SHA256` webhook cannot be rotated — create a new webhook
          instead.
        - System-managed fields (`id`, `created_at`, `updated_at`) cannot be
          modified.

        <Warning>This endpoint is in alpha, read more
        [here](https://arize.com/docs/ax/rest-reference#api-version-stages).</Warning>
      operationId: update_webhook
      parameters:
        - $ref: '#/components/parameters/WebhookIdPathParam'
      requestBody:
        $ref: '#/components/requestBodies/UpdateWebhookRequestBody'
      responses:
        '200':
          $ref: '#/components/responses/Webhook'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/RateLimitExceeded'
components:
  parameters:
    WebhookIdPathParam:
      name: webhook_id
      in: path
      description: The unique webhook identifier (base64)
      required: true
      schema:
        $ref: '#/components/schemas/Id'
      example: V2ViaG9vazoxMjM0NQ==
  requestBodies:
    UpdateWebhookRequestBody:
      description: >-
        Body containing webhook update parameters. At least one field must be
        provided.
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/UpdateWebhookRequest'
          example:
            name: Prompt release notifications (staging)
            timeout_ms: 10000
  responses:
    Webhook:
      description: A webhook object
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Webhook'
          example:
            id: V2ViaG9vazoxMjM0NQ==
            organization_id: T3JnYW5pemF0aW9uOjEyMzQ1
            name: Prompt release notifications
            description: Notifies the deploy pipeline when a prompt version is labeled
            url: https://example.com/hooks/arize
            auth_type: HMAC_SHA256
            signing_secret_hint: whsec_…abcd
            timeout_ms: 30000
            headers:
              X-Environment: production
            created_at: '2026-08-01T12:00:00Z'
            updated_at: '2026-08-01T12:00:00Z'
            created_by_user_id: VXNlcjoxMjM0NQ==
    BadRequest:
      description: Invalid request
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 400
            title: Invalid request parameters
            detail: The 'name' field is required and must be a non-empty string.
            instance: /resource
            type: https://arize.com/docs/ax/rest-reference/errors#invalid-request
    Unauthorized:
      description: Authentication is required
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 401
            title: Authentication required
            detail: You must be authenticated to access this resource.
            instance: /resource
            type: >-
              https://arize.com/docs/ax/rest-reference/errors#authentication-required
    Forbidden:
      description: Insufficient permissions to access this resource
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 403
            title: Access forbidden
            detail: You do not have permission to access this resource.
            instance: /resource/12345
            type: https://arize.com/docs/ax/rest-reference/errors#access-forbidden
    NotFound:
      description: Not found
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 404
            title: Resource not found
            detail: The requested resource with ID '12345' was not found.
            instance: /resource/12345
            type: https://arize.com/docs/ax/rest-reference/errors#resource-not-found
    Conflict:
      description: Resource conflict
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 409
            title: Resource conflict
            detail: A resource with the given identifier already exists.
            instance: /resource
            type: https://arize.com/docs/ax/rest-reference/errors#resource-conflict
    UnprocessableEntity:
      description: Unprocessable entity
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 422
            title: Unprocessable Entity
            detail: One or more fields failed validation.
            instance: /resource/12345
            type: >-
              https://arize.com/docs/ax/rest-reference/errors#unprocessable-entity
    RateLimitExceeded:
      description: Rate limit exceeded
      headers:
        Retry-After:
          description: |
            When throttled (429), how long to wait before retrying. Value is
            either a delta-seconds integer.
          schema:
            type: integer
            minimum: 0
          example: 42
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
          example:
            status: 429
            title: Rate limit exceeded
            detail: >-
              You have exceeded the allowed number of requests. Please try again
              later.
            instance: /resource
            type: >-
              https://arize.com/docs/ax/rest-reference/errors#rate-limit-exceeded
  schemas:
    Id:
      type: string
      description: A universally unique identifier (base64-encoded opaque string).
      example: RW50aXR5OjEyMzQ1
    UpdateWebhookRequest:
      type: object
      minProperties: 1
      properties:
        name:
          type: string
          maxLength: 255
          description: Updated name of the webhook (must be unique within the organization)
        description:
          type: string
          nullable: true
          description: Updated description of the webhook. Set to `null` to clear it.
        url:
          type: string
          format: uri
          description: Updated HTTPS endpoint events are delivered to
        auth_token:
          type: string
          description: |
            Replacement `Authorization` header value sent with each delivery
            request, e.g. `Bearer my-token`. Sent verbatim — include the
            `Bearer ` prefix if your endpoint expects one. Only valid when the
            webhook's `auth_type` is `BEARER`. Write-only: never returned in any
            response.
        timeout_ms:
          type: integer
          minimum: 1000
          maximum: 60000
          description: Updated delivery timeout in milliseconds
        headers:
          type: object
          maxProperties: 20
          additionalProperties:
            type: string
          description: |
            Replacement custom HTTP headers, as a map of at most 20 header names
            to values. Replaces the whole header map; headers not included are
            removed.
      additionalProperties: false
    Webhook:
      type: object
      required:
        - id
        - organization_id
        - name
        - description
        - url
        - auth_type
        - timeout_ms
        - headers
        - created_at
        - updated_at
      properties:
        id:
          allOf:
            - $ref: '#/components/schemas/Id'
          description: Unique identifier for the webhook
        organization_id:
          allOf:
            - $ref: '#/components/schemas/Id'
          description: The unique identifier of the organization that owns the webhook
        name:
          type: string
          maxLength: 255
          description: Name of the webhook (unique within the organization)
        description:
          type: string
          description: >-
            A brief description of the webhook's purpose. Defaults to an empty
            string.
        url:
          type: string
          format: uri
          description: The HTTPS endpoint events are delivered to
        auth_type:
          allOf:
            - $ref: '#/components/schemas/WebhookAuthType'
          description: >-
            How deliveries from this webhook are authenticated. Fixed at
            creation.
        signing_secret_hint:
          type: string
          description: |
            Redacted hint of the signing secret (e.g. `whsec_…abcd`), useful for
            identifying which secret the webhook uses. Present only for
            `HMAC_SHA256` webhooks. The full secret is returned exactly once, in
            the create response, and cannot be retrieved afterwards.
        timeout_ms:
          type: integer
          minimum: 1000
          maximum: 60000
          description: >-
            How long a delivery request may run before it is abandoned, in
            milliseconds. Defaults to 30000.
        headers:
          type: object
          maxProperties: 20
          additionalProperties:
            type: string
          description: Custom HTTP headers sent with each delivery request
        created_at:
          type: string
          format: date-time
          description: Timestamp for when the webhook was created
        updated_at:
          type: string
          format: date-time
          description: Timestamp for when the webhook was last updated
        created_by_user_id:
          allOf:
            - $ref: '#/components/schemas/Id'
          description: >-
            The unique identifier of the user who created the webhook. Absent
            when that user has since been removed from the account.
      description: >
        A webhook is an organization-owned destination that receives event

        deliveries over HTTPS. Attach a webhook to prompts and evaluators
        through

        their webhook-subscription endpoints to choose which events it receives.


        Credentials are write-only: the bearer token is never returned, and the

        HMAC signing secret is returned exactly once, in the create response —

        only its redacted hint is readable afterwards.
      additionalProperties: false
      x-forward-compatible: true
    Problem:
      type: object
      description: RFC 9457 Problem Details
      properties:
        title:
          type: string
          description: A short, human-readable summary of the problem type
        status:
          type: integer
          description: >-
            The HTTP status code generated by the origin server for this
            occurrence of the problem
        type:
          type: string
          format: uri-reference
          description: A URI reference that identifies the problem type
        detail:
          type: string
          description: >-
            A human-readable explanation specific to this occurrence of the
            problem
        instance:
          type: string
          format: uri-reference
          description: >-
            A URI reference that identifies the specific occurrence of the
            problem
      required:
        - title
        - status
      additionalProperties: false
      x-forward-compatible: true
    WebhookAuthType:
      type: string
      enum:
        - BEARER
        - HMAC_SHA256
      description: |
        How deliveries from this webhook are authenticated.
        - `BEARER`: the stored `auth_token` is sent verbatim as the
          `Authorization` header of each delivery request.
        - `HMAC_SHA256`: each delivery is signed with the webhook's signing
          secret. The `X-Arize-Webhook-Signature` header carries
          `v1=<hex-encoded HMAC-SHA256>` computed over
          `<timestamp>.<raw request body>`, where `<timestamp>` is the
          Unix-seconds value from the `X-Arize-Webhook-Timestamp` header and the
          raw body is the exact bytes received. Deliveries also carry
          `X-Arize-Webhook-Id` (event identifier) and `X-Arize-Webhook-Event`
          (event type). To verify, recompute the HMAC over the received
          timestamp and raw body with your stored secret and compare it to the
          signature.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: <api-key>
      description: >
        Most Arize AI endpoints require authentication. For those endpoints that
        require authentication, include your API key in the request header using
        the format

        ``` Authorization: Bearer <api-key>

        ```

````