# Update a webhook subscription (https://terac.com/docs/developers/reference/patchWebhookSubscription)

`PATCH https://terac.com/api/external/v2/hooks/subscriptions/{subscriptionId}`

Updates a webhook subscription's target URL, event types or enabled state, and returns it unchanged when the body sets none. event_types replaces the current list rather than adding to it. Changing target_url clears the confirmation, since the new host has not accepted a ping yet. Set is_enabled true to recover a subscription Terac disabled after sustained failure.

## Authorization

Requires a Bearer token via the `Authorization` header.

```
Authorization: Bearer <token>
```

## Path Parameters

- `subscriptionId` (string) **(required)**: ID of the webhook subscription, as returned when it was created or listed.

## Request Body (required)

`Content-Type: application/json`

- `target_url` (string): A new public https URL for this subscription. Private, loopback, link-local and internal addresses are refused. Changing it clears the confirmation, so confirm again before it receives events.
- `event_types` (array): Replaces the current list rather than adding to it.
  - values: `submission.status.change`, `submission.approved`
- `is_enabled` (boolean): Set true to re-enable a subscription Terac disabled after sustained failure.

## Responses

### 200: The subscription as stored after the update.

- `id` (string) **(required)**
- `target_url` (string) **(required)**
- `event_types` (array) **(required)**: Every event type this endpoint receives. PATCH replaces the whole list.
  - values: `submission.status.change`, `submission.approved`
- `is_enabled` (boolean) **(required)**
- `confirmed_at` (string, nullable) **(required)**: When this subscription passed the confirmation ping. Null means it receives nothing yet.
- `disabled_at` (string, nullable) **(required)**
- `disabled_reason` (string, nullable) **(required)**: Set when Terac disabled the subscription rather than you, after sustained delivery failure.
- `created_at` (string) **(required)**
- `updated_at` (string) **(required)**
### 400: Invalid input data

- `message` (string) **(required)**: The error message
- `code` (string) **(required)**: The error code
- `issues` (array): An array of issues that were responsible for the error
  - `message` (string) **(required)**
### 401: The API key is missing, invalid, disabled, expired or revoked, its owner no longer exists, or it is not linked to an organization. The body is nested under `error`.

- `error` (object) **(required)**
  - `code` (string) **(required)**: one of: `UNAUTHORIZED`: The error code.
  - `message` (string) **(required)**: What went wrong.
### 403: Either the account that owns the API key is banned or deleted (from the key check, nested under `error`), or the key's owner lacks the organization permission this operation needs (from the operation, with `code` and `message` at the top level).

- One of: API key error (403)
  - `error` (object) **(required)**
    - `code` (string) **(required)**: one of: `FORBIDDEN`: The error code.
    - `message` (string) **(required)**: What went wrong.
- One of: Insufficient access error (403)
  - `message` (string) **(required)**: The error message
  - `code` (string) **(required)**: The error code
  - `issues` (array): An array of issues that were responsible for the error
    - `message` (string) **(required)**
### 404: Not found

- `message` (string) **(required)**: The error message
- `code` (string) **(required)**: The error code
- `issues` (array): An array of issues that were responsible for the error
  - `message` (string) **(required)**
### 429: The API key is rate limited. A key accepts 100 requests, then refuses every request until more than 60 seconds pass with no accepted request; refused requests do not extend the wait. Wait the number of seconds in `Retry-After`, then retry. The body is nested under `error`.

- `error` (object) **(required)**
  - `code` (string) **(required)**: one of: `RATE_LIMITED`: The error code.
  - `message` (string) **(required)**: What went wrong.
### 500: Internal server error

- `message` (string) **(required)**: The error message
- `code` (string) **(required)**: The error code
- `issues` (array): An array of issues that were responsible for the error
  - `message` (string) **(required)**