--- title: Update a webhook subscription — PATCH /api/v1/webhook_subscriptions/{id} description: Partial update of url, event_filter and active; omitted keys keep their value. PUT /webhook_subscriptions/{id} is accepted as an alias with the same… canonical_url: "https://cascades.crscreditapi.com/docs/api/webhooks/update-webhook-subscription" doc_version: "1.0.0" last_updated: "2026-10-09T18:04:24Z" source: "public/api-docs/v1/swagger.yaml#updateWebhookSubscription" --- # Update a webhook subscription — PATCH /api/v1/webhook_subscriptions/{id} `PATCH https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/{id}` - Operation id: `updateWebhookSubscription` - Scopes: `webhooks:write` - Idempotent: no - OpenAPI: https://cascades.crscreditapi.com/openapi.json · https://cascades.crscreditapi.com/openapi.yaml (operationId `updateWebhookSubscription`) Partial update of `url`, `event_filter` and `active`; omitted keys keep their value. `PUT /webhook_subscriptions/{id}` is accepted as an alias with the same partial semantics. The response never includes the `signing_secret`. Requires `webhooks:write`. ## Path parameters | Name | Type | Required | Description | |---|---|---|---| | `id` | integer | yes | Webhook subscription id. Scoped to the calling api_client. | ## Request body `application/json` — `WebhookSubscriptionUpdateRequest` | Field | Type | Required | Description | |---|---|---|---| | `url` | string (uri) | no | | | `event_filter` | array of WebhookEventName | no | | | `active` | boolean | no | | ```json { "event_filter": [ "adverse_action.completed" ] } ``` ## Responses ### 200 — Updated (no signing_secret) `application/json` | Field | Type | Required | Description | |---|---|---|---| | `data` | WebhookSubscription | no | | |   `id` | integer | no | | |   `object` | string | no | | |   `url` | string | no | | |   `event_filter` | array of WebhookEventName | no | Empty = subscribed to ALL events. | |   `active` | boolean | no | | |   `last_delivered_at` | string (date-time), nullable | no | | |   `created_at` | string (date-time) | no | | |   `updated_at` | string (date-time) | no | | | `meta` | Meta | no | | |   `request_id` | string | yes | Correlation id for this request. Also sent as the `X-Request-Id` response header; quote it when contacting support. | ```json { "data": { "id": 1, "object": "webhook_subscription", "url": "https://hooks.partner.example/cascades", "event_filter": [ "execution.completed" ], "active": true, "last_delivered_at": "2026-05-08T18:41:05Z", "created_at": "2026-05-08T18:41:05Z", "updated_at": "2026-05-08T18:41:05Z" }, "meta": { "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f" } } ``` ### 401 — Missing, malformed, expired or revoked bearer token. The `WWW-Authenticate` header carries the RFC 6750 challenge. `application/json` — `ErrorEnvelope` ```json { "error": { "code": "unauthorized", "message": "A valid bearer token is required.", "details": [], "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f", "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/unauthorized" } } ``` ### 403 — Token does not hold the required scope. `details` lists the scope(s) that were checked. `application/json` — `ErrorEnvelope` ```json { "error": { "code": "insufficient_scope", "message": "This token does not have the required scope.", "details": [ { "field": "scope", "message": "executions:write" } ], "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f", "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/insufficient_scope" } } ``` ### 404 — Resource does not exist or belongs to another tenant / api_client `application/json` — `ErrorEnvelope` ```json { "error": { "code": "not_found", "message": "The requested resource was not found.", "details": [], "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f", "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/not_found" } } ``` ### 422 — Request body or params failed validation `application/json` — `ErrorEnvelope` ```json { "error": { "code": "validation_failed", "message": "The request could not be processed.", "details": [ { "field": "execution_mode", "message": "must be test or live" } ], "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f", "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/validation_failed" } } ``` ### 429 — Rate limit exceeded (60 req/min per IP on `/api/v1`, 600 req/hour per token prefix, or 300 req/5 min per IP globally). The body is the standard error envelope and `Retry-After` gives the seconds until the window resets. `application/json` — `ErrorEnvelope` ```json { "error": { "code": "rate_limited", "message": "Rate limit exceeded. Retry later.", "details": [], "request_id": "7d4c2f48-9a1b-4c3d-8e2f-1a2b3c4d5e6f", "doc_url": "https://cascades.crscreditapi.com/docs/api/errors/rate_limited" } } ``` ## Code samples ### cURL ```shell curl -X PATCH "https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/12" \ -H "Authorization: Bearer {{API_KEY}}" \ -H "Content-Type: application/json" \ -d '{ "event_filter": [ "adverse_action.completed" ] }' ``` ### Node.js ```javascript const response = await fetch("https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/12", { method: "PATCH", headers: { "Authorization": "Bearer {{API_KEY}}", "Content-Type": "application/json" }, body: JSON.stringify({ "event_filter": [ "adverse_action.completed" ] }) }); const { data, meta } = await response.json(); console.log(response.status, data, meta.request_id); ``` ### Python ```python import requests response = requests.patch( "https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/12", headers={ "Authorization": "Bearer {{API_KEY}}", }, json={ "event_filter": [ "adverse_action.completed" ] }, ) response.raise_for_status() payload = response.json() print(payload["data"], payload["meta"]["request_id"]) ``` ### Ruby ```ruby require "net/http" require "json" uri = URI("https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/12") request = Net::HTTP::Patch.new(uri) request["Authorization"] = "Bearer {{API_KEY}}" request["Content-Type"] = "application/json" request.body = <<~JSON { "event_filter": [ "adverse_action.completed" ] } JSON response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |http| http.request(request) end payload = JSON.parse(response.body) puts payload["data"], payload.dig("meta", "request_id") ``` ### Go ```go package main import ( "bytes" "fmt" "io" "net/http" ) func main() { body := []byte(`{ "event_filter": [ "adverse_action.completed" ] }`) req, err := http.NewRequest("PATCH", "https://cascades.crscreditapi.com/api/v1/webhook_subscriptions/12", bytes.NewBuffer(body)) if err != nil { panic(err) } req.Header.Set("Authorization", "Bearer {{API_KEY}}") req.Header.Set("Content-Type", "application/json") resp, err := http.DefaultClient.Do(req) if err != nil { panic(err) } defer resp.Body.Close() out, _ := io.ReadAll(resp.Body) fmt.Println(resp.StatusCode, string(out)) } ``` ### Agent ```shell claude mcp add cascades \ -e CASCADES_API_KEY={{API_KEY}} \ -e CASCADES_PROD_BASE_URL=https://cascades.crscreditapi.com \ -- npx -y @crscreditapi/cascades-mcp-server # Then ask your assistant: # "Update a webhook subscription 12 using the Cascades API." # No MCP tool covers this endpoint yet; the assistant can call PATCH /webhook_subscriptions/{id} with curl. ``` ## Related - [Webhooks](https://cascades.crscreditapi.com/docs/concepts/webhooks) ## Sitemap See the full [sitemap](https://cascades.crscreditapi.com/sitemap.md) for all pages.