Skip to main content
PUT

Update Webhook Integration

Modify an existing webhook integration’s URL, secret, headers, or status.

Authentication & Scope

This endpoint requires a Personal Access Token with the manage-integrations ability.

Request

number
required
The ID of the form containing the webhook.
number
required
The ID of the webhook integration to update.
string
required
Must be set to "webhook".
string
The status of the webhook. Allowed values: "active", "inactive".
object
required
Configuration object containing webhook details. All fields are optional.
object
Update the conditional logic for webhook triggering.

Response

200 OK – Webhook updated successfully.
403 Forbidden – The token does not have manage-integrations ability or insufficient form permissions. 404 Not Found – Form or integration not found. 422 Unprocessable Entity – Validation error.

Security

Webhook URLs are validated when they are saved and again before each delivery. OpnForm does not follow webhook redirects, and private network destinations are blocked unless the instance operator explicitly enables private webhook URLs for a self-hosted deployment.

Secret Rotation

When updating the webhook_secret, the new secret will be used for all future webhook requests. Existing webhook attempts with the old secret will fail validation on the receiver’s end. If you need to rotate your secret, consider implementing a grace period on your receiving endpoint to accept both old and new secrets during the transition.

Blocked Headers

For security reasons, the following headers cannot be customized in webhook_headers:
  • Authorization
  • X-Webhook-Signature
  • Content-Type
  • Content-Length
  • Host
  • Cookie
  • X-CSRF-Token
  • X-Forwarded-For
  • X-Forwarded-Proto
  • X-Real-IP
For signature validation implementation examples, see Validating Webhook Signatures.

Authorizations

Authorization
string
header
required

Personal Access Token

Path Parameters

form
number
required

The ID of the form.

integrationid
number
required

The ID of the integration.

Body

application/json
integration_id
enum<string>
required

Must be "webhook"

Available options:
webhook
data
object
required
status
enum<string>

The status of the webhook

Available options:
active,
inactive

Response

Webhook updated successfully

message
string
Example:

"Form Integration was updated."

form_integration
object