> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dmly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Update a webhook endpoint.

> Updates the endpoint. Uses the same validation as create, so `name`, `url` and `events` must all be supplied (it is a full replace, not a partial patch); `active` is optional and left unchanged when omitted. Returns the updated webhook card (without the secret).



## OpenAPI

````yaml /api-reference/agency-openapi.json patch /webhooks/{webhook}
openapi: 3.1.0
info:
  title: DMLY Agency API
  version: 1.0.0
  description: >-
    The DMLY Agency API lets a whitelabel reseller manage its sub-accounts

    programmatically — provision customer workspaces, assign plans and add-ons,
    and

    subscribe to sub-account lifecycle events. It is a separate surface from the

    public workspace [REST API](/api-reference/introduction): a different base
    URL, a

    different key, and a different set of webhooks.


    ## Base URL


    ```

    https://dash.dmly.io/api/agency/v1

    ```


    ## Authentication


    Every request carries an **agency API key**, which authenticates the acting
    agency

    and scopes every request to that agency's own sub-accounts — an agency can
    only

    ever see and act on its own workspaces.


    ```

    x-api-key: dmly_ag_xxxxxxxx…

    ```


    `Authorization: Bearer dmly_ag_xxxxxxxx…` is also accepted.


    Mint and revoke keys from the agency console under **API Keys**. The
    plaintext key

    is shown **once** on creation; only its hash is stored. An agency key is
    different

    from a workspace API key (`dmly_…`) and is not interchangeable with it.


    ## Conventions


    - Sub-accounts, plans, add-ons and webhook endpoints are identified by their
      public `uuid`, returned as `uuid`.
    - Lists are paginated with `?per_page` (alias `?limit`) — default 25, hard
    cap 100.


    ## Availability


    The whole surface can be disabled fleet-wide during an incident without
    revoking

    individual keys; while it is off, every endpoint returns `503`.
  contact:
    name: DMLY
    url: https://dmly.io
servers:
  - url: https://dash.dmly.io/api/agency/v1
    description: DMLY
security:
  - agencyApiKeyAuth: []
  - agencyBearerAuth: []
tags:
  - name: Agency Plans
    description: Endpoints for Agency Plans.
  - name: Agency Subscriptions and add-ons
    description: Endpoints for Agency Subscriptions and add-ons.
  - name: Agency Webhook endpoints
    description: Endpoints for Agency Webhook endpoints.
  - name: Agency Workspaces
    description: Endpoints for Agency Workspaces.
  - name: Agency events
    description: Sub-account lifecycle events DMLY posts to your endpoint.
paths:
  /webhooks/{webhook}:
    patch:
      tags:
        - Agency Webhook endpoints
      summary: Update a webhook endpoint.
      description: >-
        Updates the endpoint. Uses the same validation as create, so `name`,
        `url` and `events` must all be supplied (it is a full replace, not a
        partial patch); `active` is optional and left unchanged when omitted.
        Returns the updated webhook card (without the secret).
      operationId: webhooks.update.patch
      parameters:
        - name: webhook
          in: path
          required: true
          description: Webhook id.
          schema:
            type: string
            format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                url:
                  type: string
                  format: uri
                events:
                  type: array
                  items:
                    type: string
                active:
                  type: boolean
            example:
              name: Production v2
              url: https://example.com/hooks/dmly
              events:
                - workspace.created
              active: false
      responses:
        '200':
          description: Success.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/ValidationError'
        '429':
          $ref: '#/components/responses/RateLimited'
        '503':
          $ref: '#/components/responses/Unavailable'
components:
  responses:
    Unauthorized:
      description: The agency API key is missing or invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: This agency has been suspended, so its keys no longer work.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: >-
        No such resource for this agency — the uuid is unknown or belongs to
        another agency.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ValidationError:
      description: Validation failed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationError'
    RateLimited:
      description: >-
        Rate limit exceeded: 120 requests per minute per agency key. Requests
        without a valid key share a per-IP budget of 60 per minute instead.
      headers:
        Retry-After:
          description: Seconds until the limit resets.
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unavailable:
      description: The reseller API is currently disabled fleet-wide.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    Error:
      type: object
      properties:
        message:
          type: string
    ValidationError:
      type: object
      properties:
        message:
          type: string
        errors:
          type: object
          description: Field name → array of messages.
          additionalProperties:
            type: array
            items:
              type: string
  securitySchemes:
    agencyApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        Your agency API key (`dmly_ag_…`). It authenticates the acting agency
        and scopes every request to that agency's own sub-accounts and plans.
    agencyBearerAuth:
      type: http
      scheme: bearer
      description: 'The same agency API key, sent as `Authorization: Bearer dmly_ag_…`.'

````