Vacation TrackerDeveloper Docs
REST API v2API referenceWebhooks

Update a webhook

This API method changes a webhook's url, events or description and returns the webhook with 200. Requires webhooks:write. Send only the fields you want to change; at least one field is required. Fields you do not send keep their current values.

  • events, when sent, replaces the full list. The same URL and event checks as on create apply.
  • Use POST /v2/webhooks/{id}/pause and POST /v2/webhooks/{id}/resume to change the status; status cannot be sent here.
  • The Idempotency-Key and X-On-Behalf-Of headers are ignored.

Errors: 400 VALIDATION_ERROR (details.fields), 400 INVALID_REQUEST_BODY, 400 WEBHOOK_URL_INVALID, 400 WEBHOOK_EVENTS_INVALID, 403 WEBHOOK_EVENTS_NOT_ALLOWED, 403 FORBIDDEN (the key owner no longer exists), 404 WEBHOOK_NOT_FOUND, and 409 WEBHOOK_REVOKED (the webhook is revoked and cannot be changed).

PATCH
/v2/webhooks/{id}

Authorization

bearerAuth webhooks:write
AuthorizationBearer <token>

API key sent as Authorization: Bearer vt_live_<secret>. See the Authentication and Scopes sections at the top of this document for how keys are created, which scopes exist and how the key owner's role limits them.

In: header

Scope: webhooks:write

Path Parameters

id*string

webhook ID.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PATCH "https://example.com/v2/webhooks/wh_3f1c2b9e-8a47-4d5e-9c61-2b7f0e4a1d93" \  -H "Content-Type: application/json" \  -d '{    "events": [      "leave.approved",      "leave.cancelled",      "leave.deleted"    ]  }'
{
  "data": {
    "webhookId": "wh_3f1c2b9e-8a47-4d5e-9c61-2b7f0e4a1d93",
    "url": "https://example.com/vacation-tracker/webhooks",
    "description": "Sync leaves to payroll",
    "events": [
      "leave.approved",
      "leave.cancelled"
    ],
    "status": "active",
    "pausedReason": null,
    "pausedAt": null,
    "revokedAt": null,
    "revocationReason": null,
    "ownerId": "user-63b17e97-d38b-4586-8498-bb4f5d2e2c14",
    "secretPrefix": "whsec_AbCd",
    "lastDelivery": {
      "deliveryId": "dlv_1790157600000_8a47c61e2b7f4d5e9c613f1c2b9e1d93",
      "eventName": "leave.approved",
      "status": "SUCCEEDED",
      "responseStatus": 200,
      "at": "2026-09-23T10:00:00.000Z"
    },
    "createdAt": "2026-09-01T08:00:00.000Z",
    "updatedAt": "2026-09-23T10:00:00.000Z"
  }
}
{
  "error": {
    "code": "VALIDATION_ERROR",
    "name": "ValidationError",
    "description": "A query parameter, body field or header failed validation.",
    "resolution": "Fix the fields listed in details.fields and send the request again.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef",
    "details": {
      "fields": [
        {
          "path": "startDate",
          "message": "\"startDate\" is required"
        }
      ]
    }
  }
}
{
  "error": {
    "code": "UNAUTHORIZED",
    "name": "Unauthorized",
    "description": "The API key is missing, malformed or not recognized.",
    "resolution": "Send a valid API key in the Authorization header as Bearer followed by the full vt_live_ key.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}

{
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "name": "InsufficientScope",
    "description": "The API key does not have the scopes this request needs.",
    "resolution": "Add the scopes listed in details.requiredScopes to the key in the Vacation Tracker dashboard.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef",
    "details": {
      "requiredScopes": [
        "leaves:write"
      ]
    }
  }
}

{
  "error": {
    "code": "WEBHOOK_NOT_FOUND",
    "name": "Webhook not found",
    "description": "The webhook was not found.",
    "resolution": "Check the webhook ID.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}
{
  "error": {
    "code": "WEBHOOK_REVOKED",
    "name": "Webhook revoked",
    "description": "The webhook has been revoked.",
    "resolution": "Delete the webhook and create a new one.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}
{
  "error": {
    "code": "RATE_LIMITED",
    "name": "RateLimited",
    "description": "Too many requests were sent in a short time.",
    "resolution": "Wait a few seconds and retry, using the same Idempotency-Key for writes.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}
{
  "error": {
    "code": "INTERNAL_ERROR",
    "name": "InternalError",
    "description": "Something went wrong on our side.",
    "resolution": "Retry later, and if it keeps happening, contact Vacation Tracker support and quote the requestId.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}

Need help?

developers@vacationtracker.io

Get a webhook

This API method returns a single webhook, including its last delivery. Requires webhooks:read. The signing secret is never returned here.

Delete a webhook

This API method deletes a webhook and returns 204. Requires webhooks:write. No request body. No more deliveries are sent to it, including pending retries. A revoked webhook can be deleted. The Idempotency-Key and X-On-Behalf-Of headers are ignored.