> ## Documentation Index > Fetch the complete documentation index at: https://docs.gateway.connexease.com/llms.txt > Use this file to discover all available pages before exploring further. # Update Webhook > Sets the webhook configuration for an application: the HTTPS URL the Gateway posts events to, the custom headers it attaches to each delivery, and which event types you are subscribed to. **Endpoint requirements.** Your endpoint must be reachable over HTTPS with a valid certificate and must answer HTTP 200 within 5 seconds. Do the real work asynchronously. **Clearing headers.** Send `headers: {}` to remove previously stored headers. **Tip.** Point the URL at a request-inspection service such as `webhook.site` while wiring things up, then switch it to your own endpoint. The change takes effect on the next event, with no redeploy on your side. ## OpenAPI ````yaml /public-openapi.json post /apps/{app_id}/webhook openapi: 3.0.3 info: title: Connexease Public API version: 1.0.0 description: >- Panel-independent API for managing WhatsApp Business operations from your own servers. Every endpoint is scoped to the organization resolved from your secret key. Read endpoints are uncached and proxy straight to the source. **On-premises installations** are served from your own domain with an extra `/public` segment: `https://{your_domain}/public/api/v1/...`. Authentication, bodies, responses, and error codes are identical. servers: - url: https://public-api.gateway.connexease.com/api/v1 description: Production security: - secretKey: [] tags: - name: Analytics description: Organization-wide message volume. - name: Application description: The WhatsApp business profile linked to an application. - name: Template description: >- The full template lifecycle: create, list, inspect, update, delete, and measure. - name: Media description: >- Uploads that produce the single-use handle for template headers and the profile picture. - name: Developers description: Webhook configuration and API keys. paths: /apps/{app_id}/webhook: post: tags: - Developers summary: Update Webhook description: >- Sets the webhook configuration for an application: the HTTPS URL the Gateway posts events to, the custom headers it attaches to each delivery, and which event types you are subscribed to. **Endpoint requirements.** Your endpoint must be reachable over HTTPS with a valid certificate and must answer HTTP 200 within 5 seconds. Do the real work asynchronously. **Clearing headers.** Send `headers: {}` to remove previously stored headers. **Tip.** Point the URL at a request-inspection service such as `webhook.site` while wiring things up, then switch it to your own endpoint. The change takes effect on the next event, with no redeploy on your side. operationId: updateWebhook parameters: - $ref: '#/components/parameters/AppId' requestBody: required: true content: application/json: schema: type: object required: - url properties: url: type: string format: uri description: >- The HTTPS endpoint that will receive events. Must be publicly reachable and serve a valid TLS certificate. headers: type: object additionalProperties: type: string description: >- Custom headers the Gateway attaches to every delivery. Free-form, so this is where an auth token, tenant ID, or WAF bypass header goes. Send `{}` to clear existing headers. Do not put credentials here that you would not want stored on the configuration. subscribedEvents: $ref: '#/components/schemas/SubscribedEvents' example: url: https://api.acme.com/connexease/webhook headers: X-Signature-Token: s3cr3t subscribedEvents: messages: true message_status: true message_template_status: false read: true account: false responses: '200': description: The stored configuration, read back after the write. content: application/json: schema: type: object properties: data: $ref: '#/components/schemas/WebhookConfiguration' isSuccess: type: boolean enum: - true '400': $ref: '#/components/responses/MalformedRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/AppNotFound' '422': $ref: '#/components/responses/ValidationFailed' components: parameters: AppId: name: app_id in: path required: true description: >- Application ID. Must belong to the organization resolved from your secret key, otherwise the request returns `404` with `APPLICATION_004`. schema: type: string example: app_7poyXj8GXuv76e schemas: SubscribedEvents: type: object description: >- Event name to boolean map. Events set to `false`, and events left out entirely, are not delivered. properties: messages: type: boolean description: A user sent a message to your WhatsApp number. message_status: type: boolean description: Outbound message status changed (sent, delivered, failed). read: type: boolean description: A user read your outbound message. message_template_status: type: boolean description: A template was approved, rejected, or paused. account: type: boolean description: Account or phone number update. additionalProperties: false WebhookConfiguration: type: object properties: id: type: string format: uuid description: UUID of the webhook configuration. url: type: string format: uri description: The HTTPS endpoint the Gateway posts events to. headers: type: object additionalProperties: type: string description: >- Custom headers sent with every delivery. Empty object when none are configured. subscribedEvents: $ref: '#/components/schemas/SubscribedEvents' isActive: type: boolean description: Whether deliveries are currently enabled. createdAt: type: string format: date-time updatedAt: type: string format: date-time ErrorEnvelope: type: object description: >- Every failure shares this shape. `description` already has any `params` interpolated into it. properties: isSuccess: type: boolean enum: - false errors: type: object properties: code: type: string description: >- `VAL_*`, `WA_*`, `META_*`, `APPLICATION_*`, `ORGANIZATION_SECRET_*`, `REQ_001`, or `SYS_001`. example: META_075 group: type: string enum: - VALIDATION - NOT_FOUND - CONFLICT - AUTHENTICATION - NOT_ALLOWED - LIMIT_EXCEEDED - SERVICE_UNAVAILABLE - SYSTEM description: type: string example: Template with 0000000000 not found in Meta. params: type: object additionalProperties: true description: >- Raw values interpolated into `description`. Present only on parametric messages. fields: type: object description: >- Field-level validation errors only. Field name (dot-joined for nested fields, list indices omitted) to its own `code` / `description` / `params`. additionalProperties: type: object properties: code: type: string description: type: string params: type: object additionalProperties: true required: - code - group - description required: - isSuccess - errors responses: MalformedRequest: description: >- Missing required field, unparseable number or UUID, or invalid JSON (`REQ_001`). Not a field-validation error — no `fields` map is returned, because the request could not be read well enough to validate it. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' Unauthorized: description: >- Secret key missing (`ORGANIZATION_SECRET_010`) or invalid (`ORGANIZATION_SECRET_011`). content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' AppNotFound: description: '`app_id` does not belong to the organization (`APPLICATION_004`).' content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' ValidationFailed: description: >- Field validation failed. Top-level code is `VAL_000`; each offending field is listed under `errors.fields`. content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' securitySchemes: secretKey: type: http scheme: bearer description: >- Secret key in `Bearer sk_...` format. Server-to-server only — never embed it in a browser or mobile client. The organization is resolved from the key, so `organization_id` is never passed explicitly. ````