webhooks.update

Update a webhook in place.

Prerequisites

A Curviate API key, passed as apiKey when you construct the client. Quickstart shows how to create one.

Signature

update(id: string, body: WebhookUpdateBody): Promise<WebhookUpdateResult>

Example

import { Curviate } from "@curviate/sdk";
 
const curviate = new Curviate({
  apiKey: "cvt_live_...",
  baseUrl: "https://api.curviate.com",
});
 
const result = await curviate.webhooks.update("YOUR_ID", { events: [] });
console.log(result.id);

Parameters

Name	Type	Required	Description
`id`	`string`	Yes	Webhook id (wh_-prefixed ULID).
`events`	`array`	No	Replace the subscribed events (whole-array). Every event must be a canonical event whose source matches the webhook's source.
`request_url`	`string`	No	Replace the delivery URL. Must be a publicly reachable https host on the default https port.
`name`	`string`	No	Replace the human-readable name (1-100 chars), or null to clear it.
`enabled`	`boolean`	No	Enable or disable the webhook. A disabled webhook delivers nothing. Disabling is a stop, not a pause: it takes effect immediately, including for retries that were already queued, and those attempts are abandoned rather than deferred, so re-enabling delivers new events instead of replaying the ones that were dropped.
`headers`	`array`	No	Replace the custom headers added to each delivery POST (whole-array). Names must be valid HTTP header names and values must be printable ASCII (no line breaks or control characters). Reserved names are rejected at registration; they include Content-Type, User-Agent, Host, any Curviate-* or Sec-* name, and the hop-by-hop headers. At most 10 headers, 1024 characters per value, 4096 bytes in total. Custom headers are not covered by the delivery signature, so treat them as a hint, not as proof of origin. Values are encrypted at rest and are never returned by a read. A read shows the header name plus a 8-character keyed fingerprint of the value, which carries no part of the value and no indication of its length. It is deterministic within your account, so a fingerprint confirms a rotation took effect and tells you whether two of your webhooks carry the same credential; fingerprints are not comparable across accounts. The header name is what identifies which credential is configured.
`data`	`array`	No	Replace the field-remapping keys for the delivery payload (whole-array).
`account_ids`	`array`	No	Replace the targeted accounts (whole-array, each an acc_ id you own), or null to cover every current and future account (account_status webhooks only).
`motion_ids`	`array`	No	Only deliver events whose data.motion_id is one of these Motions (mot_ ids you own, up to 100). Events that carry no Motion are then not delivered. Replaces the whole list; null removes the filter.

Returns

Resolves to WebhookUpdateResult. Top-level fields: object, id, source, request_url, name, account_ids, motion_ids, enabled, headers, events, data, secret_prefix, created_at, safety_warning.

Error codes

Code	What it means, and what to do
`UNAUTHORIZED`	The API key is missing, malformed, or revoked. Check the key you passed to the client.
`INVALID_REQUEST`	A parameter failed validation. The message names the offending field; fix the request rather than retrying it.
`RATE_LIMIT_ACCOUNT`	This account's own quota is exhausted. Wait for the window in the `Retry-After` header, then retry.
`RATE_LIMIT_TENANT`	The tenant-wide quota is exhausted across all accounts. Slow the whole workload, not just this call.
`PLATFORM_RATE_LIMIT`	LinkedIn is throttling this account. Back off well beyond the hinted delay; sustained pressure risks the account.
`PLATFORM_ERROR`	An upstream failure, usually transient: retry once with backoff before treating it as a real error. Check the response first, though. When it carries `retry_likely_to_succeed: false` and `retry_hint: {kind: "never"}`, retrying cannot help and backing off only delays the real answer.
`PAYLOAD_TOO_LARGE`	Three limits can trigger this. The platform's own ceiling on total request size is the lowest and the one you are most likely to hit: it starts rejecting at roughly 1 MB, so a handful of photo-sized images is refused even though it clears everything below. Above that, this API caps one attachment at 5 MiB of file content and the whole request body at 9 MiB. Attachments travel base64-encoded, which inflates them by about a third, so a 5 MiB file costs roughly 6.7 MiB of the body budget. Send fewer or smaller attachments; retrying unchanged will not help.
`PAYMENT_REQUIRED`	The workspace has no active subscription, or its subscription is past due. Subscribe, or update the payment method, then retry.
`RESOURCE_NOT_FOUND`	The id in the path does not exist, or is not visible to this account. Re-read it from the list endpoint that produced it.

Every code above is a stable CurviateError.code you can branch on. The full list, the response envelope, and retry semantics are in the Error codes reference.

Next steps

webhooks.list: List the tenant's registered webhooks, cursor-paginated.
webhooks.listEvents: Return the complete canonical webhook event catalogue, grouped by source.
webhooks.get: Return a single webhook owned by the calling tenant.
SDK Quick Start: installation, the client, account scoping, and pagination.