# Disable or enable destination

Update a webhook destination, including enable and disable.

Partial update. At least one field is required. active false disables the destination. active true clears the disabled timestamp and resets consecutive failures. eventTypes must be a non-empty subset of the catalog.

This route is console / Firebase only for now. Tenant API keys are not accepted.

## See also

- [Webhooks](https://www.invunion.com/knowledge-base/api/webhooks/). Events you can subscribe to and the JSON posted to your URL.

- HTTP method: `PATCH`
- Path: `/api/v1/webhook-endpoints/:id`
- URL: `https://api.invunion.com/api/v1/webhook-endpoints/:id`
- Required scope: `none — Firebase console only`
- HTML docs: https://www.invunion.com/knowledge-base/api/update-webhook-endpoint/
- Markdown docs: https://www.invunion.com/knowledge-base/api/update-webhook-endpoint.md

## Path parameters

| Name | Type | Required | Description | Allowed values | Example |
| --- | --- | --- | --- | --- | --- |
| `id` | string, no maximum | required | Webhook destination UUID. |  | `4e2deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d` |


## Body parameters

| Name | Type | Required | Description | Allowed values | Example |
| --- | --- | --- | --- | --- | --- |
| `active` | boolean | optional | If false, disable the destination. If true, enable it again. | `true`, `false` |  |
| `url` | string, max 2048 | optional | HTTPS URL. Private hosts and URLs with credentials are rejected. |  | `https://hooks.leonescars.example/invunion` |
| `description` | string, max 255 | optional | Optional label. |  | `Leones Cars operations` |
| `eventTypes` | array | optional | Event types to deliver. Non-empty subset of the catalog. | `transaction.created`, `invoice.created`, `invoice.updated`, `invoice.paid`, `invoice.partially_paid`, `match.created`, `match.suggested`, `match.confirmed`, `match.rejected`, `match.cancelled`, `bank.connected`, `bank.disconnected`, `sync.completed`, `sync.failed` |  |

## Errors

| Error | HTTP code | Description |
| --- | --- | --- |
| `Missing Bearer token` | `401` | The Authorization header is missing or is not a Bearer token. |
| `Invalid token` | `401` | Webhook destinations and deliveries are console-only. Send a Firebase ID token. Tenant API keys are not accepted on these routes. |
| `Too many requests, please try again later` | `429` | Wait and retry. The Retry-After header is the number of seconds to wait. |
| `At least one field is required` | `400` | The body was empty. |
| `Webhook URL must use a public host` | `400` | The URL is not a public HTTP or HTTPS host. Other URL checks return a similar message. |
| `Webhook endpoint not found` | `404` | No destination with this UUID exists in the authenticated tenant. |
| `Internal server error` | `500` | Unexpected server error. The JSON body includes correlationId. Retry with backoff. |

## Request (curl)

```bash
curl --request PATCH \
  --url https://api.invunion.com/api/v1/webhook-endpoints/4e2deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d \
  --header 'accept: application/json' \
  --header 'authorization: Bearer FIREBASE_ID_TOKEN' \
  --header 'content-type: application/json' \
  --data '{
  "active": false
}'
```

## Request (Python)

```python
import requests

url = "https://api.invunion.com/api/v1/webhook-endpoints/4e2deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"
headers = {
    "Accept": "application/json",
    "Authorization": "Bearer FIREBASE_ID_TOKEN",
    "Content-Type": "application/json",
}
payload = {
    "active": False
}
response = requests.patch(url, json=payload, headers=headers)
print(response.json())
```

## Request (Ruby)

```ruby
require 'net/http'
require 'json'
require 'uri'

uri = URI("https://api.invunion.com/api/v1/webhook-endpoints/4e2deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(uri)
request['Accept'] = 'application/json'
request['Authorization'] = 'Bearer FIREBASE_ID_TOKEN'
request['Content-Type'] = 'application/json'
request.body = "{\n  \"active\": false\n}"
response = http.request(request)
puts response.body
```

## Request (JavaScript)

```javascript
const response = await fetch("https://api.invunion.com/api/v1/webhook-endpoints/4e2deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", {
  method: "PATCH",
  headers: {
    "Accept": "application/json",
    "Authorization": "Bearer FIREBASE_ID_TOKEN",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "active": false
}),
});
const data = await response.json();
```

## Request (Go)

```go
package main

import (
	"bytes"
	"fmt"
	"io"
	"net/http"
)

func main() {
	payload := []byte(`{
  "active": false
}`)
	req, err := http.NewRequest("PATCH", "https://api.invunion.com/api/v1/webhook-endpoints/4e2deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", bytes.NewBuffer(payload))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Authorization", "Bearer FIREBASE_ID_TOKEN")
	req.Header.Set("Content-Type", "application/json")
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	fmt.Println(string(body))
}
```

## Request (Node)

```javascript
const response = await fetch("https://api.invunion.com/api/v1/webhook-endpoints/4e2deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", {
  method: "PATCH",
  headers: {
    "Accept": "application/json",
    "Authorization": "Bearer FIREBASE_ID_TOKEN",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "active": false
}),
});
console.log(await response.json());
```

## Success (200)

```json
{
  "success": true,
  "data": {
    "id": "4e2deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
    "url": "https://hooks.leonescars.example/invunion",
    "description": "Leones Cars operations",
    "eventTypes": [
      "invoice.paid",
      "match.created"
    ],
    "secretPrefix": "whsec_4e2d",
    "active": false,
    "consecutiveFailures": 0,
    "lastSuccessAt": "2026-09-12T09:00:04.000Z",
    "lastFailureAt": null,
    "lastDeliveryAt": "2026-09-12T09:00:04.000Z",
    "disabledAt": "2026-09-19T10:00:00.000Z",
    "disabledReason": null,
    "createdAt": "2026-09-01T08:00:00.000Z",
    "updatedAt": "2026-09-12T09:00:04.000Z"
  }
}
```