Update Endpoint | Webhooks API

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description": "Updated production endpoint"
  }'

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "authentication": {
      "username": "your-username",
      "password": "your-password"
    }
  }'

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "authentication": {
      "clientId": "your-client-id",
      "clientSecret": "your-client-secret",
      "authUrl": "https://auth.your-server.com/oauth/token"
    }
  }'

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "authentication": null
  }'

import requests

endpoint_id = "4a124f25-fe8d-47a0-92c8-16d94cbfe24c"
url = f"https://api.atoa.me/api/webhook/v2/endpoints/{endpoint_id}"

payload = {
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description": "Updated production endpoint"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.request("PUT", url, json=payload, headers=headers)
print(response.text)

const endpointId = "4a124f25-fe8d-47a0-92c8-16d94cbfe24c";

const options = {
  method: 'PUT',
  headers: { Authorization: 'Bearer <token>', 'Content-Type': 'application/json' },
  body: JSON.stringify({
    events: ['PAYMENTS_STATUS', 'REFUND_STATUS', 'EXPIRED_STATUS'],
    description: 'Updated production endpoint'
  })
};

fetch(`https://api.atoa.me/api/webhook/v2/endpoints/${endpointId}`, options)
  .then(response => response.json())
  .then(response => console.log(response))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

$endpointId = "4a124f25-fe8d-47a0-92c8-16d94cbfe24c";

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.atoa.me/api/webhook/v2/endpoints/{$endpointId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    "events" => ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description" => "Updated production endpoint"
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	endpointId := "4a124f25-fe8d-47a0-92c8-16d94cbfe24c"
	url := "https://api.atoa.me/api/webhook/v2/endpoints/" + endpointId

	payload := strings.NewReader(`{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description": "Updated production endpoint"
  }`)

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.atoa.me/api/webhook/v2/endpoints/{endpointId}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .routeParam("endpointId", "4a124f25-fe8d-47a0-92c8-16d94cbfe24c")
  .body("{\n  \"events\": [\"PAYMENTS_STATUS\", \"REFUND_STATUS\", \"EXPIRED_STATUS\"],\n  \"description\": \"Updated production endpoint\"\n}")
  .asString();

{
  "id": "4a124f25-fe8d-47a0-92c8-16d94cbfe24c",
  "url": "https://your-server.com/webhooks",
  "description": "Updated production endpoint",
  "environment": "PRODUCTION",
  "events": [
    { "event": "PAYMENTS_STATUS", "label": "Payment Status" },
    { "event": "REFUND_STATUS", "label": "Refund Status" },
    { "event": "EXPIRED_STATUS", "label": "Expired Status" }
  ],
  "hasAuthentication": false,
  "authenticationType": null,
  "failureCount": 0,
  "lastDeliveredAt": "2025-06-01T12:00:00.000Z"
}

{
  "name": "BAD_REQUEST",
  "message": "At least one event type is required.",
  "status": 400
}

{
  "name": "BAD_REQUEST",
  "message": "Duplicate event types are not allowed.",
  "status": 400
}

{
  "name": "BAD_REQUEST",
  "message": "Payment Status has reached the maximum limit of 3 endpoints per event type.",
  "status": 400
}

{
  "name": "BAD_REQUEST",
  "message": "POS Payment Status requires V2 signing. Please generate a signing secret from the dashboard to proceed.",
  "status": 400
}

{
  "name": "UNAUTHORIZED",
  "message": "Unauthorized",
  "status": 401,
  "errors": "[]"
}

{
  "name": "NOT_FOUND",
  "message": "Webhook not found",
  "status": 404
}

PUT

api

webhook

endpoints

{endpointId}

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description": "Updated production endpoint"
  }'

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "authentication": {
      "username": "your-username",
      "password": "your-password"
    }
  }'

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "authentication": {
      "clientId": "your-client-id",
      "clientSecret": "your-client-secret",
      "authUrl": "https://auth.your-server.com/oauth/token"
    }
  }'

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "authentication": null
  }'

import requests

endpoint_id = "4a124f25-fe8d-47a0-92c8-16d94cbfe24c"
url = f"https://api.atoa.me/api/webhook/v2/endpoints/{endpoint_id}"

payload = {
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description": "Updated production endpoint"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.request("PUT", url, json=payload, headers=headers)
print(response.text)

const endpointId = "4a124f25-fe8d-47a0-92c8-16d94cbfe24c";

const options = {
  method: 'PUT',
  headers: { Authorization: 'Bearer <token>', 'Content-Type': 'application/json' },
  body: JSON.stringify({
    events: ['PAYMENTS_STATUS', 'REFUND_STATUS', 'EXPIRED_STATUS'],
    description: 'Updated production endpoint'
  })
};

fetch(`https://api.atoa.me/api/webhook/v2/endpoints/${endpointId}`, options)
  .then(response => response.json())
  .then(response => console.log(response))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

$endpointId = "4a124f25-fe8d-47a0-92c8-16d94cbfe24c";

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.atoa.me/api/webhook/v2/endpoints/{$endpointId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    "events" => ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description" => "Updated production endpoint"
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	endpointId := "4a124f25-fe8d-47a0-92c8-16d94cbfe24c"
	url := "https://api.atoa.me/api/webhook/v2/endpoints/" + endpointId

	payload := strings.NewReader(`{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description": "Updated production endpoint"
  }`)

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.atoa.me/api/webhook/v2/endpoints/{endpointId}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .routeParam("endpointId", "4a124f25-fe8d-47a0-92c8-16d94cbfe24c")
  .body("{\n  \"events\": [\"PAYMENTS_STATUS\", \"REFUND_STATUS\", \"EXPIRED_STATUS\"],\n  \"description\": \"Updated production endpoint\"\n}")
  .asString();

{
  "id": "4a124f25-fe8d-47a0-92c8-16d94cbfe24c",
  "url": "https://your-server.com/webhooks",
  "description": "Updated production endpoint",
  "environment": "PRODUCTION",
  "events": [
    { "event": "PAYMENTS_STATUS", "label": "Payment Status" },
    { "event": "REFUND_STATUS", "label": "Refund Status" },
    { "event": "EXPIRED_STATUS", "label": "Expired Status" }
  ],
  "hasAuthentication": false,
  "authenticationType": null,
  "failureCount": 0,
  "lastDeliveredAt": "2025-06-01T12:00:00.000Z"
}

{
  "name": "BAD_REQUEST",
  "message": "At least one event type is required.",
  "status": 400
}

{
  "name": "BAD_REQUEST",
  "message": "Duplicate event types are not allowed.",
  "status": 400
}

{
  "name": "BAD_REQUEST",
  "message": "Payment Status has reached the maximum limit of 3 endpoints per event type.",
  "status": 400
}

{
  "name": "BAD_REQUEST",
  "message": "POS Payment Status requires V2 signing. Please generate a signing secret from the dashboard to proceed.",
  "status": 400
}

{
  "name": "UNAUTHORIZED",
  "message": "Unauthorized",
  "status": 401,
  "errors": "[]"
}

{
  "name": "NOT_FOUND",
  "message": "Webhook not found",
  "status": 404
}

Update an existing webhook endpoint’s description, event subscriptions, or authentication credentials.

The endpoint URL cannot be changed after creation. To use a different URL, delete the endpoint and create a new one.

Authorization

Bearer <token> Path Parameters

string

required

The unique identifier of the endpoint to update.

Request Body Schema

string[]

required

The complete set of event types to subscribe to. This replaces the existing subscriptions — any event not included is removed. At least one event is required.If you are adding a new event type to this endpoint, each event type supports a maximum of 3 registered endpoints across your account. Adding an event that already has 3 other endpoints subscribed returns a 400 error. Use List endpoints to check current registrations before updating.

string

Updated description for this endpoint (max 100 characters). Omit to leave the current description unchanged.

object

Optional. Updated authentication configuration. Two methods are supported — choose one. Fields from different methods cannot be mixed. Pass null explicitly to remove existing authentication. Omit the field entirely to leave authentication unchanged.

Remove authentication

Pass "authentication": null to remove any existing authentication from the endpoint.

Basic Auth — username + password

Atoa includes an Authorization: Basic <base64(username:password)> header in every delivery request. Pass both fields together.

string

required

Username for HTTP Basic Authentication.

string

required

Password for HTTP Basic Authentication.

OAuth 2.0 — client credentials flow

Before each delivery, Atoa calls your token endpoint using the client_credentials grant to obtain a short-lived access token, then includes it as Authorization: Bearer <token> in the delivery request. Pass all three fields together.

string

required

Client ID registered with your authorisation server.

string

required

Client secret for the above client ID.

string

required

Your token endpoint URL (e.g. https://auth.your-server.com/oauth/token). Atoa will POST to this URL to fetch an access token before each delivery.

Response Returns the updated endpoint object. Same shape as Create endpoint.

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description": "Updated production endpoint"
  }'

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "authentication": {
      "username": "your-username",
      "password": "your-password"
    }
  }'

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "authentication": {
      "clientId": "your-client-id",
      "clientSecret": "your-client-secret",
      "authUrl": "https://auth.your-server.com/oauth/token"
    }
  }'

curl --request PUT \
  --url https://api.atoa.me/api/webhook/v2/endpoints/4a124f25-fe8d-47a0-92c8-16d94cbfe24c \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "authentication": null
  }'

import requests

endpoint_id = "4a124f25-fe8d-47a0-92c8-16d94cbfe24c"
url = f"https://api.atoa.me/api/webhook/v2/endpoints/{endpoint_id}"

payload = {
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description": "Updated production endpoint"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.request("PUT", url, json=payload, headers=headers)
print(response.text)

const endpointId = "4a124f25-fe8d-47a0-92c8-16d94cbfe24c";

const options = {
  method: 'PUT',
  headers: { Authorization: 'Bearer <token>', 'Content-Type': 'application/json' },
  body: JSON.stringify({
    events: ['PAYMENTS_STATUS', 'REFUND_STATUS', 'EXPIRED_STATUS'],
    description: 'Updated production endpoint'
  })
};

fetch(`https://api.atoa.me/api/webhook/v2/endpoints/${endpointId}`, options)
  .then(response => response.json())
  .then(response => console.log(response))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

$endpointId = "4a124f25-fe8d-47a0-92c8-16d94cbfe24c";

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.atoa.me/api/webhook/v2/endpoints/{$endpointId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    "events" => ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description" => "Updated production endpoint"
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	endpointId := "4a124f25-fe8d-47a0-92c8-16d94cbfe24c"
	url := "https://api.atoa.me/api/webhook/v2/endpoints/" + endpointId

	payload := strings.NewReader(`{
    "events": ["PAYMENTS_STATUS", "REFUND_STATUS", "EXPIRED_STATUS"],
    "description": "Updated production endpoint"
  }`)

	req, _ := http.NewRequest("PUT", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.put("https://api.atoa.me/api/webhook/v2/endpoints/{endpointId}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .routeParam("endpointId", "4a124f25-fe8d-47a0-92c8-16d94cbfe24c")
  .body("{\n  \"events\": [\"PAYMENTS_STATUS\", \"REFUND_STATUS\", \"EXPIRED_STATUS\"],\n  \"description\": \"Updated production endpoint\"\n}")
  .asString();

{
  "id": "4a124f25-fe8d-47a0-92c8-16d94cbfe24c",
  "url": "https://your-server.com/webhooks",
  "description": "Updated production endpoint",
  "environment": "PRODUCTION",
  "events": [
    { "event": "PAYMENTS_STATUS", "label": "Payment Status" },
    { "event": "REFUND_STATUS", "label": "Refund Status" },
    { "event": "EXPIRED_STATUS", "label": "Expired Status" }
  ],
  "hasAuthentication": false,
  "authenticationType": null,
  "failureCount": 0,
  "lastDeliveredAt": "2025-06-01T12:00:00.000Z"
}

{
  "name": "BAD_REQUEST",
  "message": "At least one event type is required.",
  "status": 400
}

{
  "name": "BAD_REQUEST",
  "message": "Duplicate event types are not allowed.",
  "status": 400
}

{
  "name": "BAD_REQUEST",
  "message": "Payment Status has reached the maximum limit of 3 endpoints per event type.",
  "status": 400
}

{
  "name": "BAD_REQUEST",
  "message": "POS Payment Status requires V2 signing. Please generate a signing secret from the dashboard to proceed.",
  "status": 400
}

{
  "name": "UNAUTHORIZED",
  "message": "Unauthorized",
  "status": 401,
  "errors": "[]"
}

{
  "name": "NOT_FOUND",
  "message": "Webhook not found",
  "status": 404
}

Overview

Reference

Webhook

Card on File

Update Endpoint | Webhooks API

Authorization

​Authorization

Authorization