> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endl.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Update subscription

> A partial update — a `null` or omitted field is left unchanged. You can change the status and the event filter.

**The target URL is immutable.** A request that includes `target` is rejected. To send events somewhere else, delete the subscription and create a new one, which issues a fresh signing secret. This is deliberate: it stops a compromised key from silently repointing a live, signed event stream at an attacker.



## OpenAPI

````yaml api-reference/endl-webhooks-api.json PATCH /api/v0/webhooks/subscriptions/{id}
openapi: 3.1.0
info:
  title: Endl Webhooks API
  version: '0'
  description: >-
    Register where your events go, inspect what happened to each delivery, and
    read the PULL feed.


    Every endpoint returns the standard Endl response envelope and requires the
    `webhooks` permission — the PULL feed additionally requires `events`.
servers:
  - url: https://qa-api.endl.xyz
    description: QA
security:
  - apiKey: []
tags:
  - name: Subscriptions
    description: Register and manage the endpoints that receive your events.
  - name: Deliveries
    description: Inspect and retry individual delivery attempts.
  - name: Events
    description: Read events from the PULL feed.
paths:
  /api/v0/webhooks/subscriptions/{id}:
    parameters:
      - $ref: '#/components/parameters/SubscriptionId'
    patch:
      tags:
        - Subscriptions
      summary: Update subscription
      description: >-
        A partial update — a `null` or omitted field is left unchanged. You can
        change the status and the event filter.


        **The target URL is immutable.** A request that includes `target` is
        rejected. To send events somewhere else, delete the subscription and
        create a new one, which issues a fresh signing secret. This is
        deliberate: it stops a compromised key from silently repointing a live,
        signed event stream at an attacker.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                status:
                  type: string
                  enum:
                    - ACTIVE
                    - PAUSED
                    - DELETED
                  description: >-
                    `PAUSED` holds events, `ACTIVE` resumes delivery, `DELETED`
                    soft-deletes. `SUSPENDED` is rejected — only Endl sets it.
                eventFilter:
                  type: array
                  items:
                    type: string
                  description: >-
                    Replaces the current filter. An empty list resets it to
                    `["*"]`.
            example:
              status: PAUSED
              eventFilter:
                - payout.completed
      responses:
        '200':
          description: Updated.
          content:
            application/json:
              example:
                code: 200
                message: Subscription updated
                status: SUCCESS
                data:
                  id: 2b1e8f40-3c9a-4d21-9f7e-6a1c0b5d2e34
                  deliveryMode: PUSH
                  target: https://api.acme.com/webhooks/endl
                  eventFilter:
                    - payout.completed
                  schemaVersion: '1.0'
                  status: PAUSED
                  secretHint: whsec_…5RtBw
                  createdOn: '2026-09-02T12:34:56.789Z'
                errors: []
        '400':
          description: '`SUSPENDED` requested, `target` supplied, or missing permission.'
        '401':
          description: Authentication failed.
        '404':
          description: Not found.
        '409':
          description: Resuming would exceed the active cap.
        '503':
          description: Endl could not verify the credential right now.
components:
  parameters:
    SubscriptionId:
      name: id
      in: path
      required: true
      schema:
        type: string
        format: uuid
      description: The subscription's UUID.
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: API-KEY
      description: >-
        Your partner API key. Requires the `webhooks` permission, or `events`
        for the PULL feed.

````