PUTMethod PUT/partner/webhooks/{webhook_id}

You modify a notification subscription that your brand already owns, and you receive the subscription in its new state.

#Authorization

Send your API key in the Authorization header, in the form Bearer followed by a space then the key. The key must carry the webhooks:write scope. A key that does not carry this scope receives a 403 whose message names the missing scope.

Two conditions come on top of the scope of the key.

• The subscription must belong to the brand of the key. We look for the subscription by its number and by your brand. When that lookup finds nothing, you receive a 404. A subscription that belongs to another brand gives exactly the same response. This endpoint therefore never tells you that a number exists elsewhere.
• The plan of your brand must include notifications. Otherwise you receive a 403 carrying the FEATURE_NOT_AVAILABLE code. One exception exists, described just below.

The full URL of this endpoint is https://api.sealtrust.io/v1/partner/webhooks/{webhook_id}. The same endpoint also answers without the /v1 prefix, at https://api.sealtrust.io/partner/webhooks/{webhook_id}. Both URLs call the same code. Use the /v1 form for a new integration.

#Rate limit

We measure the rate over a fixed 60 second window. The ceiling rises with your plan, and we can set a value on your brand that wins over the one of your plan. We therefore read, in this order: the value set on your brand, then the one of your plan, then a fallback value of 120 calls per window. That fallback value is used only if your brand and your plan carry none.

Do not guess your ceiling of the moment. You read it on every response that gets past the rate check.

Two counters overlap, with the same ceiling: one per key, one for the sum of all the keys of your brand. Creating extra keys therefore does not raise the total rate allowed.

Four headers describe the more constraining of the two counters.

A rate refusal returns 429 with Retry-After, expressed in seconds remaining in the current window. That value is never below 1.

This endpoint consumes no daily quota of a key and no monthly quota of a plan. The rate ceiling is the only counter that applies here.

#Path and query parameters

This endpoint has no query parameter.

#Headers

#Request body

The body is a JSON object. The four fields are optional. Send only the fields you want to change. A field absent from the body keeps its value.

The server refuses any field that this table does not name. An unknown field makes the request fail with a 422, and we modify nothing.

An empty body, written {}, is valid. It modifies nothing, it returns the subscription unchanged, and we require the plan as for any other modification.

#The 23 event types

A value of events that is not in this list makes the request fail with a 422, and the message names the rejected values.

#Example request

You repoint subscription number 128 to a new URL and you cut its list down to two event types.

curl -i -X PUT https://api.sealtrust.io/v1/partner/webhooks/128 \
  -H "Authorization: Bearer st_test_0000000000000000000000000000000000000000000000" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://exemple-sas.example.com/sealtrust/evenements",
    "events": ["product.minted", "batch.completed"]
  }'

import { SealTrustClient } from "@sealtrust-io/sdk";

const sealtrust = new SealTrustClient({
  apiKey: "st_test_0000000000000000000000000000000000000000000000",
});

const abonnement = await sealtrust.webhooks.update(128, {
  url: "https://exemple-sas.example.com/sealtrust/evenements",
  events: ["product.minted", "batch.completed"],
});

console.log(abonnement.id, abonnement.url, abonnement.events);

import requests

response = requests.put(
    "https://api.sealtrust.io/v1/partner/webhooks/128",
    headers={
        "Authorization": "Bearer st_test_0000000000000000000000000000000000000000000000",
    },
    json={
        "url": "https://exemple-sas.example.com/sealtrust/evenements",
        "events": ["product.minted", "batch.completed"],
    },
    timeout=30,
)

print(response.status_code)
print(response.headers.get("X-RateLimit-Remaining"))
print(response.json())

#Example response

HTTP code 200.

{
  "id": 128,
  "brand_id": 12,
  "url": "https://exemple-sas.example.com/sealtrust/evenements",
  "events": ["product.minted", "batch.completed"],
  "is_active": true,
  "health": "healthy",
  "created_at": "2026-08-18T09:12:44.512038+00:00",
  "updated_at": "2026-08-20T14:03:21.884517+00:00"
}

The response has eight fields and nothing else. The secret never appears in it.

#Errors

The body of an error response carries a detail field. Depending on the case, that field contains a sentence, a list or an object.

#See also

• GET /partner/webhooks/{webhook_id}, read a subscription and its delivery state.
• GET /partner/webhooks, list your notification subscriptions, page by page.
• DELETE /partner/webhooks/{webhook_id}, delete a subscription and the signing secret attached to it.
• Receiving events by webhook, create a subscription, verify a signature, catch up on lost events.