API reference

PATCHUpdate a webhook endpoint

PATCH /v1/webhook_endpoints/{endpoint_id}: Change the URL, events, description, static header, loop prevention or status.

PATCHhttps://api.light-ai.app/v1/webhook_endpoints/{endpoint_id}

Change the URL, events, description, static header, loop prevention or status. Scopes never grow. An endpoint stopped by a revocation or suspension can be disabled but not re-enabled here (an owner re-affirms it in Settings → Developers). One the organization disabled (status_reason disabled_by_organization) can be disabled or edited but not enabled or re-pointed, and no other endpoint can be pointed at its receiver (409 stale_state). A static header never moves to a new URL: a request that changes url on an endpoint with a static header must send static_header again (or null), else 422.

Scope	`webhooks:manage`
Credential	API key: `Authorization: Bearer lai_live_…` (or `lai_test_…`). Partner keys add `Light-AI-Organization`.
Test mode	Works with test keys (test objects only).
Idempotency	`Idempotency-Key` supported. See Idempotency.

Path parameters#

endpoint_idstringrequired#

The endpoint id (we_…). Id prefix we_.

Headers#

Light-AI-Organizationstring#

Partner keys: the connected organization to act for (org_…). Organization keys may omit it. Id prefix org_.

Light-AI-Versionstring#

Pin a dated API version (defaults to the key's version). One of: 2026-11-01.

Idempotency-Keystring#

Retry-safe writes: the same key and body replay the first response for 24 hours (Idempotent-Replayed: true). 8–128 characters.

Request body#

urlstring#

https only, port 443 or 8443, public host. At most 2048 characters.

eventsstring[]#

1–40 items.

descriptionstring | null#

At most 500 characters.

static_headerobject | null#

A fixed header sent with every delivery (e.g. for n8n Header Auth). Stored encrypted; never shown again. It belongs to its URL: a request that changes url must send static_header again (or null to remove it), otherwise 422 at /static_header.

static_header.namestringrequired#

static_header.valuestringrequired#

Visible ASCII (spaces allowed inside); surrounding whitespace is trimmed. Stored encrypted. Responses show only its last 4 characters, and only when it is at least 12 characters long. 1–1000 characters.

exclude_own_originboolean#

statusstring#

One of: enabled, disabled.

Response 200#

The updated endpoint.

idstringrequired#

Id prefix we_.

objectstringrequired#

Always webhook_endpoint.

urlstringrequired#

descriptionstring | nullrequired#

eventsstring[]required#

One of: lead.created, lead.touched, lead.updated, lead.mockup_ready, client.created, client.updated, client.deleted, project.created, project.stage_changed, quote.published, quote.viewed, quote.external_link_clicked, quote.change_requested, quote.approved, quote.declined, quote.expired, quote.link_disabled, quote.link_enabled, quote.superseded, mockup.completed, mockup.failed, organization.entitlement_changed, grant.created, grant.revoked, api_key.expiring, webhook_endpoint.disabled, ping.

unentitled_eventsstring[]required#

Subscribed types the organization's current plan does not deliver live (e.g. after a downgrade). They resume when the plan includes them. One of: lead.created, lead.touched, lead.updated, lead.mockup_ready, client.created, client.updated, client.deleted, project.created, project.stage_changed, quote.published, quote.viewed, quote.external_link_clicked, quote.change_requested, quote.approved, quote.declined, quote.expired, quote.link_disabled, quote.link_enabled, quote.superseded, mockup.completed, mockup.failed, organization.entitlement_changed, grant.created, grant.revoked, api_key.expiring, webhook_endpoint.disabled, ping.

livemodebooleanrequired#

false for objects created with a test key.

statusstringrequired#

One of: enabled, disabled, disabled_by_system, disabled_by_revocation, suspended.

status_reasonstring | nullrequired#

Why it is not enabled. disabled_by_organization: the contractor disabled it in Settings → Developers. Until they enable it there (it then returns to the state it had before their disable) or remove it there, the API cannot enable, re-point or delete it, nor create or point another endpoint at the same receiver (the same host, port and path; query string, case, repeated or trailing slashes and :443 ignored): each answers 409 stale_state with current_state disabled_by_organization. A partner's partner-level endpoints at that receiver receive none of that contractor's events meanwhile (its organization.entitlement_changed included; grant notices addressed to the partner still arrive). A different path or host is a different receiver. This stops deliveries, not access: a partner's key still reads through its grant (the contractor suspends or revokes the grant to stop the partner). gone / circuit_breaker: Light AI stopped it (410, or 72 hours of failures). grant_suspended, grant_revoked, key and security reasons: access was suspended or revoked.

disabled_while_suspendedbooleanrequired#

api_versionstringrequired#

exclude_own_originbooleanrequired#

scopesstring[]required#

One of: leads:read, leads:write, clients:read, clients:write, projects:read, projects:write, quotes:read, quotes:write, quotes:share_link, quotes:asset_links, webhooks:manage, events:read, mockups:read, mockups:write, forms:read, forms:write.

kindstringrequired#

One of: organization, partner.

grant_idsstring[] | nullrequired#

static_headerobject | nullrequired#

static_header.namestringrequired#

static_header.value_redactedstringrequired#

… plus the last 4 characters of a value of 12 or more characters; … alone for a shorter value.

created_byobjectrequired#

created_by.typestringrequired#

One of: api_key, user.

created_by.idstring | nullrequired#

created_by.namestring | nullrequired#

created_by.partnerstring | null#

lanestringrequired#

One of: normal, degraded.

backlogintegerrequired#

oldest_pending_attimestamp | nullrequired#