Workspace

Update workspace webhook

Workspace webhooks — the same registry as /v1/phone-lines/webhooks (same rows, plwh_ secret, signature, retries and deliveries), with a wider event set: every phone_line.* event plus wallet.topup_paid (a wallet top-up was credited). "*" means every phone-line event only: wallet.topup_paid is opt-in, list it by name (for example ["*", "wallet.topup_paid"]). This surface lists every webhook of the workspace. Tenant-scoped key (or account key with x-workspace-id); Owner or Admin (phone_lines:webhooks) with a user credential.

⚠️ Real side effect. Changes the fields you send and answers { "webhook": { … } }; an absent field is left as it is. active: false pauses the webhook (it receives no deliveries — a delivery already in its retries is marked failed at its next attempt) and active: true resumes it; events that happened while it was paused are never sent.

The resulting webhook is validated as on creation. Only a URL that changes is checked again against internal destinations, so a webhook can always be paused or have its events edited. A name sent blank becomes the host of the (new or stored) URL. Editing never changes the signing secret, and the secret is not returned.

Permissions: with an OAuth / MCP token, the user must be an Owner or Admin (phone_lines:webhooks) — 403 PERMISSION_DENIED otherwise.

Every /v1/phone-lines endpoint takes a tenant-scoped key only: phone-line webhooks belong to the workspace, not to a WhatsApp number, so a number-scoped key (or a per-number OAuth grant) gets 403 NUMBER_SCOPE_NOT_ALLOWED before any role is looked at. A 403 PERMISSION_DENIED / WORKSPACE_MEMBERSHIP_REQUIRED is sent with Cache-Control: no-store.

These are the phone-line webhooks — a registry separate from /v1/webhooks: they receive only phone_line.* events, and a number webhook never receives one.

Requires a tenant-scoped key.

PATCH

workspace

webhooks

{id}

Update or pause a workspace webhook

curl --request PATCH \
  --url https://pilotstatus.com.br/v1/workspace/webhooks/{id} \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "active": false
}
'

import requests

url = "https://pilotstatus.com.br/v1/workspace/webhooks/{id}"

payload = { "active": False }
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({active: false})
};

fetch('https://pilotstatus.com.br/v1/workspace/webhooks/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://pilotstatus.com.br/v1/workspace/webhooks/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'active' => false
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://pilotstatus.com.br/v1/workspace/webhooks/{id}"

	payload := strings.NewReader("{\n  \"active\": false\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://pilotstatus.com.br/v1/workspace/webhooks/{id}")
  .header("x-api-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"active\": false\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://pilotstatus.com.br/v1/workspace/webhooks/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"active\": false\n}"

response = http.request(request)
puts response.read_body

{
  "webhook": {
    "id": "cmh1w8b2k0001wh8example3d",
    "name": "hooks.example.com",
    "url": "https://hooks.example.com/pilot/phone-lines",
    "events": [
      "*"
    ],
    "active": false,
    "lastDeliveryAt": "2026-10-27T14:11:51.000Z",
    "lastStatusCode": 200,
    "createdAt": "2026-10-27T13:58:02.000Z"
  }
}

Authorizations

x-api-key

string

header

required

Your ps_ API key

Headers

x-workspace-id

string

Only with an account key (ps_account_): the workspace to act on, from GET /v1/workspaces. Without it an account key gets 400 WORKSPACE_ID_REQUIRED.

Path Parameters

string

required

The webhook's id (from GET /v1/phone-lines/webhooks or the create response).

Body

application/json

name

string

Optional, up to 100 characters (400 INVALID_WEBHOOK_NAME above that). Blank or absent → the URL's host.

Maximum string length: 100

Example:

"Phone lines — production"

url

string

Must be https and reach a public address. A URL that points to an internal or private network address — localhost, a loopback or private IP, a host without a dot, or a name that resolves to one — → 400 WEBHOOK_URL_REFUSED.

Example:

"https://hooks.example.com/pilot/phone-lines"

events

enum<string>[]

One or more of the phone-line events, or "*" for all of them (inside this registry "*" means every phone-line event, including any added later). Duplicates are removed. An empty list or an unknown event → 400 INVALID_WEBHOOK.

Minimum array length: 1

Available options:

phone_line.purchased,

phone_line.audio_received,

phone_line.code_received,

phone_line.code_failed,

phone_line.renewed,

phone_line.payment_failed,

phone_line.suspended,

phone_line.returned,

phone_line.canceled,

phone_line.verification_updated,

*

Example:

["*"]

active

boolean

false pauses, true resumes.

Example:

false

Response

The webhook after the change

webhook

object

Show child attributes

Update or pause a workspace webhook

curl --request PATCH \
  --url https://pilotstatus.com.br/v1/workspace/webhooks/{id} \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "active": false
}
'

import requests

url = "https://pilotstatus.com.br/v1/workspace/webhooks/{id}"

payload = { "active": False }
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({active: false})
};

fetch('https://pilotstatus.com.br/v1/workspace/webhooks/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://pilotstatus.com.br/v1/workspace/webhooks/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'active' => false
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://pilotstatus.com.br/v1/workspace/webhooks/{id}"

	payload := strings.NewReader("{\n  \"active\": false\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://pilotstatus.com.br/v1/workspace/webhooks/{id}")
  .header("x-api-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"active\": false\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://pilotstatus.com.br/v1/workspace/webhooks/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"active\": false\n}"

response = http.request(request)
puts response.read_body

{
  "webhook": {
    "id": "cmh1w8b2k0001wh8example3d",
    "name": "hooks.example.com",
    "url": "https://hooks.example.com/pilot/phone-lines",
    "events": [
      "*"
    ],
    "active": false,
    "lastDeliveryAt": "2026-10-27T14:11:51.000Z",
    "lastStatusCode": 200,
    "createdAt": "2026-10-27T13:58:02.000Z"
  }
}