Sinbad Partner API

curl -X PATCH https://us-central1-sinbad-staging-env.cloudfunctions.net/b2b-v1/v1/webhooks/wh_demo \
     -H "Idempotency-Key: request_demo_001" \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "revision": 1,
  "status": "paused"
}'

{
  "webhook": {
    "webhookId": "wh_demo",
    "partnerId": "partner_demo",
    "integrationId": "integration_demo",
    "environment": "sinbad-staging-env",
    "url": "https://partner.example.com/events",
    "description": "Trade updates",
    "eventTypes": [
      "trade.created",
      "trade.updated",
      "trade.message.created"
    ],
    "apiVersion": "2026-10-22",
    "status": "paused",
    "revision": 2,
    "verifiedAt": null,
    "createdAt": "2026-10-23T10:00:00.000Z",
    "updatedAt": "2026-10-23T10:00:00.000Z",
    "deletedAt": null,
    "overlapUntil": null,
    "signingKeyId": "key_demo"
  }
}

Update or pause a webhook.

Credential: Partner secret

Before you call

A server-side partner secret for the owning partner. Do not send an Origin header.
An active integration that your partner credential permits.
Set an Idempotency-Key and reuse it for an identical retry.
Use the current revision returned by Get a webhook endpoint.

Update description/subscriptions or pause/resume with expected revision

Use the current revision; stale revisions return 409 REVISION_CONFLICT. Activation requires successful verification (VERIFICATION_REQUIRED). Changes cancel unsent work for an old subscription; requests already in flight may complete.

Server-only partner credential access: a 403 means the integration is unauthorized or inactive. Mutations share 60/min per partner; test and replay allow 5/min each per endpoint, rotation 1/min per endpoint. Only committed changes count; identical idempotent replays within 24 hours do not. A 429 includes retryAfter. Conflict details.kind can include IDEMPOTENCY_CONFLICT, ENDPOINT_DELETED, ENDPOINT_LIMIT, REVISION_CONFLICT, VERIFICATION_REQUIRED, ROTATION_IN_PROGRESS or REPLAY_UNAVAILABLE. Webhook availability depends on environment readiness; confirm it with Sinbad.

Webhook delivery must be available in the selected environment. Confirm readiness with Sinbad.

Errors

Status	Code	What to do
400	`VALIDATION_ERROR`	Correct the fields reported in details before retrying.
401	`UNAUTHENTICATED`	Create a new customer session or use a valid server credential.
403	`FORBIDDEN`	Use a server credential permitted for this active integration.
404	`NOT_FOUND`	Check the resource ID. A resource that belongs to someone else also returns 404.
409	`CONFLICT`	Read the current state again before you prepare or retry.
429	`RATE_LIMITED`	Wait for Retry-After before retrying.
503	`UPSTREAM_ERROR`	Retry with backoff; preserve the same idempotency key for a repeated mutation.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Path parameters

webhookIdstringRequiredformat: "^[A-Za-z0-9_-]{1,128}$"

Request

This endpoint expects an object.

revisionintegerRequired>=1

descriptionstringOptional<=200 characters

eventTypeslist of enumsOptional

Allowed values:

statusenumOptional

Allowed values:

Response headers

Cache-ControlstringOptional

no-store

Response

Success

webhookobject

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

409

Conflict Error

429

Too Many Requests Error

503

Service Unavailable Error