Change a webhook destination, rotate its verification token, or deactivate it.

Update Webhook

Summary

Change a webhook destination, rotate its verification token, or deactivate it.

Prerequisites

Authorization: Bearer w91_live_xxx
Content-Type: application/json for JSON requests

Related documentation

Update uses POST rather than PUT or PATCH so an integration only needs GET and POST. Every field inside webhook is optional, but at least one update field is required.

POST/api/v2/webhooks/{webhookUid}

Update a webhook destination.

Parameter	Type	Required	Description
`webhookUid`	string	Required	Webhook UID to update.
`senderId`	string	Optional	WhatsApp sender that owns the webhook.
`webhook.name`	string	Optional	Display name.
`webhook.endpointUrl`	string	Optional	HTTPS delivery endpoint.
`webhook.events`	array	Optional	Supported event keys from the event catalog.
`webhook.status`	string	Optional	ACTIVE or INACTIVE.
`webhook.timeoutMs`	integer	Optional	Delivery timeout in milliseconds.
`webhook.retryEnabled`	boolean	Optional	Whether failed deliveries are retried.
`webhook.retryMaxAttempts`	integer	Optional	Maximum retry attempts.
`webhook.verificationHeaderKey`	string	Optional	Custom verification header name.
`webhook.verificationToken`	string	Optional	New verification token value.
`webhook.clearVerificationToken`	boolean	Optional	Set true to remove the stored verification token.

Deactivate

curl -X POST "https://graph.whats91.com/api/v2/webhooks/wh_abc" \
  -H "Authorization: Bearer w91_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "senderId": "916268662275",
    "webhook": { "status": "INACTIVE", "retryEnabled": false }
  }'

Rotate verification token

{
  "webhook": {
    "verificationToken": "new-shared-secret"
  }
}

Clear verification token

{
  "webhook": {
    "clearVerificationToken": true
  }
}

200 OK

{
  "success": true,
  "message": "Webhook updated",
  "data": {
    "webhookUid": "wh_abc",
    "status": "INACTIVE",
    "retryEnabled": false,
    "hasVerificationToken": true
  },
  "metadata": {
    "apiVersion": "v2",
    "requestId": "request-uuid"
  }
}

Updating a webhook never rotates the signing secret.
There is no public delete endpoint. Set status to INACTIVE to stop deliveries.
Webhook management is sender-scoped. Manage each WhatsApp number separately through senderId or a number-scoped token.

SDK Examples

Use these examples as starting points for server-side implementations.

cURL

curl -X POST "https://graph.whats91.com/api/v2/webhooks/{webhookUid}" \
  -H "Authorization: Bearer w91_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
  "webhook": {
    "verificationToken": "new-shared-secret"
  }
}'

Node.js

const response = await fetch("https://graph.whats91.com/api/v2/webhooks/{webhookUid}", {
  method: "POST",
  headers: {
    "Authorization": "Bearer w91_live_xxx",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "webhook": {
      "verificationToken": "new-shared-secret"
    }
  })
});

const data = await response.json();
console.log(data);

PHP

$ch = curl_init("https://graph.whats91.com/api/v2/webhooks/{webhookUid}");
curl_setopt_array($ch, [
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer w91_live_xxx",
    "Content-Type: application/json"
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "webhook" => [
      "verificationToken" => "new-shared-secret"
    ]
  ])
]);

$response = curl_exec($ch);
curl_close($ch);
echo $response;

Python

import requests

response = requests.request(
    "POST",
    "https://graph.whats91.com/api/v2/webhooks/{webhookUid}",
    headers={
        "Authorization": "Bearer w91_live_xxx",
        "Content-Type": "application/json",
    },
    json={
        "webhook": {
            "verificationToken": "new-shared-secret"
        }
    }
)

print(response.json())

C#

using System.Text;

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", "Bearer w91_live_xxx");

var request = new HttpRequestMessage(HttpMethod.Post, "https://graph.whats91.com/api/v2/webhooks/{webhookUid}");
request.Content = new StringContent(
  """
  {
    "webhook": {
      "verificationToken": "new-shared-secret"
    }
  }
  """,
  Encoding.UTF8,
  "application/json"
);

var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

Related APIs

Webhook

Create and manage Whats91 Webhooks v2 event destinations with the canonical public API route.

Get Webhook

Retrieve one webhook destination by its webhookUid.

Samples

Webhook management requests, responses, and event payload samples for common Whats91 webhook flows.

Examples

Practical webhook receiver examples and use cases for CRM, delivery tracking, and template operations.