Update Webhook Settings

PATCH 
/api/xero/webhook-settings/:integrationInstanceId

Enable or disable Xero webhooks and update the signing key. Key rotation is supported with a 1-hour grace period for the previous key.

Authorization

Any valid API token can call this endpoint — no specific scope required. Manage tokens.

Authentication: Requires Bearer token.

Fields:

• webhook_enabled (required, boolean): Enable or disable webhook processing
• signing_key (optional, string, min 32 max 256): HMAC-SHA256 signing key from Xero

Errors:

• 422: Cannot enable webhooks without a signing key

Request

Responses

200

OK

Response Headers

Content-Type

401

Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.

403

Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.

404

Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.

422

Unprocessable Entity

Response Headers

Content-Type

429

Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.