Skip to main content
PUT
Update a dispute webhook

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <secret_key>, where <secret_key> is your secret_key.

Headers

X-Merchant-Code
string
required

Merchant code the request is scoped to. Required on every dispute-webhook request, even when your secret key maps to a single merchant; case-insensitive.

Example:

"code provided to you from Tabby side"

Path Parameters

id
string<uuid>
required

ID of the webhook.

Example:

"webhook id, uuid format"

Body

application/json
url
string<uri>
required

Endpoint for dispute notifications (HTTPS recommended). Must be an absolute URL with a publicly resolvable host name — localhost, raw IP addresses and hosts that do not resolve are rejected. Normalised before it is stored (lower-case scheme and host, default port and trailing slash removed) and unique per merchant.

Example:

"https://example.com/tabby/dispute-webhook"

header
object

Optional static header Tabby adds to every notification so you can verify its origin. Omit it on PUT to remove the header.

Response

Success. Dispute webhook object is returned; header.value is masked.

id
string
required
read-only

Unique dispute webhook ID, assigned by Tabby.

Example:

"f5eb7c26-b163-4fad-b75f-66024824116e"

url
string<uri>
required

Endpoint for dispute notifications, as stored (normalised).

Example:

"https://example.com/tabby/dispute-webhook"

header
object | null

The signing header, if one was registered. value is masked.