curl --request PATCH \
  --url https://api.malvo.io/webhooks/{id} \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: <api-key>' \
  --data '
{
  "headers": {
    "Authorization": "Bearer <rotated-secret>"
  }
}
'

const options = {
  method: 'PATCH',
  headers: {'X-API-KEY': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({headers: {Authorization: 'Bearer <rotated-secret>'}})
};

fetch('https://api.malvo.io/webhooks/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.malvo.io/webhooks/{id}"

payload = { "headers": { "Authorization": "Bearer <rotated-secret>" } }
headers = {
    "X-API-KEY": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.malvo.io/webhooks/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'headers' => [
        'Authorization' => 'Bearer <rotated-secret>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-API-KEY: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "id": "39e1d11f-3c12-44a8-a788-75c5747e1a8e",
  "event": "all",
  "url": "https://api.your-app.com/webhooks/malvo",
  "createdAt": "2026-06-10T12:00:00.000Z",
  "updatedAt": "2026-06-12T08:15:00.000Z",
  "disabled": null
}

{
  "code": 400,
  "message": "Invalid webhook URL: only https:// URLs are allowed",
  "codeDescription": "VALIDATION_ERROR"
}

{
  "code": 401,
  "message": "Missing or invalid X-API-KEY",
  "codeDescription": "UNAUTHORIZED"
}

{
  "code": 404,
  "message": "Webhook not found",
  "codeDescription": "NOT_FOUND"
}

{
  "code": 429,
  "message": "Too many requests",
  "codeDescription": "RATE_LIMIT_EXCEEDED"
}

{
  "code": 500,
  "message": "Internal server error",
  "codeDescription": "INTERNAL_ERROR"
}