A webhook endpoint can be paused by updating its active flag. That is different from deleting its configuration or rotating its secret. Use a deliberate maintenance workflow so operators understand what stops, what remains and what must be reconciled afterward.
Inspect the endpoint first
Read the current endpoint using the documented webhook management routes and identify its URL, subscriptions and active state. The management scope is webhooks:manage. Keep signing secrets out of routine diagnostic output; ordinary list responses do not return them.
If the goal is a receiver URL change, consider its verification and deployment separately. A pause can create an operating window, but it does not by itself prove the replacement receiver is ready.
Patch only the intended field
The update endpoint leaves omitted fields alone and replaces an events array wholesale when provided. To pause without changing subscriptions:
PATCH /v1/webhooks/{id}
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
{"active":false}
Use {"active":true} to request reactivation after the receiver is ready. Do not include an empty events array as a placeholder for “unchanged.” Read update webhook for the current constraints.
Plan reconciliation before the pause
Record the maintenance window and the downstream work that may need review. The contract does not promise that every business event occurring while an endpoint is paused will be created as a replayable delivery afterward. Do not describe reactivation as automatic backfill.
Reconcile relevant source records through the documented read APIs according to your application’s needs. Delivery replay is available for a past delivery; it is not a general mechanism for inventing events that were never queued. Keep that distinction in the maintenance checklist.
Verify the resumed workflow
Check the active state and receiver configuration, then use the webhook test workflow to verify connectivity and signature handling. A test ping does not prove business processing or historical reconciliation, so exercise those separately with controlled records.
Test a pause-only patch, a subscription change and an uncertain response. Confirm your interface does not lose the prior events list or display success before the server’s state is known. Keep the maintenance outcome and any unresolved reconciliation task visible to the next operator.