# Set or change the webhook URL

`PUT https://management.horeca-24.de/api/partner/v1/webhook`

The URL must use `https` on port 443, carry no `user:pass@`, be at most 2048 characters long and name a host
(no IP literal, no `localhost`) whose addresses are all public. The check is repeated at every delivery. A
refused URL answers `422 INVALID_FIELD` with `path: "url"`.

`webhookSecret` is answered **only the first time** a URL is set; store it. A first or changed URL sends
`menu.updated` right away if the restaurant has synced a menu; `menuDelivery` says how that went.

Until a URL is set, no events are produced and orders are refused (`409 WEBHOOK_NOT_CONFIGURED`).

## Headers

- `Authorization` (string, required): Bearer $PARTNER_API_KEY

## Request

`application/json`

- `url` (string, required, 1-2048 chars, format: uri)
  https, port 443, public host

## Response

### 200 — Stored

- `url` (string, required, format: uri)
- `webhookSecret` (string, optional, pattern: `^whsec_`)
  Only the first time a URL is set. Store it.
- `menuDelivery` (string, required, `sent` | `queued` | `failed` | `skipped`)
  The `menu.updated` sent for the URL - sent, queued (retried), failed, or skipped (nothing to send)

## Errors

- `400`: An error; see `ErrorCode`
- `401`: `UNAUTHORIZED`: the key is missing, malformed, unknown, wrong, expired or revoked
- `403`: `CONNECTION_REVOKED`: the restaurant deleted the connection; stop sending
- `422`: An error; see `ErrorCode`

## Code example (cURL)

```sh
curl -X PUT https://management.horeca-24.de/api/partner/v1/webhook \
  -H "Authorization: Bearer $PARTNER_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
  "url": "https://partner.example/hooks/horeca24"
}'
```

## Response 200 — Example

```json
{
  "url": "https://partner.example/hooks/horeca24",
  "webhookSecret": "whsec_Q2hhbmdlIG1lIGJlZm9yZSBnb2luZyBsaXZlIQ",
  "menuDelivery": "sent"
}
```