Delete webhook
DELETE/config/webhook/:webhookId
This endpoint deletes a webhook. The server disables the webhook and marks it as deleted. After the delete, the webhook sends no more events, and the other webhook endpoints do not find it. The response contains the webhook in its final state.
Request
Path Parameters
The ID of the webhook to delete.
Responses
- 200
- 401
- 404
- 500
OK
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
webhook object
A webhook configuration of the organisation. The service always sends every field of this object, except sandboxOrgId.
Unique identifier of the webhook.
Unique identifier of the organisation that owns the webhook.
Unique identifier of the sandbox organisation. The service sends this field only for a webhook that belongs to a sandbox deployment. A webhook receives only the events of its own scope.
URL that receives the webhook payload.
Possible values: [application/json, application/x-www-form-urlencoded]
Content type of the webhook payload.
subscribedEvents objectrequired
The event types that the webhook receives, in 3 groups. A minimum of 1 of the 3 arrays must hold a minimum of 1 event type. The service refuses an event type that is not in the list of its group. The service does not remove duplicate values.
Possible values: [data.update.initiated, data.update.cancelled, consent.allowed, consent.disallowed, consent.auto_expiry, data.delete.initiated, data.download.initiated, data.delete.cancelled, data.download.cancelled]
Consent management event types. These events occur when an individual gives or refuses consent, or asks to delete, download or update their data.
Possible values: [openid.credential.offer_sent, openid.credential.offer_received, openid.credential.credential_issued, openid.credential.credential_acked, openid.credential.credential_accepted, openid.credential.credential_deleted, openid.credential.issuance_denied, openid.credential.token_issued, openid.holder.credential.credential_pending, openid.holder.credential.credential_acked, openid.holder.credential.credential_accepted, openid.presentation.request_sent.v3, openid.presentation.request_received.v3, openid.presentation.presentation_acked.v3, openid.presentation.presentation_pending.v3]
Digital wallet event types. Every OID4VC event uses this group; the openid.* values are the only values that an OID4VCI or OpenID4VP integration needs. The digitalwallet.* values belong to the older DIDComm protocol.
The openid.credential.* events follow the issuer side of an OID4VCI exchange. The openid.holder.credential.* events follow the holder side. The openid.presentation.*.v3 events follow an OpenID4VP exchange: request_sent, request_received and presentation_acked come from the verifier side, and presentation_pending and presentation_acked come from the holder side.
Possible values: [datamarketplace.data_disclosure_agreement_record]
Data marketplace event types. These events occur when the service creates or updates a data disclosure agreement record.
When true, the webhook receives no event delivery.
Secret key that the service uses to calculate the X-IGrant-Signature header of each delivery. The service sends this value in clear text in every webhook response, so protect the response as you protect the key.
When true, the service does not verify the TLS certificate of the payload URL.
UTC time when the service created the webhook, in YYYY-MM-DDThh:mm:ssZ format. The service does not change this value on an update.
{
"webhook": {
"id": "68a1f2c3d4e5f6a7b8c9d0e1",
"orgId": "string",
"sandboxOrgId": "string",
"payloadUrl": "https://example.com/hooks/igrant",
"contentType": "application/json",
"subscribedEvents": {
"consentManagementWebhook": [
"data.update.initiated"
],
"digitalWalletWebhook": [
"openid.credential.offer_sent"
],
"dataMarketplaceWebhook": [
"datamarketplace.data_disclosure_agreement_record"
]
},
"disabled": true,
"secretKey": "string",
"skipSslVerification": true,
"timestamp": "2026-08-09T10:11:12Z"
}
}
Unauthorized
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
{
"errorCode": 400,
"errorDescription": "Bad input parameter"
}
Resource not found. The organisation has no webhook with the given ID, or the webhook is deleted.
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
{
"errorCode": 400,
"errorDescription": "Bad input parameter"
}
Internal server error
Response Headers
- application/json
- Schema
- Example (from schema)
Schema
{
"errorCode": 400,
"errorDescription": "Bad input parameter"
}