> ## Documentation Index > Fetch the complete documentation index at: https://docs.slash.com/llms.txt > Use this file to discover all available pages before exploring further. # Update the authorization webhook > Change part of an account's authorization webhook. Omitted fields keep their value. ## OpenAPI ````yaml /openapi-v2.json patch /v2/accounts/{accountId}/authorization-webhook openapi: 3.1.0 info: title: Slash Public API V2 description: >- Send money for a Slash legal entity. Every request uses an API key. Transfer creation returns a Transfer that links its resulting transactions. version: 0.0.1 servers: - url: https://api.slash.com description: production security: - api_key: [] paths: /v2/accounts/{accountId}/authorization-webhook: parameters: - name: x-legal-entity in: header required: true description: >- The legal entity to act on. Required on every request except `GET /v2/legal-entities`, which lists the ids a user API key can send here: those of every legal entity its user has access to. schema: type: string pattern: ^le_[a-zA-Z0-9]+$ - name: accountId in: path required: true description: Account id with the `sa_group_` prefix. schema: type: string patch: summary: Update the authorization webhook description: >- Change part of an account's authorization webhook. Omitted fields keep their value. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/authorization-webhook-update' example: status: active responses: '200': description: The authorization webhook. content: application/json: schema: $ref: '#/components/schemas/authorization-webhook' '400': $ref: >- #/components/responses/PublicApiV2Error400AuthorizationWebhooksUpdate '401': $ref: '#/components/responses/PublicApiV2Error401Unauthorized' '403': $ref: >- #/components/responses/PublicApiV2Error403AuthorizationWebhooksNotEnabledForbiddenLegalEntityNotAvailableUserApiKeyRequired '404': $ref: '#/components/responses/PublicApiV2Error404NotFound' '429': $ref: '#/components/responses/PublicApiV2RateLimited' '500': $ref: '#/components/responses/PublicApiV2Error500Internal' security: - api_key: [] components: schemas: authorization-webhook-update: title: AuthorizationWebhookUpdate description: Omitted fields keep their value. type: object properties: webhookUrl: type: string description: Where Slash sends authorization requests. example: https://example.com/slash/authorize status: type: string enum: - active - inactive description: Slash only sends requests to an `active` webhook. config: $ref: '#/components/schemas/authorization-webhook-config' additionalProperties: false authorization-webhook: title: AuthorizationWebhook description: >- An endpoint of yours that approves or declines each card authorization on an account before Slash answers the card network. An account has at most one. type: object properties: webhookUrl: type: string description: Where Slash sends authorization requests. example: https://example.com/slash/authorize signingSecret: type: string description: >- Signs every request Slash sends. It is set when the webhook is created and does not change. status: type: string enum: - active - inactive description: Slash only sends requests to an `active` webhook. timeoutDurationMs: type: integer description: >- How long Slash waits for an answer before applying `config`, in milliseconds. example: 1500 config: $ref: '#/components/schemas/authorization-webhook-config' createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - webhookUrl - signingSecret - status - timeoutDurationMs - config - createdAt - updatedAt additionalProperties: false authorization-webhook-config: title: AuthorizationWebhookConfig description: >- What happens to an authorization the webhook does not answer: it times out, returns an invalid response or cannot be reached, or Slash cannot consult it at all. oneOf: - $ref: '#/components/schemas/authorization-webhook-config-reject' - $ref: '#/components/schemas/authorization-webhook-config-default' discriminator: propertyName: fallbackBehavior mapping: reject: '#/components/schemas/authorization-webhook-config-reject' default: '#/components/schemas/authorization-webhook-config-default' PublicApiV2ErrorAuthorizationWebhookUrlNotHttps: title: PublicApiV2ErrorAuthorizationWebhookUrlNotHttps description: >- Slash only sends authorization requests to `https://` URLs. Use an HTTPS endpoint. allOf: - $ref: '#/components/schemas/Error' - type: object properties: code: type: string enum: - webhook_url_not_https details: type: object properties: field: type: string description: Dot path of the request field at fault. id: type: string description: The identifier that field carried, when it is one. additionalProperties: false required: - code - details PublicApiV2ErrorInvalidRequestShape: title: PublicApiV2ErrorInvalidRequestShape description: >- The body, query, or headers failed validation, or a required header is missing. `details` has one entry per failing location, keyed by JSON pointer or header name. allOf: - $ref: '#/components/schemas/Error' - type: object properties: code: type: string enum: - invalid_request details: type: object properties: {} additionalProperties: type: string required: - code - details PublicApiV2ErrorUnauthorized: title: PublicApiV2ErrorUnauthorized description: API key authentication is missing or invalid. allOf: - $ref: '#/components/schemas/Error' - type: object properties: code: type: string enum: - unauthorized details: type: object properties: {} additionalProperties: false required: - code - details PublicApiV2ErrorAuthorizationWebhooksNotEnabled: title: PublicApiV2ErrorAuthorizationWebhooksNotEnabled description: >- Authorization webhooks are an Enterprise feature. Contact Slash sales to enable it. allOf: - $ref: '#/components/schemas/Error' - type: object properties: code: type: string enum: - authorization_webhooks_not_enabled details: type: object properties: {} additionalProperties: false required: - code - details PublicApiV2ErrorForbiddenLegalEntity: title: PublicApiV2ErrorForbiddenLegalEntity description: The credential is not permitted to act for the selected legal entity. allOf: - $ref: '#/components/schemas/Error' - type: object properties: code: type: string enum: - forbidden details: type: object properties: {} additionalProperties: false required: - code - details PublicApiV2ErrorNotAvailable: title: PublicApiV2ErrorNotAvailable description: >- Public API v2 is not yet available. Use [Public API v1](https://docs.slash.com/introduction) in the meantime. allOf: - $ref: '#/components/schemas/Error' - type: object properties: code: type: string enum: - not_available details: type: object properties: {} additionalProperties: false required: - code - details PublicApiV2ErrorUserApiKeyRequired: title: PublicApiV2ErrorUserApiKeyRequired description: >- The API key is scoped to a legal entity rather than a user. Every v2 request needs a user API key, created under Settings → API keys in the Slash dashboard, together with the `x-legal-entity` header. allOf: - $ref: '#/components/schemas/Error' - type: object properties: code: type: string enum: - user_api_key_required details: type: object properties: {} additionalProperties: false required: - code - details PublicApiV2ErrorNotFound: title: PublicApiV2ErrorNotFound description: >- No resource matches the identifier. When the identifier is a field of the request, `details` names that `field` and the `id` it received. allOf: - $ref: '#/components/schemas/Error' - type: object properties: code: type: string enum: - not_found details: type: object properties: field: type: string description: Dot path of the request field at fault. id: type: string description: The identifier that field carried, when it is one. additionalProperties: false required: - code - details PublicApiV2ErrorInternal: title: PublicApiV2ErrorInternal description: >- Slash could not complete the request. Quote `referenceId` when contacting Slash support. allOf: - $ref: '#/components/schemas/Error' - type: object properties: code: type: string enum: - internal details: type: object properties: {} additionalProperties: false required: - code - details authorization-webhook-config-reject: title: AuthorizationWebhookConfigReject description: Decline the authorization. type: object properties: fallbackBehavior: type: string enum: - reject required: - fallbackBehavior additionalProperties: false authorization-webhook-config-default: title: AuthorizationWebhookConfigDefault description: >- Continue the authorization through Slash's own checks, such as balance and limits. With `when`, only authorizations that match it continue; the rest are declined. type: object properties: fallbackBehavior: type: string enum: - default when: $ref: '#/components/schemas/authorization-webhook-condition' required: - fallbackBehavior additionalProperties: false Error: type: object properties: code: type: string description: >- Machine-readable reason; branch on this, not on `message`. Every code an endpoint can return is listed on its reference page; the ones shared by all endpoints are explained in the Errors guide. example: invalid_request message: type: string description: >- Human-readable explanation, safe to show to an operator. Wording may change; use `code` and `details` programmatically. details: type: object description: >- The values behind `message`, keyed per `code`. For example `insufficient_funds` carries `available` and `requested`; `invalid_request` from contract validation carries one entry per failing field, keyed by JSON pointer. Empty when the code has no variable data. additionalProperties: type: string example: available: $120.00 requested: $500.00 referenceId: type: string description: Unique id of this failure. Quote it when contacting Slash support. example: 4001-2alj5if required: - code - message - details - referenceId additionalProperties: false title: Error authorization-webhook-condition: title: AuthorizationWebhookCondition description: >- A condition on a card authorization. `and` and `or` combine two conditions and nest, up to 16 levels deep. A comparison tests `amountCents`, the absolute amount in USD cents. `in` tests whether the four-digit `merchantCategoryCode` or the ISO 3166-1 alpha-2 `merchantCountry` is one of `values`. A condition on a field the authorization did not carry is false. oneOf: - type: object title: Logical properties: operator: type: string enum: - and - or left: $ref: '#/components/schemas/authorization-webhook-condition' right: $ref: '#/components/schemas/authorization-webhook-condition' required: - operator - left - right additionalProperties: false - type: object title: Amount comparison properties: operator: type: string enum: - lte - lt - gte - gt - eq field: type: string enum: - amountCents value: type: integer description: USD cents. example: 2000 required: - operator - field - value additionalProperties: false - type: object title: Set membership properties: operator: type: string enum: - in field: type: string enum: - merchantCategoryCode - merchantCountry values: type: array items: type: string example: - '7311' required: - operator - field - values additionalProperties: false responses: PublicApiV2Error400AuthorizationWebhooksUpdate: description: >- - `webhook_url_not_https` — Slash only sends authorization requests to `https://` URLs. Use an HTTPS endpoint. - `invalid_request (request shape)` — The body, query, or headers failed validation, or a required header is missing. `details` has one entry per failing location, keyed by JSON pointer or header name. content: application/json: schema: anyOf: - title: webhook_url_not_https allOf: - $ref: >- #/components/schemas/PublicApiV2ErrorAuthorizationWebhookUrlNotHttps - title: invalid_request (request shape) allOf: - $ref: '#/components/schemas/PublicApiV2ErrorInvalidRequestShape' examples: webhook_url_not_https_webhook_url: summary: webhook_url_not_https (webhookUrl) value: code: webhook_url_not_https message: The webhook URL must use HTTPS. details: field: webhookUrl referenceId: 4001-2alj5if invalid_request_request_shape: summary: invalid_request (request shape) value: code: invalid_request message: >- Invalid `accountId`: Expected a valid ID beginning with "sa_group_". details: /accountId: Expected a valid ID beginning with "sa_group_". referenceId: 4001-2alj5if PublicApiV2Error401Unauthorized: description: '- `unauthorized` — API key authentication is missing or invalid.' content: application/json: schema: $ref: '#/components/schemas/PublicApiV2ErrorUnauthorized' examples: unauthorized: summary: unauthorized value: code: unauthorized message: API key authentication is missing or invalid. details: {} referenceId: 4011-2alj5if PublicApiV2Error403AuthorizationWebhooksNotEnabledForbiddenLegalEntityNotAvailableUserApiKeyRequired: description: >- - `authorization_webhooks_not_enabled` — Authorization webhooks are an Enterprise feature. Contact Slash sales to enable it. - `forbidden (legal entity)` — The credential is not permitted to act for the selected legal entity. - `not_available` — Public API v2 is not yet available. Use [Public API v1](https://docs.slash.com/introduction) in the meantime. - `user_api_key_required` — The API key is scoped to a legal entity rather than a user. Every v2 request needs a user API key, created under Settings → API keys in the Slash dashboard, together with the `x-legal-entity` header. content: application/json: schema: anyOf: - title: authorization_webhooks_not_enabled allOf: - $ref: >- #/components/schemas/PublicApiV2ErrorAuthorizationWebhooksNotEnabled - title: forbidden (legal entity) allOf: - $ref: '#/components/schemas/PublicApiV2ErrorForbiddenLegalEntity' - title: not_available allOf: - $ref: '#/components/schemas/PublicApiV2ErrorNotAvailable' - title: user_api_key_required allOf: - $ref: '#/components/schemas/PublicApiV2ErrorUserApiKeyRequired' examples: authorization_webhooks_not_enabled: summary: authorization_webhooks_not_enabled value: code: authorization_webhooks_not_enabled message: Authorization webhooks are not enabled. details: {} referenceId: 4031-2alj5if forbidden_legal_entity: summary: forbidden (legal entity) value: code: forbidden message: This credential is not permitted to do that. details: {} referenceId: 4031-2alj5if not_available: summary: not_available value: code: not_available message: >- Public API v2 is not yet available. Use Public API v1 (https://docs.slash.com/introduction) in the meantime. details: {} referenceId: 4031-2alj5if user_api_key_required: summary: user_api_key_required value: code: user_api_key_required message: >- Public API v2 requires a user API key. Create one under Settings → API keys in the Slash dashboard. details: {} referenceId: 4031-2alj5if PublicApiV2Error404NotFound: description: >- - `not_found` — No resource matches the identifier. When the identifier is a field of the request, `details` names that `field` and the `id` it received. content: application/json: schema: $ref: '#/components/schemas/PublicApiV2ErrorNotFound' examples: not_found: summary: not_found value: code: not_found message: The requested resource was not found. details: {} referenceId: 4041-2alj5if PublicApiV2RateLimited: description: >- The request exceeded the applicable rate limit. The response body is plain text, not the error object; clients must not depend on its wording. content: text/plain: schema: type: string example: You are rate limited PublicApiV2Error500Internal: description: >- - `internal` — Slash could not complete the request. Quote `referenceId` when contacting Slash support. content: application/json: schema: $ref: '#/components/schemas/PublicApiV2ErrorInternal' examples: internal: summary: internal value: code: internal message: >- An unexpected error occurred. If this keeps happening, contact Slash support with the reference id below. details: {} referenceId: 5001-2alj5if securitySchemes: api_key: type: apiKey name: X-API-Key in: header description: >- User API key authentication. Create a key under Settings → API keys in the Slash dashboard (https://app.slash.com/global-settings/api-keys) and send the `x-legal-entity` header naming the legal entity to act on with every request. Keys scoped to a legal entity are rejected with `403 user_api_key_required`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.