> ## Documentation Index > Fetch the complete documentation index at: https://docs.fluid.app/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract. > Authenticate with the header Authorization: Bearer ; public storefront read endpoints require no auth. > Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null. > Never use /api/company/v1 or /api/v1 paths, page/per_page params, or offset pagination — they are legacy. > The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/auth-v0.yaml covers the unversioned auth surface (/api/... paths — authentication, MFA, social auth, and token exchange); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas). > Successful responses wrap the resource payload alongside a top-level integer status and a meta object. # Update a webhook > Updates a webhook subscription. The body accepts `url`, `active`, `auth_token`, and `http_method`; `resource` and `event` are fixed at creation — retarget by deleting and recreating. Rotate the signing secret by sending a new `auth_token`. Returns `200` with the updated subscription, `404` when the id is unknown, and `422` when the body fails validation. Requires a company Bearer token (`401` otherwise). ## OpenAPI ````yaml /api-reference/webhooks-v0.yaml put /api/company/webhooks/{id} openapi: 3.1.0 info: title: Fluid Webhooks API description: >- Webhook subscriptions, callback registrations, webhook/callback schemas, and company events. version: v0 contact: email: support@fluid.app license: name: Proprietary identifier: LicenseRef-Proprietary servers: - url: https://api.fluid.app - url: https://{company}.fluid.app description: Production server with company subdomain variables: company: default: myco description: Company subdomain security: [] tags: - name: webhooks description: >- Webhook subscriptions — create, list, update, delete, and inspect the most recent delivered event per resource. - name: webhooks-resources description: The catalog of resources (and their events) a webhook may subscribe to. - name: webhook-schemas description: >- Published JSON payload schemas for webhook events, keyed by event identifier. - name: callback-registrations description: >- Synchronous callback registrations that let a company or droplet respond to Fluid callbacks (e.g. tax, shipping). - name: callback-definitions description: The catalog of callback definitions a registration can target. - name: callback-schemas description: Request/response schemas for each callback definition. - name: company-events description: >- Company calendar events surfaced to members, with optional country-scoped notifications. paths: /api/company/webhooks/{id}: put: tags: - webhooks summary: Update a webhook description: > Updates a webhook subscription. The body accepts `url`, `active`, `auth_token`, and `http_method`; `resource` and `event` are fixed at creation — retarget by deleting and recreating. Rotate the signing secret by sending a new `auth_token`. Returns `200` with the updated subscription, `404` when the id is unknown, and `422` when the body fails validation. Requires a company Bearer token (`401` otherwise). operationId: webhooks_v0_update_webhook parameters: - name: id in: path schema: type: string required: true description: > Identifier of the webhook subscription — the numeric `id` returned at create, carried as a path segment. requestBody: content: application/json: schema: type: object properties: webhook: type: object properties: url: type: string active: type: boolean auth_token: type: string http_method: type: string enum: - post - put - get examples: deactivate: summary: Disable a subscription without deleting it value: webhook: active: false rotate_secret: summary: Rotate the signing secret value: webhook: auth_token: n2P5sQ8vB1xZ4aD7cF0hK3mR6tW9yE2 update_endpoint: summary: Point the subscription at a new URL and delivery method value: webhook: url: https://hooks.acme-wellness.com/fluid/orders-v2 http_method: post responses: '200': description: Webhook updated content: application/json: schema: type: object required: - webhook properties: webhook: $ref: '#/components/schemas/WebhookSummary' meta: $ref: '#/components/schemas/Meta' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/UnauthorizedResponse' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '422': description: Unprocessable entity content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearer_auth: [] components: schemas: WebhookSummary: description: Webhook subscription type: object properties: id: type: integer description: > Numeric identifier of the webhook subscription, assigned at create. Used to address the subscription on the `/api/company/webhooks/{id}` endpoints. company_id: type: integer description: Id of the company that owns the subscription. droplet_installation_uuid: description: >- UUID of the droplet installation that owns the webhook, or null when the webhook is company-owned. type: - string - 'null' url: type: string description: > HTTPS endpoint Fluid delivers matching events to. In production it must be publicly reachable — Fluid does not deliver to internal or private hosts. active: type: boolean description: | Whether the subscription is enabled. When `false`, Fluid keeps the subscription but delivers nothing. resource: type: - string - 'null' description: > The resource being watched (e.g. `order`, `cart`, `member`); set when the subscription is created. May be `null` in the response for a subscription without one. event: type: - string - 'null' description: > The event on the resource that triggers delivery (e.g. `created`); set at create alongside `resource`. May be `null` in the response for a subscription without one. event_identifier: type: - string - 'null' description: > Identifier Fluid uses for this event's payload schema (e.g. `order_created`). Look up the schema under `/api/webhooks/schemas`. http_method: type: string enum: - post - put - get description: HTTP method Fluid uses to deliver the payload to `url`. auth_token: type: - string - 'null' description: > Shared secret Fluid signs each delivery with; `null` when none is set. Rotate it by sending a new value to the update endpoint. created_at: type: string format: date-time description: Timestamp when the subscription was created (ISO 8601). updated_at: type: string format: date-time description: Timestamp when the subscription was last updated (ISO 8601). Meta: type: object properties: request_id: type: - string - 'null' timestamp: type: string format: date-time UnauthorizedResponse: type: object properties: message: type: string required: - message ErrorResponse: type: object required: - error_message - errors - meta properties: error_message: type: string errors: $ref: '#/components/schemas/ErrorBag' meta: $ref: '#/components/schemas/Meta' ErrorBag: description: >- Validation errors keyed by field, a list of errors, a single error message, or null when no structured error details are available. anyOf: - type: string - type: array items: $ref: '#/components/schemas/ErrorValue' - type: object additionalProperties: $ref: '#/components/schemas/ErrorValue' - type: 'null' ErrorValue: description: A validation or API error value. anyOf: - type: string - type: array items: type: string - type: object additionalProperties: $ref: '#/components/schemas/JsonValue' JsonValue: description: >- Any valid JSON value for provider, integration, theme, metadata, or other dynamic payloads whose keys are not fixed by the API contract. anyOf: - type: string - type: number - type: boolean - type: 'null' - type: array items: $ref: '#/components/schemas/JsonValue' - type: object additionalProperties: $ref: '#/components/schemas/JsonValue' securitySchemes: bearer_auth: type: http scheme: bearer description: Bearer token authentication ````