PUT

Enable or disable webhook signing

Enables webhook signing, or requests that it be disabled, for an enterprise.

Enabling (signingEnabled: true) takes effect immediately. It is idempotent, and also cancels any pending disable request.

Disabling (signingEnabled: false) does not take effect immediately. It requires OTP verification and moves the enterprise to DISABLE_PENDING. Webhooks continue to be signed until the request is approved, at which point the status becomes DISABLED. If the request is denied, the status returns to ENABLED. The response includes a pendingDisableRequest with the evaluationId of the approval. Submitting a disable request while one is already pending returns a 409. Disabling when signing is already DISABLED is a no-op and returns the current settings.

Authorization: Caller must be an admin of the specified enterprise.

Path Params

enterpriseId string required

The enterprise ID.

Header Params

X-BitGo-OTP string

OTP code for verification. Required only when disabling webhook signing.

Body Params

object

Request to enable or disable webhook signing for an enterprise.

signingEnabled boolean required

true enables webhook signing immediately. false submits a request to disable signing, which requires OTP verification and approval before it takes effect.

Responses

200

Settings updated. When disabling, status is DISABLE_PENDING and signingEnabled remains true until the request is approved.

Response Body

object

Current webhook signing settings for an enterprise.

status string enum required
Webhook signing status for the enterprise.
- ENABLED: webhooks are signed.
- DISABLED: webhooks are not signed.
- DISABLE_PENDING: a request to disable signing is awaiting approval. Webhooks continue to be signed until the request is approved.
ENABLEDDISABLEDDISABLE_PENDING
signingEnabled boolean required

Whether webhooks are currently signed. true for ENABLED and DISABLE_PENDING, false for DISABLED.
updatedAt string date-time nullable

When the settings were last changed. null if the enterprise has never changed its settings, in which case status reflects the platform default.
pendingDisableRequest object nullable

Present only when status is DISABLE_PENDING.
pendingDisableRequest object
- evaluationId string uuid required
  
  ID of the policy evaluation that must be approved to complete the disable request.
- requestedBy string required
  
  ID of the user who requested that signing be disabled.
- requestedAt string date-time required
  
  When the disable request was submitted.

400

Bad Request

Response Body

ONE OF

code string
message string
status integer

code string
message string
status integer
failedValidations object

401

Unauthorized

Response Body

object

code string
message string
status integer

403

Forbidden

Response Body

object

code string
message string
status integer

409

Conflict - The request conflicts with the current state of the resource

Response Body

object

code string
message string
status integer

500

Server Error - Transient error please try again

Response Body

object

code string
message string
status integer

curl -X PUT \ --url 'https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/settings' \ --header 'accept: application/json' \ --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \ --header 'X-BitGo-OTP: string' \ --header 'content-type: application/json' \ --data '{, "signingEnabled": true }'

const url = 'https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/settings'; const options = { method: 'PUT', headers: {accept: 'application/json', 'Authorization': 'Bearer YOUR_ACCESS_TOKEN', 'X-BitGo-OTP': 'string', 'content-type': 'application/json'}, body: JSON.stringify({, "signingEnabled": true }) }; fetch(url, options) .then(res => res.json()) .then(json => console.log(json)) .catch(err => console.error(err));

require 'uri' require 'net/http' url = URI("https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/settings") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Put.new(url) request["accept"] = 'application/json' request["Authorization"] = 'Bearer YOUR_ACCESS_TOKEN' request["X-BitGo-OTP"] = 'string' request["content-type"] = 'application/json' request.body = '{, "signingEnabled": true }' response = http.request(request) puts response.read_body

<?php require_once('vendor/autoload.php'); $client = new \GuzzleHttp\Client(); $response = $client->request('PUT', 'https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/settings', [ 'headers' => [ 'accept' => 'application/json', 'Authorization' => 'Bearer YOUR_ACCESS_TOKEN', 'X-BitGo-OTP' => 'string', 'content-type' => 'application/json', ], 'body' => '{, "signingEnabled": true }', ]); echo $response->getBody();

import requests url = "https://app.bitgo-test.com/api/policy/v1/enterprises/enterpriseId/webhooks/settings" payload = {, "signingEnabled": true } headers = { "accept": "application/json", "Authorization": "Bearer YOUR_ACCESS_TOKEN", "X-BitGo-OTP": "string", "content-type": "application/json" } response = requests.put(url, json=payload, headers=headers) print(response.text)

{ "status": "ENABLED", "signingEnabled": true, "updatedAt": "2026-01-12T10:30:00Z", "pendingDisableRequest": { "evaluationId": "3b1f4c0e-6a52-4f0b-9d55-2f6c1f0a7e11", "requestedBy": "5f8d0d55b54764421b7156c3e3a3a0f1", "requestedAt": "2026-01-12T10:30:00Z" } }