# Configure the team webhook

Create or replace the team's webhook configuration.
- **Preconditions**: `callbackUrl` must be an HTTPS URL of 1 to 1024 characters, with a host, no user info, no fragment and a valid port. Every address it resolves to must be publicly routable; localhost, private, link-local, CGNAT, cloud metadata, protocol-reserved, documentation and 6to4 ranges are rejected. The same check runs again when a delivery opens its connection, so a name that later resolves into a private range fails that delivery instead of reaching your network.
- **Effect**: upserts the single configuration owned by the team in the server-side context. `teamId` is never read from the request, so a caller cannot configure another team. The Local API and Open API endpoints read and write the same record, and the response echoes what was stored.
- **Disabling**: `enabled: false` keeps the URL and stops new events from being created. Events already queued are cancelled one by one if the configuration is still disabled when they are next authorized, so re-enabling quickly lets them continue.
- **Retry**: safe. The save is an upsert keyed by team, so repeating the same request converges on the same state.
- **Client version**: requires MoreLogin client v2.66.0 or higher, because the desktop client is what exposes this route locally. The Open API endpoint has no client dependency.

See [Webhooks](../Getting%20Started/webhooks.md) for the callback contract, event names and retry schedule.
Documented business errors: `41001`. See [Error Codes](../Getting%20Started/error-codes.md) for what each code means. Any operation can additionally return the common codes.

Endpoint: POST /api/webhook/config
Version: 2026-09-05

## Request fields (application/json):

  - `callbackUrl` (string, required)
    HTTPS URL that receives the events. 1 to 1024 characters.

  - `enabled` (boolean, required)
    Whether delivery is enabled for the team.

## Response 200:

  - `200` (unknown)
    Success. `data` is an object with the fields `callbackUrl` and `enabled`, echoing the stored configuration.

## Response 200 fields (application/json):

  - `code` (integer, required)
    Return result code 0:Normal Other codes are exceptions.

  - `msg` (string | null, required)
    error message

  - `data` (object, required)

  - `data.callbackUrl` (string)
    The stored HTTPS callback URL.

  - `data.enabled` (boolean)
    Whether delivery is enabled for the team.

  - `requestId` (string, required)
    Operation Request ID