`bird webhooks client-certificate update`

Usage

Code example

bird webhooks client-certificate update [flags]

Description

Update the webhook client certificate settings

Send a test event with bird webhooks test to each webhook that is not a connector endpoint or an MCP Events subscription while the mode is evaluating, and check that client_certificate is presented, before you set enforced. In enforced, a delivery attempt fails when the receiver does not ask for the certificate or rejects it. Test sends apply a change at once. Deliveries can take a few minutes.

Build the request from flags, a JSON WebhookClientCertificateUpdate body via --body-file ("-" reads stdin), or both — a flag overrides the matching body field. Run --example to print a ready-to-edit body, or --dry-run to print the resolved request without sending it.

Browser confirmation: the review link goes to stderr, not stdout, as next[].url in a JSON line that also carries confirmation_id. The command then waits and prints the result on stdout; --confirmation-id waits on an existing one.

Procedure

Step 4 of 6 of "Present a client certificate on webhook deliveries". Previous: bird webhooks client-certificate upload. Next: bird webhooks test. Step 6 of 6 of "Present a client certificate on webhook deliveries". Previous: bird webhooks test.

Examples

Code example

# print the body shape (no credentials needed)
bird webhooks client-certificate update --example

# the body it prints:

Code example

{
  "crl_check": "disabled",
  "state": "disabled"
}

Options

Request

Name	Description
`--body-file`	Read the JSON request body from this file; "-" reads stdin
`--example`	Print a complete example request body, then exit
`--dry-run`	Print the resolved request without sending it, then exit
`--idempotency-key`	Deduplication key; a retry with the same key won't act twice

Options

Name	Description
`--state`	Whether client certificates are off (disabled), checked while the previous behavior stays available (evaluating), or required (enforced). Possible values: disabled, evaluating, enforced.
`--crl-check`	How a certificate chain is checked against the certificate revocation list (CRL) that each certificate names. With full_chain, the leaf certificate and each intermediate certificate below the trusted root are checked. A certificate that names no CRL is not checked. Possible values: disabled, full_chain.
`--response-schema`	Print the fields this command returns, then exit
`--confirmation-id`	Wait for an existing confirmation of this exact request

Name	Description
`bird webhooks client-certificate create-signing-request`	Create a webhook client certificate signing request
`bird webhooks client-certificate get`	Get the webhook client certificate
`bird webhooks client-certificate upload`	Upload the webhook client certificate

Continue with the documentation, guides and examples for this topic.

Get an implementation brief

Related resources