Partial update of a webhook subscription's URL, ownership scope, subscribed events, description, and metadata. A routing/configuration change atomically advances configurationGeneration, cancels attempts whose network request has not begun, and applies only to newly accepted events. A request already started before the commit may finish, but cannot schedule another attempt. Changing scope requires platform.webhook:write on both the stored and proposed scope and atomically transfers quota from the old partition to the new partition; the request returns 409 without changing either partition when the destination would exceed 100. Secret rotation uses rotateWebhookSecret. When supplied, Idempotency-Key snapshots the successful response so a retry cannot apply the PATCH twice; reuse with a different request body returns 409 IdempotencyKeyConflict.