diff --git a/mintlify/openapi.yaml b/mintlify/openapi.yaml
index 6a2a8401..15090ca1 100644
--- a/mintlify/openapi.yaml
+++ b/mintlify/openapi.yaml
@@ -8104,6 +8104,14 @@ components:
           example: mycompany.com
         webhookEndpoint:
           type: string
+          format: uri
+          pattern: ^https://
+          minLength: 9
+          description: |
+            HTTPS URL where Grid will POST webhook events. Must use the `https://` scheme;
+            `http://`, raw hostnames, and empty strings are rejected. Localhost and private
+            hostnames are not supported in production. To clear the webhook endpoint, omit
+            this field from the request rather than sending an empty string.
           example: https://api.mycompany.com/webhooks/uma
         supportedCurrencies:
           type: array
diff --git a/openapi.yaml b/openapi.yaml
index 6a2a8401..15090ca1 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -8104,6 +8104,14 @@ components:
           example: mycompany.com
         webhookEndpoint:
           type: string
+          format: uri
+          pattern: ^https://
+          minLength: 9
+          description: |
+            HTTPS URL where Grid will POST webhook events. Must use the `https://` scheme;
+            `http://`, raw hostnames, and empty strings are rejected. Localhost and private
+            hostnames are not supported in production. To clear the webhook endpoint, omit
+            this field from the request rather than sending an empty string.
           example: https://api.mycompany.com/webhooks/uma
         supportedCurrencies:
           type: array
diff --git a/openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml b/openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml
index 9222e4c1..da93c8bd 100644
--- a/openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml
+++ b/openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml
@@ -5,6 +5,14 @@ properties:
     example: mycompany.com
   webhookEndpoint:
     type: string
+    format: uri
+    pattern: '^https://'
+    minLength: 9
+    description: |
+      HTTPS URL where Grid will POST webhook events. Must use the `https://` scheme;
+      `http://`, raw hostnames, and empty strings are rejected. Localhost and private
+      hostnames are not supported in production. To clear the webhook endpoint, omit
+      this field from the request rather than sending an empty string.
     example: https://api.mycompany.com/webhooks/uma
   supportedCurrencies:
     type: array