title: How does Event Grid + CloudEvents + Webhooks support updating the access_token?
body: <p>CloudEvents has a webhooks specification for event delivery: <a href="https://github.com/cloudevents/spec/blob/master/http-webhook.md" rel="nofollow noreferrer">HTTP 1.1 Web Hooks for Event Delivery - Version 1.0</a>.  Among other things, the CloudEvents Webhooks spec details requirements for webhook validation and authorization.  As described in the spec, CloudEvents webhooks authorization methods "lean on the OAuth 2.0 Bearer Token RFC6750 model".</p>
  
  <p>Azure Event Grid supports CloudEvents: <a href="https://docs.microsoft.com/en-us/azure/event-grid/cloudevents-schema" rel="nofollow noreferrer">Use CloudEvents v1.0 schema with Event Grid</a></p>
  
  <p>Event Grid's support for webhook authorization is limited to "adding query parameters to the webhook URL when creating an Event Subscription" as described here: <a href="https://docs.microsoft.com/en-us/azure/event-grid/security-authentication#authenticate-event-delivery-to-webhook-endpoints-using-azure-ad" rel="nofollow noreferrer">Authenticating access to Azure Event Grid resources</a>.</p>
  
  <p><strong>Given that an OAuth bearer token can have a <a href="https://www.oauth.com/oauth2-servers/access-tokens/access-token-lifetime/" rel="nofollow noreferrer">limited lifetime</a>, I therefore need a way to refresh the token.  However, as far as I can tell Event Grid provides no mechanism other than hard-coding the token in the query parameter at the time the webhook subscription is defined.</strong></p>
  
  <p><strong>Is my understanding correct?  Any recommendations?</strong></p>
  
  <p>EDIT: In this scenario the webhook endpoint is an external endpoint not hosted on Azure.  It is a 3rd party endpoint that simply supports the CloudEvents webhooks specification.</p>