The webhook delivery log
- In the sandbox
Since 0.28.0. One webhook's deliveries, newest attempt first (never attempted last), with each delivery's state, failures and times and not the event itself. A client's key with the read scope reads its own webhook's (naming another client answers 404); the operator's key reads the operator's own webhook, or one client's with client; the read-only operator key reads the same. At most limit rows (default 100, at most 500), with truncated when there are more.
apiKeyAuthorizationBearer <token>Send your key as a bearer token: Authorization: Bearer <your-api-key>. Health is the only call that needs no key.
client?string^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$state?string"pending""delivered""dead"limit?integer1 <= value <= 500100The deliveries.
application/json- response
data*array<>truncated*booleancurl -X GET "https://example.com/webhook/deliveries" \ -H "Authorization: Bearer <your-api-key>"{ "data": [ { "invoice_id": "string", "sequence": 0, "event_id": "string", "state": "pending", "failures": 0, "first_failure_at": "2019-08-24T14:15:22Z", "last_attempt_at": "2019-08-24T14:15:22Z" } ], "truncated": true}Get the webhook settings (the operator's, or with a client's admin key that client's own) GET
Since 0.16.0 the operator's key reads one client's settings with client. A client's admin key may name only its own client; any other answers 404. An unknown or repeated parameter, or client given empty, answers 400. Setting and testing a webhook take no query parameters at all (400): they stay with the webhook's own key.
Set the webhook URL, or rotate its secret PUT
The operator's key sets the operator's webhook, which gets every client's events; a client's admin key sets that client's own, which gets only its events. The first call needs url and creates the secret, which is returned once. Rotating returns the new secret once. For 24 hours the service signs each delivery with both the new and the old secret, so the partner can switch without losing events. Only events written after the first call are delivered. The URL must be https, and every address its host resolves to must be public: loopback, private, link-local, carrier-grade NAT, multicast, reserved and cloud metadata addresses are refused, here and again before each delivery. Redirects are not followed. Since 0.16.0 any query parameter answers 400, so a misspelt client can never change the operator's own webhook.