Webhooks & events
Webhook endpoints, deliveries and the Events API.
- GETList webhook endpoints
- POSTCreate a webhook endpoint
- GETRetrieve a webhook endpoint
- PATCHUpdate a webhook endpoint
- DELETEDelete a webhook endpoint
- POSTRoll a webhook signing secret
- GETReveal a webhook signing secret
- POSTSend a test event
- GETList recent deliveries
- POSTRetry a delivery
- GETList events
- GETRetrieve an event
- GETList event types
List webhook endpoints
/v1/webhook-endpointsSDKlistener.webhookEndpoints.list()client.webhook_endpoints.list()
Returns
200OK
objectstringrequiredurlstringrequireddataarray of objectsrequiredShow child attributesHide child attributes
has_morebooleanrequired- Pass as
next_cursorstringrequiredcursorto get the next page; null on the last page. - The result's non-list fields (window, coverage, freshness, totals, note …).
metaobjectrequired
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found429rate_limited500internal_error
Create a webhook endpoint
/v1/webhook-endpointsReturns the signing secret (whsec_…) once. Up to 16 endpoints per workspace.
- Send
"dry_run": trueto get{"object": "dry_run", "would_write": …}without writing anything.
SDKlistener.webhookEndpoints.create()client.webhook_endpoints.create()
Headers
- Any unique string (≤ 255 chars). Replays within 24 h return the stored response with Idempotent-Replayed: true.
Idempotency-Keystring
Request body
application/json- HTTPS URL that receives POSTed events.
urlstringrequired - Event types to deliver, or ["*"] for all. See GET /v1/event-types.
enabled_eventsarray of stringsrequired - Free-text note shown in the dashboard.
descriptionstring - Validate and return what would be written without calling the service.
dry_runbooleanDefault
false
Returns
200OK
One of:
WebhookEndpoint
DryRun
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found409confirmation_required413body_too_large429rate_limited500internal_error
Retrieve a webhook endpoint
/v1/webhook-endpoints/{endpoint_id}SDKlistener.webhookEndpoints.retrieve()client.webhook_endpoints.retrieve()
Path parameters
- Webhook endpoint id (we_…).
endpoint_idstringrequired
Returns
200OK
objectanyrequired- we_…
idstringrequired urlstring (uri)requiredenabled_eventsarray of stringsrequiredstatusstringrequiredOne ofenableddisableddescriptionstringdisabled_reasonstring- whsec_… — returned only on create and roll-secret.
secretstring secret_last4stringexpires_previous_atstring (date-time)api_versionstringcreated_atstring (date-time)updated_atstring (date-time)
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found429rate_limited500internal_error
Update a webhook endpoint
/v1/webhook-endpoints/{endpoint_id}- Send
"dry_run": trueto get{"object": "dry_run", "would_write": …}without writing anything.
SDKlistener.webhookEndpoints.update()client.webhook_endpoints.update()
Path parameters
- Webhook endpoint id (we_…).
endpoint_idstringrequired
Headers
- Any unique string (≤ 255 chars). Replays within 24 h return the stored response with Idempotent-Replayed: true.
Idempotency-Keystring
Request body
application/json- New HTTPS URL.
urlstring - Event types to deliver, or ["*"].
enabled_eventsarray of strings - Free-text note.
descriptionstring - true pauses deliveries; false re-enables the endpoint.
disabledboolean - Validate and return what would be written without calling the service.
dry_runbooleanDefault
false
Returns
200OK
One of:
WebhookEndpoint
DryRun
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found409confirmation_required413body_too_large429rate_limited500internal_error
Delete a webhook endpoint
/v1/webhook-endpoints/{endpoint_id}- Send
?dry_run=trueto get{"object": "dry_run", "would_write": …}without writing anything.
SDKlistener.webhookEndpoints.delete()client.webhook_endpoints.delete()
Path parameters
- Webhook endpoint id (we_…).
endpoint_idstringrequired
Query parameters
- Validate and return what would be written without calling the service.
dry_runbooleanDefault
false
Headers
- Any unique string (≤ 255 chars). Replays within 24 h return the stored response with Idempotent-Replayed: true.
Idempotency-Keystring
Returns
200OK
One of:
WebhookEndpoint
DryRun
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found409confirmation_required413body_too_large429rate_limited500internal_error
Roll a webhook signing secret
/v1/webhook-endpoints/{endpoint_id}/roll-secretReturns the new secret once; the previous one keeps signing until expires_previous_at.
- Send
"dry_run": trueto get{"object": "dry_run", "would_write": …}without writing anything.
SDKlistener.webhookEndpoints.rollSecret()client.webhook_endpoints.roll_secret()
Path parameters
- Webhook endpoint id (we_…).
endpoint_idstringrequired
Headers
- Any unique string (≤ 255 chars). Replays within 24 h return the stored response with Idempotent-Replayed: true.
Idempotency-Keystring
Request body
application/json- Hours the previous secret keeps signing (0–168).
expire_previous_in_hoursintegerDefault
24 - Validate and return what would be written without calling the service.
dry_runbooleanDefault
false
Returns
200OK
One of:
WebhookEndpoint
DryRun
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found409confirmation_required413body_too_large429rate_limited500internal_error
Reveal a webhook signing secret
/v1/webhook-endpoints/{endpoint_id}/secretThe endpoint's current signing secret (whsec_…), as the dashboard's "Reveal" shows it, plus previous_secret_expires_at while a rolled secret still signs. Needs webhooks:write because the secret lets its holder forge deliveries. Never cached (Cache-Control: no-store, no ETag).
SDKlistener.webhookEndpoints.retrieveSecret()client.webhook_endpoints.retrieve_secret()
Path parameters
- Webhook endpoint id (we_…).
endpoint_idstringrequired
Returns
200OK
objectanyrequired- we_…
idstringrequired - whsec_… — verify Listener-Signature with it.
secretstringrequired secret_last4string- Set while a rolled secret still signs deliveries.
previous_secret_expires_atstring (date-time)
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found429rate_limited500internal_error
Send a test event
/v1/webhook-endpoints/{endpoint_id}/test- Send
"dry_run": trueto get{"object": "dry_run", "would_write": …}without writing anything.
SDKlistener.webhookEndpoints.test()client.webhook_endpoints.test()
Path parameters
- Webhook endpoint id (we_…).
endpoint_idstringrequired
Headers
- Any unique string (≤ 255 chars). Replays within 24 h return the stored response with Idempotent-Replayed: true.
Idempotency-Keystring
Request body
application/json- Event type to send.
event_typestringDefault
"webhook_endpoint.test" - Validate and return what would be written without calling the service.
dry_runbooleanDefault
false
Returns
200OK
One of:
WebhookDelivery
DryRun
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found409confirmation_required413body_too_large429rate_limited500internal_error
List recent deliveries
/v1/webhook-endpoints/{endpoint_id}/deliveriesSDKlistener.webhookEndpoints.deliveries.list()client.webhook_endpoints.deliveries.list()
Path parameters
- Webhook endpoint id (we_…).
endpoint_idstringrequired
Query parameters
- Page size, 1–100 (default 25).
limitintegerDefault
25 - Opaque cursor from the previous page's next_cursor.
cursorstring
Returns
200OK
objectstringrequiredurlstringrequireddataarray of objectsrequiredShow child attributesHide child attributes
has_morebooleanrequired- Pass as
next_cursorstringrequiredcursorto get the next page; null on the last page. - The result's non-list fields (window, coverage, freshness, totals, note …).
metaobjectrequired
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found429rate_limited500internal_error
Retry a delivery
/v1/webhook-deliveries/{delivery_id}/retry- Send
"dry_run": trueto get{"object": "dry_run", "would_write": …}without writing anything.
SDKlistener.webhookDeliveries.retry()client.webhook_deliveries.retry()
Path parameters
- Delivery id (wd_…).
delivery_idstringrequired
Headers
- Any unique string (≤ 255 chars). Replays within 24 h return the stored response with Idempotent-Replayed: true.
Idempotency-Keystring
Request body
application/json- Validate and return what would be written without calling the service.
dry_runbooleanDefault
false
Returns
200OK
One of:
WebhookDelivery
DryRun
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found409confirmation_required413body_too_large429rate_limited500internal_error
List events
/v1/eventsNewest first. Events are kept for 30 days.
SDKlistener.events.list()client.events.list()
Query parameters
- Only events of this type (e.g. campaign.updated).
typestring - Only events created at or after this ISO 8601 time.
created_gtestring - Only events created at or before this ISO 8601 time.
created_ltestring - Page size, 1–100 (default 25).
limitintegerDefault
25 - Opaque cursor from the previous page's next_cursor.
cursorstring
Returns
200OK
objectstringrequiredurlstringrequireddataarray of objectsrequiredShow child attributesHide child attributes
has_morebooleanrequired- Pass as
next_cursorstringrequiredcursorto get the next page; null on the last page. - The result's non-list fields (window, coverage, freshness, totals, note …).
metaobjectrequired
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found429rate_limited500internal_error
Retrieve an event
/v1/events/{event_id}SDKlistener.events.retrieve()client.events.retrieve()
Path parameters
- Event id (evt_…).
event_idstringrequired
Returns
200OK
objectanyrequired- evt_…
idstringrequired typestringrequiredcreatedstring (date-time)requireddataobjectrequiredShow child attributesHide child attributes
api_versionstringworkspace_idstringsourcestringOne ofapiappsystemrequestobjectShow child attributesHide child attributes
Errors
400parameter_invalid401credential_invalid403scope_missing404resource_not_found429rate_limited500internal_error
List event types
/v1/event-typesEvery event type with a description and an example payload. No authentication.
SDKlistener.eventTypes.list()client.event_types.list()
Returns
200OK
objectstringrequiredurlstringrequireddataarray of objectsrequiredShow child attributesHide child attributes
has_morebooleanrequired- Pass as
next_cursorstringrequiredcursorto get the next page; null on the last page. - The result's non-list fields (window, coverage, freshness, totals, note …).
metaobjectrequired
Errors
400parameter_invalid404resource_not_found429rate_limited500internal_error