Fortlauf
Kostenlos starten Discovery-Call buchen

Webhooks

Webhook-Endpunkte registrieren und Zustellungen einsehen oder erneut senden.

Register webhook endpoints and inspect/replay lifecycle deliveries.

12 Operationen · Basis-URL https://api.fortlauf.de/v1

Operationen

  1. GET /webhook-endpoints List webhook endpoints for the active tenant/entity
  2. POST /webhook-endpoints Register a webhook endpoint
  3. GET /webhook-endpoints/{id} Get one webhook endpoint (masked secret)
  4. PATCH /webhook-endpoints/{id} Update a webhook endpoint (url / subscribedTypes / status)
  5. DELETE /webhook-endpoints/{id} Disable a webhook endpoint (soft-delete)
  6. POST /webhook-endpoints/{id}/reveal-secret Reveal the full signing secret (audit-logged, repeatable)
  7. POST /webhook-endpoints/{id}/rotate-secret Rotate the signing secret
  8. POST /webhook-endpoints/{id}/test-event Send a synthetic test event (async, "Testereignis senden")
  9. GET /webhook-endpoints/{id}/deliveries Per-endpoint delivery log (cursor-paginated)
  10. GET /webhook-deliveries Tenant-wide webhook delivery log (cursor-paginated)
  11. GET /webhook-deliveries/{id} One delivery + its ordered attempt timeline
  12. POST /webhook-deliveries/{id}/replay Replay a delivery (async, "Erneut senden")

List webhook endpoints for the active tenant/entity

GET /webhook-endpoints

Admin/owner only (requireTenantContext + requireRole('admin')). Bounded, small set per tenant. Secrets are never returned here — only the masked secretPrefix. Each item also carries lastDeliveredAt, the last successful delivery instant.

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Antworten

  • 200

    The tenant's webhook endpoints (masked secrets).

    application/json object

  • 403

    Caller lacks the admin role (insufficient_role).

Register a webhook endpoint

POST /webhook-endpoints

Creates an endpoint and returns it WITH the full signing secret exactly once (secret, prominence: show-once, but also retrievable later via /reveal-secret). mode is fixed at creation to the caller's active auth-context mode and is never mutable afterward; supplying a different mode (or a non-active entityId) is a 400. url must be HTTPS. Honors the optional Idempotency-Key header so a retried registration does not create a second endpoint minting a second signing secret (the same duplicate-is-dangerous case as POST /tenants/{tenantId}/api-keys). A retry of a registration that already succeeded answers 409 idempotency_replay_secret_withheld with the endpoint it created, minus secret; read the secret again with /reveal-secret.

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
Idempotency-Key Header string

Optional client-supplied key that makes this mutating request safe to retry. The FIRST request runs and its outcome is recorded keyed by (tenant, route, key); a REPLAY (same key + byte-identical body, after the first completed) returns the recorded response verbatim WITHOUT re-executing — so a network-blip retry never creates a duplicate customer/subscription/key. A key reused with a DIFFERENT body is 409 IDEMPOTENCY_KEY_REUSED_WITH_DIFFERENT_BODY; a key whose first request is still in flight is 409 REQUEST_IN_PROGRESS (retryable). Keys expire after 24h — a key reused after expiry is a fresh request, not a replay. Transparent when omitted (the request runs normally).

Länge: max. 255

Request-Body erforderlich

application/json CreateWebhookEndpoint

Antworten

  • 201

    Created. Body is the endpoint plus the full plaintext secret.

    application/json WebhookEndpointWithSecret

  • 400

    Validation error, non-HTTPS url, mode_mismatch, or entity_mismatch.

  • 403

    Caller lacks the admin role.

  • 409

    Idempotency-Key conflict, on a route whose success body carries a one-time secret. IDEMPOTENCY_KEY_REUSED_WITH_DIFFERENT_BODY — the key was already used with a different request body; REQUEST_IN_PROGRESS — the first request bearing this key is still in flight (retryable); idempotency_replay_secret_withheld — the first request bearing this key already SUCCEEDED. Nothing new was created. The secret it returned is shown only once and is never stored for a replay, so this answer carries the created resource in resource without the secret. Do not retry it.

    application/json IdempotencyConflictOrSecretWithheldError

Get one webhook endpoint (masked secret)

GET /webhook-endpoints/{id}

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
id erforderlich Pfad string (uuid)

Webhook endpoint id.

Antworten

  • 200

    The endpoint (masked secretPrefix, never the plaintext).

    application/json WebhookEndpoint

  • 404

    Not found / not visible to the caller.

Update a webhook endpoint (url / subscribedTypes / status)

PATCH /webhook-endpoints/{id}

mode is NOT mutable — a body containing mode (or any unknown field) is rejected 400. Every successful update writes an audit-log entry.

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
id erforderlich Pfad string (uuid)

Webhook endpoint id.

Request-Body erforderlich

application/json UpdateWebhookEndpoint

Antworten

  • 200

    The updated endpoint.

    application/json WebhookEndpoint

  • 400

    Validation error (incl. an attempt to change mode).

  • 404

    Not found / not visible.

Disable a webhook endpoint (soft-delete)

DELETE /webhook-endpoints/{id}

Soft-delete: flips status='disabled' so the delivery log stays referentially intact. Audit-logged.

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
id erforderlich Pfad string (uuid)

Webhook endpoint id.

Antworten

  • 204

    Disabled.

  • 404

    Not found / not visible.

Reveal the full signing secret (audit-logged, repeatable)

POST /webhook-endpoints/{id}/reveal-secret

Decrypts and returns the full plaintext signing secret (the secret is retrievable, not hash-only). Writes an audit-log entry on EVERY call (a repeatable toggle, not show-once).

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
id erforderlich Pfad string (uuid)

Webhook endpoint id.

Antworten

  • 200

    The full plaintext signing secret.

    application/json object

  • 404

    Not found / not visible.

Rotate the signing secret

POST /webhook-endpoints/{id}/rotate-secret

Generates a new signing secret and returns it once; the old secret stops validating immediately (no overlap window). Audit-logged.

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
id erforderlich Pfad string (uuid)

Webhook endpoint id.

Antworten

  • 200

    The endpoint plus the new full plaintext secret.

    application/json WebhookEndpointWithSecret

  • 404

    Not found / not visible.

Send a synthetic test event (async, "Testereignis senden")

POST /webhook-endpoints/{id}/test-event

Enqueues a synthetic=true event (document_id=null, representative metadata-only payload) and the SINGLE delivery targeting ONLY this endpoint, dispatched through the normal delivery worker (signed identically to a real delivery). Returns 202 with the delivery id to poll (GET /webhook-deliveries/{id}) — it does NOT POST synchronously. eventCode must be in the endpoint's subscribed set (else 400 event_not_subscribed). Synthetic events are never metered / never counted as a lifecycle transition. Audit-logged.

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
id erforderlich Pfad string (uuid)

Webhook endpoint id.

Request-Body erforderlich

application/json object

Antworten

  • 202

    The synthetic event's enqueued delivery (poll its id).

    application/json EnqueuedWebhookDelivery

  • 400

    Not subscribed to eventCode (event_not_subscribed), or validation error.

  • 404

    Endpoint not found / not visible.

Per-endpoint delivery log (cursor-paginated)

GET /webhook-endpoints/{id}/deliveries

Cursor-paginated ({ data, nextCursor }), keyset over (created_at, id), newest first. Metadata only — no request/response bodies. 404 if the endpoint is not visible to the caller.

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
id erforderlich Pfad string (uuid)

Webhook endpoint id.
cursor Query string

Opaque keyset cursor from a prior page's nextCursor. Reset it on a filter change.
limit Query integer

Page size for cursor-paginated reads.

Standard: 25
Bereich: ≥ 1, ≤ 100
eventCode Query WebhookEventCode

Filter by the STABLE event code.
status Query string

Filter by delivery status. A single value exact-matches; a comma-separated set (e.g. pending,delivering,retrying) filters by status IN (...) — the dashboard's "Wird wiederholt" bucket sends the three non-terminal statuses this way. An unknown status in the set → 400 invalid_status.

Muster: ^(pending|delivering|succeeded|retrying|failed)(,(pending|delivering|succeeded|retrying|failed))*$
from Query string (date-time)

Inclusive created_at lower bound (RFC3339).
to Query string (date-time)

Inclusive created_at upper bound (RFC3339).

Antworten

  • 200

    A page of delivery records for this endpoint.

    application/json WebhookDeliveryPage

  • 400

    The query string was refused. Three distinguishable facts share this status, and a client should branch on the error code rather than on the status: unknown_query_parameter — the request named one or more query parameters this deployment does not define, and parameters lists their names. Nothing was filtered and nothing was written. This is a DEPLOY-ORDER signal: it is what a client released ahead of the API sees, and it replaces the older behaviour in which an unrecognised parameter was silently ignored and the request answered 200 OK with the UNFILTERED collection — indistinguishable, to the caller, from the filter having been applied. validation_error — a parameter this endpoint does define carried an unusable value (including a required one being absent or too short). issues[] names the parameter and what was wrong with it. invalid_cursor — on cursor-paginated endpoints, the pagination cursor is malformed. No response on this path ever echoes a submitted VALUE; only parameter names appear.

    application/json UnknownQueryParameterError | ValidationError

  • 404

    Endpoint not found / not visible.

Tenant-wide webhook delivery log (cursor-paginated)

GET /webhook-deliveries

Cursor-paginated latest-state delivery log across the tenant's endpoints. Metadata only, no bodies. Served from the parent row — no join. Filter by endpointId/eventCode/status/date range.

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
cursor Query string

Opaque keyset cursor from a prior page's nextCursor. Reset it on a filter change.
limit Query integer

Page size for cursor-paginated reads.

Standard: 25
Bereich: ≥ 1, ≤ 100
endpointId Query string (uuid)

Restrict to one endpoint's deliveries.
eventCode Query WebhookEventCode

Filter by the STABLE event code.
status Query string

Filter by delivery status. A single value exact-matches; a comma-separated set (e.g. pending,delivering,retrying) filters by status IN (...) — the dashboard's "Wird wiederholt" bucket sends the three non-terminal statuses this way. An unknown status in the set → 400 invalid_status.

Muster: ^(pending|delivering|succeeded|retrying|failed)(,(pending|delivering|succeeded|retrying|failed))*$
from Query string (date-time)

Inclusive created_at lower bound (RFC3339).
to Query string (date-time)

Inclusive created_at upper bound (RFC3339).

Antworten

  • 200

    A page of delivery records.

    application/json WebhookDeliveryPage

  • 400

    The query string was refused. Three distinguishable facts share this status, and a client should branch on the error code rather than on the status: unknown_query_parameter — the request named one or more query parameters this deployment does not define, and parameters lists their names. Nothing was filtered and nothing was written. This is a DEPLOY-ORDER signal: it is what a client released ahead of the API sees, and it replaces the older behaviour in which an unrecognised parameter was silently ignored and the request answered 200 OK with the UNFILTERED collection — indistinguishable, to the caller, from the filter having been applied. validation_error — a parameter this endpoint does define carried an unusable value (including a required one being absent or too short). issues[] names the parameter and what was wrong with it. invalid_cursor — on cursor-paginated endpoints, the pagination cursor is malformed. No response on this path ever echoes a submitted VALUE; only parameter names appear.

    application/json UnknownQueryParameterError | ValidationError

One delivery + its ordered attempt timeline

GET /webhook-deliveries/{id}

Returns the delivery latest-state PLUS its attempts[] (oldest→newest), which backs the per-attempt timeline. Metadata only.

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
id erforderlich Pfad string (uuid)

Delivery id.

Antworten

  • 200

    The delivery with its attempt history.

    application/json WebhookDeliveryDetail

  • 404

    Not found / not visible.

Replay a delivery (async, "Erneut senden")

POST /webhook-deliveries/{id}/replay

Creates a NEW delivery record, linked to the original, referencing the same frozen event + endpoint, pending with no attempts yet, dispatched through the normal delivery worker. The original delivery and its attempt history stay IMMUTABLE; the replayed body is byte-identical (re-signed with a fresh timestamp — legally safe per UStAE 14c.1 Abs. 4 Satz 7). Returns 202 with the new delivery id to poll. Audit-logged.

Erforderlicher Scope
keiner
Zugang
nur mit angemeldeter Sitzung – ein API-Schlüssel wird abgelehnt (oidc-only)

Parameter

Parameter In Typ Beschreibung
id erforderlich Pfad string (uuid)

The original delivery id to replay.

Antworten

  • 202

    The new replay delivery (poll its id).

    application/json EnqueuedWebhookDelivery

  • 404

    Original delivery not found / not visible.

Datenmodelle

Jedes Datenmodell dieser Gruppe einmal, mit allen Feldern – auch den verschachtelten. Verschachtelte Objekte sind aufklappbar; ein benannter Typ verweist auf seinen eigenen Abschnitt.

WebhookEndpointListItem object

A WebhookEndpoint as returned by the list endpoint, plus lastDeliveredAt — the instant of the last SUCCESSFUL delivery to this endpoint, computed by a JOIN over the delivery records (MAX(completed_at) FILTER (status='succeeded')), never denormalized onto the endpoint row.

Feld Typ Beschreibung
id erforderlich string (uuid)
tenantId string (uuid)
entityId erforderlich string (uuid) | null

NULL would be a whole-tenant endpoint (deferred; always the active entity today).
mode erforderlich string

Set at creation, never mutable.

Werte: "live", "test"
url erforderlich string

HTTPS receiver URL.
subscribedTypes erforderlich Array<WebhookEventCode>
status erforderlich string
Werte: "active", "disabled"
secretPrefix erforderlich string

Masked signing-secret identifier (whsec_a1b2c3d4).
secretRotatedAt erforderlich string (date-time)
createdBy erforderlich string (uuid)
createdAt erforderlich string (date-time)
updatedAt erforderlich string (date-time)
lastDeliveredAt erforderlich string (date-time) | null

Timestamp of the last successful delivery to this endpoint; null if none has ever succeeded.

Verwendet von: GET /webhook-endpoints

CreateWebhookEndpoint object

Feld Typ Beschreibung
url erforderlich string

HTTPS-only receiver URL (non-HTTPS rejected 400).
subscribedTypes erforderlich Array<WebhookEventCode>
Elemente: min. 1
mode string

Optional; must equal the caller's active mode (else 400). Fixed at creation.

Werte: "live", "test"
entityId string (uuid)

Optional; must equal the caller's active entity (else 400).

Verwendet von: POST /webhook-endpoints

WebhookEndpointWithSecret object

A WebhookEndpoint plus the full plaintext secret, returned once.

Feld Typ Beschreibung
id erforderlich string (uuid)
tenantId string (uuid)
entityId erforderlich string (uuid) | null

NULL would be a whole-tenant endpoint (deferred; always the active entity today).
mode erforderlich string

Set at creation, never mutable.

Werte: "live", "test"
url erforderlich string

HTTPS receiver URL.
subscribedTypes erforderlich Array<WebhookEventCode>
status erforderlich string
Werte: "active", "disabled"
secretPrefix erforderlich string

Masked signing-secret identifier (whsec_a1b2c3d4).
secretRotatedAt erforderlich string (date-time)
createdBy erforderlich string (uuid)
createdAt erforderlich string (date-time)
updatedAt erforderlich string (date-time)
secret erforderlich string

The full plaintext signing secret. Shown once here; retrievable later via /reveal-secret.

Verwendet von: POST /webhook-endpoints , POST /webhook-endpoints/{id}/rotate-secret

IdempotencyConflictOrSecretWithheldError object

Feld Typ Beschreibung
error erforderlich string
Werte: "IDEMPOTENCY_KEY_REUSED_WITH_DIFFERENT_BODY", "REQUEST_IN_PROGRESS", "idempotency_replay_secret_withheld"
message string
resource object

Only with idempotency_replay_secret_withheld: the resource the first request created, as it answered then but WITHOUT the one-time secret field.

Verwendet von: POST /webhook-endpoints

WebhookEndpoint object

A registered webhook receiver. The signing secret is NEVER present here — only the masked secretPrefix (whsec_ + first 8 chars).

Feld Typ Beschreibung
id erforderlich string (uuid)
tenantId string (uuid)
entityId erforderlich string (uuid) | null

NULL would be a whole-tenant endpoint (deferred; always the active entity today).
mode erforderlich string

Set at creation, never mutable.

Werte: "live", "test"
url erforderlich string

HTTPS receiver URL.
subscribedTypes erforderlich Array<WebhookEventCode>
status erforderlich string
Werte: "active", "disabled"
secretPrefix erforderlich string

Masked signing-secret identifier (whsec_a1b2c3d4).
secretRotatedAt erforderlich string (date-time)
createdBy erforderlich string (uuid)
createdAt erforderlich string (date-time)
updatedAt erforderlich string (date-time)

Verwendet von: GET /webhook-endpoints/{id} , PATCH /webhook-endpoints/{id}

UpdateWebhookEndpoint object

Mutable fields only. mode is intentionally absent — including it (or any unknown field) is rejected 400 (mode is immutable).

  • Mindestens 1 Feld(er)
Feld Typ Beschreibung
url string

HTTPS-only.
subscribedTypes Array<WebhookEventCode>
Elemente: min. 1
status string
Werte: "active", "disabled"

Verwendet von: PATCH /webhook-endpoints/{id}

WebhookEventCode string

A STABLE internal event code (never the wire label). The dashboard maps these to display labels via event-types.ts: transmission_accepted→"sent", transmission_rejected→"rejected". The Zahlungsabgleich two-sided-emit codes are additive: invoice_paid→"invoice.paid" (an issued invoice became fully paid), payment_partial→"payment.partial" (a partial payment was allocated), payment_reconciled→"payment.reconciled" (a payment reconciled an invoice without a clean full flip, e.g. an overpayment). The retraction code is additive too: payment_reversed→"payment.reversed" (a recorded allocation was reversed by a compensating entry; if that takes the invoice back below fully paid it also un-pays it).

⭐ The payment family is a SEQUENCE, not a set of terminal flags. invoice.paid may be delivered more than once for one invoice; it may be followed by payment.reversed; and that may be followed by invoice.paid again — because a receivable can be settled, retracted and settled again. Apply them in created_at order — not arrival order — and treat the latest created_at as current. Ordering by arrival rebuilds the very bug this contract avoids: delivery is at-least-once on a 1m→24h retry ladder, so a retried invoice.paid can reach you after a payment.reversed. Two events with different ids are two distinct occurrences even when type is identical; invoice.paid is not a latch, and the absence of a further event is not confirmation.

The document-lifecycle codes (issued, archived, transmission_accepted, transmission_rejected) are unchanged: those transitions happen once per document by nature and are still emitted at most once.

  • Werte: "issued", "transmission_accepted", "transmission_rejected", "archived", "invoice_paid", "payment_reconciled", "payment_partial", "payment_reversed"

Verwendet von: POST /webhook-endpoints/{id}/test-event , GET /webhook-endpoints/{id}/deliveries , GET /webhook-deliveries

EnqueuedWebhookDelivery object

The delivery enqueued by a test-event or replay action — poll deliveryId via GET /webhook-deliveries/{id} for its outcome.

Feld Typ Beschreibung
deliveryId erforderlich string (uuid)
eventId erforderlich string (uuid)

The frozen event this delivery sends.
synthetic erforderlich boolean

true for a test event; carried through the delivery.
replayOf erforderlich string (uuid) | null

The original delivery id for a replay; null for a test event.

Verwendet von: POST /webhook-endpoints/{id}/test-event , POST /webhook-deliveries/{id}/replay

WebhookDeliveryPage object

A cursor-paginated page of deliveries ({ data, nextCursor }).

Feld Typ Beschreibung
data erforderlich Array<WebhookDelivery>
nextCursor erforderlich string | null

Opaque cursor for the next page; null on the last page.

Verwendet von: GET /webhook-endpoints/{id}/deliveries , GET /webhook-deliveries

UnknownQueryParameterError object

The request named query parameters this endpoint does not define. A list endpoint refuses them rather than ignoring them, so a caller can never mistake an UNFILTERED collection for a filtered one.

Feld Typ Beschreibung
error erforderlich string
Werte: "unknown_query_parameter"
parameters erforderlich Array<string>

The unrecognised parameter NAMES, deduplicated and sorted. Bounded at ten entries, and a name longer than 64 characters is omitted — a parameter name is caller-supplied text, and this response never reflects unbounded caller input. The array may therefore be EMPTY while the refusal still stands: the refusal is decided by the request, not by the length of this list.
message string
requestId string

Verwendet von: GET /webhook-endpoints/{id}/deliveries , GET /webhook-deliveries

ValidationError object

A refused request body. error is validation_error when the body was read and failed validation (each problem is listed in issues), or invalid_json when the body is not valid JSON at all (then issues is absent). An unparsable body is answered 400 invalid_json on every operation that takes a JSON body. The submitted body is never echoed.

Feld Typ Beschreibung
error string
issues Array<object>
Felder
Feld Typ Beschreibung
path string
message string
code string

Optional machine-readable reason for the refusal, for a client that shows its own wording instead of message. Present only where an endpoint documents it; an issue without it is refused for the reason message states. Today: invalid_address (an entry of a copy list is not one valid address), too_many_addresses (more than 5 entries in one copy list), copies_require_email (copy recipients are set but email is empty), and service_timing_conflict (POST /invoices, PUT /invoices/{id}: the invoice would state both a single service date and a service period; the issue's path is deliveryDate). On the invoice saves and POST /invoices/preview-totals also reverse_charge_buyer_vat_id_required (a reverse-charge line needs the buyer's VAT identification number), vat_category_unavailable (the line's VAT category is not available), vat_rate_category_mismatch (the rate does not fit the line's VAT category), vat_exemption_reason_required / vat_exemption_reason_not_allowed (the exemption reason is missing, or not allowed for that category), and, only where the deployment enforces the check, unit_code_unknown, currency_code_unknown and vat_id_prefix_unknown (the same three also appear on quote and recurring-template saves, with the same paths). The set may grow, so treat an unknown value like an absent one. Never carries a submitted value.

Verwendet von: GET /webhook-endpoints/{id}/deliveries , GET /webhook-deliveries

WebhookDeliveryDetail object

A delivery plus its ordered per-attempt timeline (oldest→newest).

Feld Typ Beschreibung
id erforderlich string (uuid)
tenantId string (uuid)
entityId erforderlich string (uuid)
mode erforderlich string
Werte: "live", "test"
endpointId erforderlich string (uuid)
eventId erforderlich string (uuid)

The stable event id — the receiver's dedup key.
eventCode erforderlich WebhookEventCode

Stored STABLE code, for filtering.
eventLabel erforderlich string

Wire label rendered from eventCode — display only.
synthetic erforderlich boolean

True for a test-delivery (never metered/counted as a lifecycle transition).
status erforderlich string
Werte: "pending", "delivering", "succeeded", "retrying", "failed"
attemptCount erforderlich integer
lastResponseStatus integer | null

HTTP status of the last attempt (null on timeout/connection error).
lastResponseMs integer | null
nextRetryAt string (date-time) | null
firstAttemptedAt string (date-time) | null
completedAt string (date-time) | null
replayOf erforderlich string (uuid) | null

Non-null for a replay delivery; references the original.
createdAt erforderlich string (date-time)
updatedAt erforderlich string (date-time)
attempts erforderlich Array<WebhookDeliveryAttempt>

Verwendet von: GET /webhook-deliveries/{id}

WebhookDelivery object

One delivery record: latest-state + timing METADATA only. No request or response bodies are ever stored or returned (GDPR-by-design).

Feld Typ Beschreibung
id erforderlich string (uuid)
tenantId string (uuid)
entityId erforderlich string (uuid)
mode erforderlich string
Werte: "live", "test"
endpointId erforderlich string (uuid)
eventId erforderlich string (uuid)

The stable event id — the receiver's dedup key.
eventCode erforderlich WebhookEventCode

Stored STABLE code, for filtering.
eventLabel erforderlich string

Wire label rendered from eventCode — display only.
synthetic erforderlich boolean

True for a test-delivery (never metered/counted as a lifecycle transition).
status erforderlich string
Werte: "pending", "delivering", "succeeded", "retrying", "failed"
attemptCount erforderlich integer
lastResponseStatus integer | null

HTTP status of the last attempt (null on timeout/connection error).
lastResponseMs integer | null
nextRetryAt string (date-time) | null
firstAttemptedAt string (date-time) | null
completedAt string (date-time) | null
replayOf erforderlich string (uuid) | null

Non-null for a replay delivery; references the original.
createdAt erforderlich string (date-time)
updatedAt erforderlich string (date-time)

Verwendet von: GET /webhook-endpoints/{id}/deliveries , GET /webhook-deliveries

WebhookDeliveryAttempt object

One immutable attempt in a delivery's history. Metadata only — coarse error category, never a body/transcript.

Feld Typ Beschreibung
id erforderlich string (uuid)
attemptNo erforderlich integer
responseStatus integer | null
responseMs integer | null
outcome erforderlich string
Werte: "succeeded", "failed_retryable", "failed_terminal"
errorCategory string | null
Werte: "timeout", "connection", "http_5xx", "http_4xx"
attemptedAt erforderlich string (date-time)

Verwendet von: GET /webhook-deliveries/{id}

Nach oben · Alle Ressourcengruppen · OpenAPI-Spezifikation (YAML)