List webhook delivery records
Returns delivery records for webhook endpoints owned by the caller. Merchant callers see only records for their own endpoints. Filters: endpoint_id, event_type, status, created_after, created_before. Cursor-based pagination via cursor + limit (default 20, max 100).
Authorization
bearer In: header
Query Parameters
Filter by a specific webhook endpoint. For merchant callers, ownership of the endpoint is verified.
uuidFilter by event type string (e.g. "payment.succeeded").
Filter by delivery status: pending, delivered, failed, or retrying.
"pending" | "delivered" | "failed" | "retrying"Return only records created at or after this timestamp (ISO 8601 UTC).
date-timeReturn only records created at or before this timestamp (ISO 8601 UTC).
date-timePagination cursor returned from a previous list response.
uuidPage size. Default 20, max 100.
1 <= value <= 100Response Body
application/json
curl -X GET "https://<api-host>/v1/webhooks/deliveries"{
"data": [
{
"id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
"tenantId": "f97df110-f4de-492e-8849-4a6af68026b0",
"livemode": true,
"endpointId": "c8d2c7e1-e4b1-4108-9e29-3429a36a1ef3",
"eventId": "d6703cc8-9e79-415d-ac03-a4dc7f6ab43c",
"eventType": "string",
"eventPayload": {
"property1": null,
"property2": null
},
"status": "pending",
"attempts": [
{
"attemptNumber": 0,
"requestedAt": "string",
"responseStatus": 0,
"responseBody": "string",
"durationMs": 0,
"error": "string"
}
],
"attemptCount": 0,
"maxAttempts": 0,
"nextRetryAt": "string",
"createdAt": "string",
"updatedAt": "string"
}
],
"pagination": {
"nextCursor": "string",
"prevCursor": "string",
"hasMore": true,
"totalCount": 0
}
}Get webhook delivery record
Returns a single delivery record by ID. Ownership is verified — the record must belong to a webhook endpoint owned by the caller scope. Returns 404 when the record does not exist or is outside the caller scope.
Create webhook endpoint
Creates a new webhook endpoint bound to the caller owner scope (merchant, tenant, or platform). The HMAC signing secret is returned ONCE in this response — store it securely. Subscribed `events` must exist in the catalog and be visible to the caller. URL must use HTTPS. Optional `maxAttempts` (1-20) overrides the platform delivery attempt budget for this endpoint; omit it to use the default.