Cowdidocs
API ReferenceWebhooks

List deliveries

GET
/v1/webhooks/deliveries

Lists every attempt this platform made to call a webhook of the caller's organization, newest first, with the body that was sent and whatever the receiver answered. Requires the org:connect:read permission. Narrow it with webhook_id, status, event_type and a created_from/created_until window. The window is over when the delivery was created; sent_at on each row says when the last attempt ran.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Query Parameters

size?integer

Number of deliveries per page. Defaults to 20; the maximum is 100.

Range0 < value
Default20
after?string

Cursor for the page after this one, from the response's next link.

before?string

Cursor for the page before this one, from the response's prev link.

status?string

Only deliveries in this status.

Value in

  • "PENDING"
  • "DELIVERED"
  • "FAILED"
webhook_id?string

Only this webhook's deliveries.

Formatuuid
event_type?string

Only deliveries of this event_type.

created_from?string

Only deliveries created at or after this ISO 8601 timestamp.

Formatdate-time
created_until?string

Only deliveries created at or before this ISO 8601 timestamp.

Formatdate-time

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v1/webhooks/deliveries?size=20&after=eyJpZCI6IjU1MGU4NDAwLWUyOWItNDFkNC1hNzE2LTQ0NjY1NTQ0MDAwMCJ9&before=eyJpZCI6IjU1MGU4NDAwLWUyOWItNDFkNC1hNzE2LTQ0NjY1NTQ0MDAwMCJ9&status=FAILED&webhook_id=550e8400-e29b-41d4-a716-446655440000&event_type=approval.outcome&created_from=2026-03-01T00%3A00%3A00Z&created_until=2026-03-31T23%3A59%3A59Z"
{  "data": [    {      "id": "0198c1c2-4f1e-7a3b-9c2d-6f0a1b2c3d4e",      "webhook_id": "550e8400-e29b-41d4-a716-446655440000",      "event_type": "approval.outcome",      "payload": {        "delivery_id": "0198c1c2-4f1e-7a3b-9c2d-6f0a1b2c3d4e",        "event_type": "approval.outcome"      },      "status": "PENDING",      "attempts": 1,      "sent_at": "2026-03-14T09:30:00Z",      "http_status": 200,      "response_snippet": {        "status": "ok"      },      "error": "Connection timed out after PT5S",      "duration": "PT0.412S",      "next_attempt_at": "2026-03-14T09:35:00Z",      "created_at": "2026-09-01T10:15:30Z"    }  ],  "links": {    "next": "/v1/payees?after=eyJpZCI6MX0",    "prev": "/v1/payees?before=eyJpZCI6MX0"  }}
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Register a webhook POST

Registers a webhook and mints its first signing key. The signing secret is in the response and is never retrievable again. The URL must use `https` and must not resolve inside a private network, unless it matches a configured in-cluster host suffix. Requires the `org:connect:write` permission. Returns 400 when the URL is invalid or an `events` entry is not in the published vocabulary, and 409 when the name or URL already belongs to another webhook.

Get a delivery and every attempt at it GET

Reads the delivery, the body that was sent, and one entry per attempt with what the receiver answered to that attempt. A delivery that failed twice and then succeeded has three entries; the summary on the list deliveries operation only carries the latest. Requires the `org:connect:read` permission. Returns 404 when the caller's organization has no delivery with this id.