Webhooks

Get a webhook delivery

Returns one delivery attempt in full, including responseBody - what your receiver actually wrote back, truncated at 4000 characters.

GET/webhooks/{id}/deliveries/{deliveryId}

Returns one delivery attempt in full, including responseBody - what your receiver actually wrote back, truncated at 4000 characters. That field is the only thing this adds over the list endpoint, and it is usually what tells you why a receiver 4xx'd.

The delivery must belong to the endpoint named in the path. A valid delivery id under the wrong {id} returns 404 webhook.delivery_not_found, not the delivery.

error is populated for anything the worker considered a failure, including a receiver that returned a 3xx (redirects are never followed) or that took longer than the 10 second timeout. nextAttemptAt is non-null only while more retries remain; after 5 attempts the delivery is terminal.

Refused for project-restricted keys.

Requires the webhooks:read scope.

curl --request GET \
  --url 'https://api.envless.cloud/webhooks/<id>/deliveries/<deliveryId>' \
  --header 'Authorization: Bearer ev_sk_xxxxxxxxxxxx'
Try itGEThttps://api.envless.cloud/webhooks/{id}/deliveries/{deliveryId}
Path parameters

Authorization

  • Authorizationstringrequiredheader

    Bearer token: an Envless API key (ev_sk_…), created in the dashboard or with POST /keys. The key is bound to one workspace; every request runs inside it.

Path parameters

  • idstringrequireduuid

    The endpoint's id (UUIDv7). The delivery must belong to it.

  • deliveryIdstringrequireduuid

    The delivery's id (UUIDv7), as returned by GET /webhooks/{id}/deliveries or in the Envless-Delivery header on the request your receiver got.

Responses

200OK

Get a webhook delivery succeeded.

  • successbooleanrequired
  • codeintegerrequired

    The HTTP status of this response, repeated in the body.

  • messagestringrequired
  • errornullrequired
  • dataobjectrequired
    Show child attributesHide child attributes
    • idstringrequired
    • webhookIdstringrequired
    • eventIdstringrequired
    • eventTypestringrequired
    • statusstringrequired
    • attemptsinteger
    • responseStatusinteger | null
    • errorstring | null
    • lastAttemptAtstring | nulldate-time
    • nextAttemptAtstring | nulldate-time
    • succeededAtstring | nulldate-time
    • failedAtstring | nulldate-time
    • createdAtstringrequireddate-time
    • responseBodystring | null

      What the receiver returned, truncated at 4000 characters. Returned only by this single-delivery route, never in the list.

  • _reqobject
    Show child attributesHide child attributes
    • reqIdstring
    • resTimeinteger | null
{
    "success": true,
    "code": 200,
    "message": "OK",
    "error": null,
    "data": {
        "id": "<string>",
        "webhookId": "<string>",
        "eventId": "<string>",
        "eventType": "<string>",
        "status": "<string>",
        "attempts": 1,
        "responseStatus": 1,
        "error": "<string>",
        "lastAttemptAt": "2026-05-30T10:14:22.000Z",
        "nextAttemptAt": "2026-05-30T10:14:22.000Z",
        "succeededAt": "2026-05-30T10:14:22.000Z",
        "failedAt": "2026-05-30T10:14:22.000Z",
        "createdAt": "2026-05-30T10:14:22.000Z",
        "responseBody": "<string>"
    },
    "_req": {
        "reqId": "<string>",
        "resTime": 1
    }
}

Error envelope

Every failure below returns the same shape with success: false; branch on error.code, never on message.

  • successbooleanrequired
  • codeintegerrequired

    The HTTP status of this response, repeated in the body.

  • messagestringrequired
  • errorobjectrequired

    Machine-readable failure detail. Null on success.

    Show child attributesHide child attributes
    • codeenum<string>required

      Stable error code. Branch on this, never on message.

      Options: "auth.api_key_required", "auth.api_key_not_found", "auth.api_key_user_missing", "auth.api_key_owner_not_member", "auth.scope_missing", "auth.scope_ceiling_exceeded", "auth.key_project_restricted", "auth.product_restricted", "auth.permission_denied", "auth.self_mutation_forbidden", "auth.step_up_required", "auth.step_up_fresh_required", "auth.cli_token_not_accepted", "auth.two_factor_required", "auth.workspace_two_factor_required", "auth.two_factor_invalid", "auth.two_factor_replayed", "auth.two_factor_locked", "auth.two_factor_not_enabled", "auth.two_factor_already_enabled", "request.body_must_be_json", "request.body_invalid", "request.body_too_large", "request.rate_limited", "request.invalid_pagination", "workspace.not_found", "workspace.slug_conflict", "workspace.limit_reached", "workspace.delete_last", "workspace.delete_too_early", "workspace.delete_has_projects", "domain.not_configured", "domain.not_found", "domain.invalid", "domain.taken", "domain.attempt_limit", "product.not_found", "product.slug_conflict", "product.locked", "project.not_found", "project.ambiguous_product", "project.slug_conflict", "environment.not_found", "environment.slug_conflict", "environment.expose_disabled", "environment.expose_private_product", "variable.not_found", "variable.name_conflict", "variable.ciphertext_invalid", "variable.baseline_drifted", "version.not_found", "member.not_found", "member.already_exists", "member.self_invite", "member.self_mutation", "member.owner_immutable", "member.owner_cannot_leave", "member.seat_limit", "invite.already_pending", "role.owner_not_assignable", "role.limit_reached", "role.immutable", "role.in_use", "invite.not_found", "invite.expired", "role.not_found", "role.name_conflict", "key.not_found", "key.limit_reached", "webhook.not_found", "webhook.delivery_not_found", "plan.limit_reached", "plan.upgrade_required", "request.not_found", "request.method_not_allowed", "request.conflict", "auth.unauthorized", "auth.forbidden", "request.invalid", "server.error"

    • resourcestring

      The resource or scope the failure relates to.

    • fieldstring

      The request field that caused the failure.

  • dataobject | nullrequired

    Null on most failures. A plan limit carries { limit, current }.

  • _reqobject
    Show child attributesHide child attributes
    • reqIdstring
    • resTimeinteger | null
{
    "success": false,
    "code": 401,
    "message": "Something went wrong.",
    "error": {
        "code": "auth.api_key_required",
        "resource": "<string>",
        "field": "<string>"
    },
    "data": {},
    "_req": {
        "reqId": "<string>",
        "resTime": 1
    }
}

401Unauthorized

  • auth.api_key_required - the Authorization header is missing, or its value does not start with ev_sk_.
  • auth.api_key_not_found - the key is unknown, inactive or revoked.
  • auth.api_key_user_missing - the key is valid but its owner no longer exists.
  • auth.api_key_owner_not_member - the key's owner is no longer a member of the key's workspace.

403Forbidden

  • auth.key_project_restricted - the calling key is fenced to specific projects.
  • auth.workspace_two_factor_required - the workspace requires two-factor authentication and the key's owner has not turned it on.
  • auth.scope_missing - the key lacks a scope this operation requires; error.resource names it.

404Not Found

  • webhook.not_found - no live endpoint with that id exists in this workspace.
  • webhook.delivery_not_found - no delivery with that id exists on this endpoint - including a delivery that is real but belongs to a different endpoint.

500Internal Server Error

server.error - an unexpected error; retry with backoff.

503Service Unavailable

server.error - the API is in maintenance mode or is missing its configuration; retry with backoff.