Get a webhook delivery

GET /api/v1/webhook-deliveries/{deliveryId}

Returns one delivery with the event payload it carries and its attempts, in order. Attempts are append-only: a retry adds a line, it never rewrites one. Sensitive keys are redacted from what this endpoint shows.

Authorization

Role in the organization	This endpoint
`OWNER`	Allowed
`ADMIN`	Allowed
`MEMBER`	Refused — `403`

Requirement	Rule for this endpoint
Business role	None beyond the organization role
Resource scope	The delivery belongs to the key's organization
Participation	None
Resource state	None

Path parameters

Parameter	Type	Required	Description
`deliveryId`	UUID	yes	Webhook delivery of the key's organization

Request headers

Header	Required	Description
`x-api-key`	yes	API key created for this organization
`X-Correlation-Id`	no	Caller correlation id, returned or generated

Example

bash

curl "$COHORTE_API_BASE_URL/api/v1/webhook-deliveries/$DELIVERY_ID" \
  -H "x-api-key: $COHORTE_API_KEY"

Response

200 OK — the delivery.
401 Unauthorized — unauthorized: the key is missing, invalid, expired or no longer attached to a member.
403 Forbidden — forbidden: the bearer is not OWNER or ADMIN.
404 Not Found — not_found: the delivery is unknown or belongs to another organization.
500 Internal Server Error — internal_error: unexpected failure.

Response fields

Field	Type	Nullable	Description
`success`	boolean	no	`true` for a successful request
`data.id`	UUID	no	Delivery identifier
`data.subscriptionId`	UUID	no	Subscription the delivery targets
`data.eventId`	UUID	no	Event identifier, identical across retries and replays; deduplicate on it
`data.eventName`	string	no	Event name, for example `enrollment.created`
`data.subjectType`	string	no	Kind of resource the event is about
`data.subjectId`	string	no	Identifier of that resource
`data.correlationId`	string	no	Correlation id of the originating command, or of the replay request
`data.occurredAt`	ISO 8601 string	no	When the event happened, in UTC
`data.status`	string	no	`pending`, `delivering`, `retry_scheduled`, `succeeded` or `exhausted`
`data.attemptCount`	integer	no	Attempts made so far, up to 5
`data.nextAttemptAt`	ISO 8601 string	yes	Next scheduled attempt, in UTC; `null` once terminal
`data.lastStatusCode`	integer	yes	HTTP status of the last attempt; `null` if no answer was received
`data.lastError`	string	yes	`http_error`, `redirect_refused`, `network_error` or `delivery_error`; `null` after a success
`data.replayOfDeliveryId`	UUID	yes	Original delivery when this one is a replay
`data.createdAt`	ISO 8601 string	no	Creation time, in UTC
`data.updatedAt`	ISO 8601 string	no	Last change, in UTC
`data.payload`	object	no	Event data sent as `data` in the webhook body, with sensitive values redacted
`data.signature.configured`	boolean	no	Always `true`
`data.signature.value`	null	yes	Always `null`; signatures are never shown
`data.attempts[].id`	UUID	no	Attempt identifier
`data.attempts[].attemptNumber`	integer	no	1 to 5
`data.attempts[].startedAt`	ISO 8601 string	no	When the attempt started, in UTC
`data.attempts[].durationMs`	integer	no	Duration, in milliseconds
`data.attempts[].succeeded`	boolean	no	`true` when the destination answered `2xx`
`data.attempts[].statusCode`	integer	yes	HTTP status received; `null` if none
`data.attempts[].errorCategory`	string	yes	`http_error`, `redirect_refused`, `network_error` or `delivery_error`
`data.attempts[].responseExcerpt`	string	yes	Up to 2048 bytes of the answer, redacted
`data.attempts[].nextRetryAt`	ISO 8601 string	yes	Retry scheduled after this attempt, in UTC
`correlationId`	string	no	Correlation id for support

Example response

json

{
  "success": true,
  "data": {
    "id": "8c2d4e6f-0a1b-4c3d-9e5f-7a8b9c0d1e2f",
    "subscriptionId": "6b1e2c3d-4f50-4a61-8b72-93a4b5c6d7e8",
    "eventId": "0e4f8a2b-6c1d-4e3f-9a5b-7c8d9e0f1a2b",
    "eventName": "enrollment.created",
    "subjectType": "Enrollment",
    "subjectId": "2f6a9c3e-1b4d-4a7e-8c0f-5d2e6b9a1c3f",
    "correlationId": "5a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
    "occurredAt": "2026-09-21T10:00:00.000Z",
    "status": "succeeded",
    "attemptCount": 2,
    "nextAttemptAt": null,
    "lastStatusCode": 200,
    "lastError": null,
    "replayOfDeliveryId": null,
    "createdAt": "2026-09-21T10:00:00.000Z",
    "updatedAt": "2026-09-21T10:02:01.000Z",
    "payload": {
      "enrollmentId": "2f6a9c3e-1b4d-4a7e-8c0f-5d2e6b9a1c3f",
      "accessToken": "[REDACTED]"
    },
    "signature": {"configured": true, "value": null},
    "attempts": [
      {
        "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
        "attemptNumber": 1,
        "startedAt": "2026-09-21T10:00:01.000Z",
        "durationMs": 412,
        "succeeded": false,
        "statusCode": 503,
        "errorCategory": "http_error",
        "responseExcerpt": "Service Unavailable",
        "nextRetryAt": "2026-09-21T10:01:01.000Z"
      },
      {
        "id": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e",
        "attemptNumber": 2,
        "startedAt": "2026-09-21T10:02:00.000Z",
        "durationMs": 180,
        "succeeded": true,
        "statusCode": 200,
        "errorCategory": null,
        "responseExcerpt": "{\"ok\":true}",
        "nextRetryAt": null
      }
    ]
  },
  "correlationId": "b7d3e1f0-2a4c-4e8b-9c1d-0f2e3a4b5c6d"
}

Notes

Keys such as authorization, cookie, password, secret, token, signature or ending in apiKey are shown as [REDACTED], and the query string of any https:// URL is hidden. Your endpoint receives the original, unredacted payload.
The example payload is illustrative; its shape depends on the event.

GET /api/v1/webhook-deliveries/{deliveryId}

Authorization

Role in the organization	This endpoint
`OWNER`	Allowed
`ADMIN`	Allowed
`MEMBER`	Refused — `403`

Requirement	Rule for this endpoint
Business role	None beyond the organization role
Resource scope	The delivery belongs to the key's organization
Participation	None
Resource state	None

Path parameters

Parameter	Type	Required	Description
`deliveryId`	UUID	yes	Webhook delivery of the key's organization

Request headers

Header	Required	Description
`x-api-key`	yes	API key created for this organization
`X-Correlation-Id`	no	Caller correlation id, returned or generated

Example

bash

curl "$COHORTE_API_BASE_URL/api/v1/webhook-deliveries/$DELIVERY_ID" \
  -H "x-api-key: $COHORTE_API_KEY"

Response

200 OK — the delivery.
401 Unauthorized — unauthorized: the key is missing, invalid, expired or no longer attached to a member.
403 Forbidden — forbidden: the bearer is not OWNER or ADMIN.
404 Not Found — not_found: the delivery is unknown or belongs to another organization.
500 Internal Server Error — internal_error: unexpected failure.

Response fields

Field	Type	Nullable	Description
`success`	boolean	no	`true` for a successful request
`data.id`	UUID	no	Delivery identifier
`data.subscriptionId`	UUID	no	Subscription the delivery targets
`data.eventId`	UUID	no	Event identifier, identical across retries and replays; deduplicate on it
`data.eventName`	string	no	Event name, for example `enrollment.created`
`data.subjectType`	string	no	Kind of resource the event is about
`data.subjectId`	string	no	Identifier of that resource
`data.correlationId`	string	no	Correlation id of the originating command, or of the replay request
`data.occurredAt`	ISO 8601 string	no	When the event happened, in UTC
`data.status`	string	no	`pending`, `delivering`, `retry_scheduled`, `succeeded` or `exhausted`
`data.attemptCount`	integer	no	Attempts made so far, up to 5
`data.nextAttemptAt`	ISO 8601 string	yes	Next scheduled attempt, in UTC; `null` once terminal
`data.lastStatusCode`	integer	yes	HTTP status of the last attempt; `null` if no answer was received
`data.lastError`	string	yes	`http_error`, `redirect_refused`, `network_error` or `delivery_error`; `null` after a success
`data.replayOfDeliveryId`	UUID	yes	Original delivery when this one is a replay
`data.createdAt`	ISO 8601 string	no	Creation time, in UTC
`data.updatedAt`	ISO 8601 string	no	Last change, in UTC
`data.payload`	object	no	Event data sent as `data` in the webhook body, with sensitive values redacted
`data.signature.configured`	boolean	no	Always `true`
`data.signature.value`	null	yes	Always `null`; signatures are never shown
`data.attempts[].id`	UUID	no	Attempt identifier
`data.attempts[].attemptNumber`	integer	no	1 to 5
`data.attempts[].startedAt`	ISO 8601 string	no	When the attempt started, in UTC
`data.attempts[].durationMs`	integer	no	Duration, in milliseconds
`data.attempts[].succeeded`	boolean	no	`true` when the destination answered `2xx`
`data.attempts[].statusCode`	integer	yes	HTTP status received; `null` if none
`data.attempts[].errorCategory`	string	yes	`http_error`, `redirect_refused`, `network_error` or `delivery_error`
`data.attempts[].responseExcerpt`	string	yes	Up to 2048 bytes of the answer, redacted
`data.attempts[].nextRetryAt`	ISO 8601 string	yes	Retry scheduled after this attempt, in UTC
`correlationId`	string	no	Correlation id for support

Example response

json

{
  "success": true,
  "data": {
    "id": "8c2d4e6f-0a1b-4c3d-9e5f-7a8b9c0d1e2f",
    "subscriptionId": "6b1e2c3d-4f50-4a61-8b72-93a4b5c6d7e8",
    "eventId": "0e4f8a2b-6c1d-4e3f-9a5b-7c8d9e0f1a2b",
    "eventName": "enrollment.created",
    "subjectType": "Enrollment",
    "subjectId": "2f6a9c3e-1b4d-4a7e-8c0f-5d2e6b9a1c3f",
    "correlationId": "5a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
    "occurredAt": "2026-09-21T10:00:00.000Z",
    "status": "succeeded",
    "attemptCount": 2,
    "nextAttemptAt": null,
    "lastStatusCode": 200,
    "lastError": null,
    "replayOfDeliveryId": null,
    "createdAt": "2026-09-21T10:00:00.000Z",
    "updatedAt": "2026-09-21T10:02:01.000Z",
    "payload": {
      "enrollmentId": "2f6a9c3e-1b4d-4a7e-8c0f-5d2e6b9a1c3f",
      "accessToken": "[REDACTED]"
    },
    "signature": {"configured": true, "value": null},
    "attempts": [
      {
        "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
        "attemptNumber": 1,
        "startedAt": "2026-09-21T10:00:01.000Z",
        "durationMs": 412,
        "succeeded": false,
        "statusCode": 503,
        "errorCategory": "http_error",
        "responseExcerpt": "Service Unavailable",
        "nextRetryAt": "2026-09-21T10:01:01.000Z"
      },
      {
        "id": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e",
        "attemptNumber": 2,
        "startedAt": "2026-09-21T10:02:00.000Z",
        "durationMs": 180,
        "succeeded": true,
        "statusCode": 200,
        "errorCategory": null,
        "responseExcerpt": "{\"ok\":true}",
        "nextRetryAt": null
      }
    ]
  },
  "correlationId": "b7d3e1f0-2a4c-4e8b-9c1d-0f2e3a4b5c6d"
}

Notes

Keys such as authorization, cookie, password, secret, token, signature or ending in apiKey are shown as [REDACTED], and the query string of any https:// URL is hidden. Your endpoint receives the original, unredacted payload.
The example payload is illustrative; its shape depends on the event.

Get a webhook delivery

Get a webhook delivery

Authorization

Path parameters

Request headers

Example

Response

Response fields

Example response

Notes

Related

Authorization

Path parameters

Request headers

Example

Response

Response fields

Example response

Notes

Related