Send a test webhook
A delivery of type webhook.test sent now, signed as every delivery is, and its attempt in the answer. It is tried once, never retried, and shows in the deliveries. A disabled endpoint can be tested. A team sends up to 10 tests a minute; more answer 429.
apiKeyAuthorizationBearer <token>An API key from the web app, under Developers. It starts with rz_live_.
id*stringThe webhook endpoint's id (wh_).
length <= 100Idempotency-Key?string1 to 255 printable characters, new for each request (a UUID); the body up to 1 MB. For 24 hours a repeat with the same key, path and body gets the first answer, with Idempotent-Replayed: true, instead of running again; 5xx, 409 and 429 answers are not kept. Errors, Retries, has the rest.
1 <= length <= 255OK
application/json- response
id*stringendpointId*stringeventId*|The event it carries, as List events gives it and as webhook-id names it. Null for a test.
event*|The event's type, or webhook.test for a test.
status*stringpending: not tried yet. retrying: tried, and tried again at nextAttemptAt. delivered: an attempt got a 2xx. failed: Rizamo stopped trying (all retries used, a 410, an address it does not send to, the endpoint disabled or no longer taking the event, or a delivery it could not prepare).
"pending""retrying""delivered""failed"attempts*array<>Oldest first.
nextAttemptAt*|nullheld*booleanWaiting for its endpoint to answer again (breaker open), with no time set: it goes once an attempt to the endpoint is delivered, or as the breaker's next try.
deliveredAt*|nullcreatedAt*stringdate-timepayload*|The body as sent, JSON: the event as List events gives it. Null until the first attempt.
curl -X POST 'https://api.rizamo.com/v1/webhooks/wh_01m4m44q00ea9a11gpjs99ddcy/test' \ -H 'Idempotency-Key: 4b9e7c1a-2f3d-4e8a-9c6b-1d2e3f4a5b6c'{ "id": "whd_01m4v9ws80fmy4v5gn3x6j4q2a", "endpointId": "wh_01m4m44q00ea9a11gpjs99ddcy", "eventId": null, "event": "webhook.test", "status": "delivered", "attempts": [ { "number": 1, "at": "2026-11-04T10:30:00.000Z", "responseCode": 204, "durationMs": 141, "error": null } ], "nextAttemptAt": null, "held": false, "deliveredAt": "2026-11-04T10:30:00.000Z", "createdAt": "2026-11-04T10:30:00.000Z", "payload": "{\"id\":\"whd_01m4v9ws80fmy4v5gn3x6j4q2a\",\"type\":\"webhook.test\",\"at\":\"2026-11-04T10:30:00.000Z\",\"actor\":{\"type\":\"api_key\",\"keyId\":\"key_01m4qw9xw0fem94hjmcppyba8c\",\"name\":\"CRM sync\"},\"summary\":\"A test from Rizamo: nothing changed\",\"resource\":{\"type\":\"webhook_endpoint\",\"id\":\"wh_01m4m44q00ea9a11gpjs99ddcy\"},\"data\":{}}"}Rotate a webhook signing secret POST
A new signing secret, in the answer and only there. For 24 hours each delivery carries two signatures in `webhook-signature`, one with each secret, so the receiver can switch without losing any; then only the new one.
List webhook deliveries GET
Each event (and test) sent to an endpoint, newest first, with every attempt, from the last 30 days. A page at a time: pass `nextCursor` as `cursor` for the next one. Only deliveries of endpoints the caller sees; someone limited to some profiles sees only their profiles' events among them, and tests. Each payload is an event as `List events` shows it, so `webhooks:read` reads what `events:read` reads: the inbox's and comment automations' deliveries only with `inbox:read` or `automations:read` too.