Events we published to this tenant's webhook destinations

GET

/operator/webhooks/events

const url = 'http://localhost:3000/operator/webhooks/events?limit=25';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'http://localhost:3000/operator/webhooks/events?limit=25' \
  --header 'Authorization: Bearer <token>'

Records what was SENT, not what was delivered. The delivery layer exposes no read API, so response codes and retry outcomes are unavailable; status is whether our publish call succeeded and attempts is how many times we tried.

Only recorded for tenants with at least one configured destination, so a tenant that has never set up a webhook sees an empty log.

Takes no tenant id — the tenant comes from the operator session, which is what makes IDOR structurally impossible. Keyset pagination on (created_at DESC, id DESC); cursor is accepted as a deprecated alias for next. Both owner and member may read.

Authorizations

operatorToken

Parameters

Query Parameters

limit

integer

default: 25 >= 1 <= 100

next

string

Cursor from the previous page.

Responses

200

A page of published events.

application/json

object

results

Array<object>

An event we published to the tenant’s webhook destinations. This records what was SENT, not what was delivered: the delivery layer exposes no read API, so response codes and retry outcomes are unavailable. status is whether our publish call succeeded; attempts is how many times we tried.

object

string format: uuid

idempotency_key

string

event_type

string

entity_id

string

payload

object

key

additional properties

any

status

string

Allowed values: published failed

error

string | null

attempts

integer

created_at

string format: date-time

next

string | null

Example

{
  "results": [
    {
      "event_type": "activity.added",
      "status": "published"
    }
  ]
}

400

Malformed cursor.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

401

Invalid, expired, revoked, or absent token.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}

403

Caller is platform staff, who have no tenant to inspect.

application/json

object

error

required

object

code

required

string

Allowed values: VALIDATION_FAILED UNAUTHENTICATED FORBIDDEN NOT_FOUND CONFLICT RATE_LIMITED INTERNAL

message

required

string

requestId

required

string

fields

Present only for VALIDATION_FAILED.

Array<object>

object

path

string

message

string

Example

{
  "error": {
    "code": "VALIDATION_FAILED"
  }
}