Verify, test, and retry webhooks

Webhooks10 minIntermediate

After you create a webhook, the next step is operational: verify signatures, send test payloads, inspect delivery history, and retry failed deliveries. The webhook API exposes dedicated endpoints for each part of that loop.

Endpoints used in this guide

POST/api/v1/webhooks/verifyVerify a webhook signature.

POST/api/v1/webhooks/testSend a test payload.

POST/api/v1/webhooks/{id}/testTest a specific webhook by ID.

GET/api/v1/webhooks/{id}/deliveriesList delivery attempts.

POST/api/v1/webhooks/{id}/deliveries/{delivery_id}/retryRetry a failed delivery.

Verify a signature

The signature verification endpoint accepts an algorithm, a signature string, and the raw body string. This is useful for testing your own verification flow or for checking an HMAC configuration during setup.

curl

curl -X POST "https://algapsa.com/api/v1/webhooks/verify" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $ALGA_API_KEY" \
  -d '{
    "algorithm": "sha256",
    "signature": "sha256=abc123",
    "body": "{\"event_type\":\"ticket.created\"}"
  }'

Send a test payload

curl

curl -X POST "https://algapsa.com/api/v1/webhooks/test" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $ALGA_API_KEY" \
  -d '{
    "test_event_type": "ticket.created",
    "override_url": "https://httpbin.org/post"
  }'

curl -X POST "https://algapsa.com/api/v1/webhooks/$WEBHOOK_ID/test" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $ALGA_API_KEY" \
  -d '{
    "test_event_type": "invoice.finalized"
  }'

Inspect and retry deliveries

curl

curl -X GET "https://algapsa.com/api/v1/webhooks/$WEBHOOK_ID/deliveries?page=1&limit=25" \
  -H "X-API-Key: $ALGA_API_KEY"

curl -X POST "https://algapsa.com/api/v1/webhooks/$WEBHOOK_ID/deliveries/$DELIVERY_ID/retry" \
  -H "X-API-Key: $ALGA_API_KEY"

What to look for in delivery records

Status transitions such as pending, delivered, or failed.
Response status and error text from the downstream receiver.
Whether failures are schema problems, authentication issues, or transient network problems.