Send a test event to the webhook

POSThttps://api.veriko.mx/v1/webhooks/{id}/test

Audience: public
Auth: API key
Permission: webhooks:create

Sends a synthetic delivery to the endpoint to check the receiver is standing. It is the natural next step after registering or updating an endpoint: it confirms the receiver answers 2xx and validates the body signature. A failed test does not count against the endpoint. The consecutive failure counter that eventually disables it is not touched here, so testing as often as needed does not bring the endpoint closer to automatic endpoint disabling. Useful right after creating or updating an endpoint via POST /v1/webhooks to confirm the receiver returns 2xx and verifies the HMAC-SHA256 body signature. The id is the UUID returned by GET /v1/webhooks.

Parameters
Parameter	In	Type	Required	Description
`id`*	path	`string (uuid)`	required	UUID of the webhook endpoint. e.g. `f47ac10b-58cc-4372-a567-0e02b2c3d479`

Request

cURLPython•JavaScript•PHP•

curl -X POST 'https://api.veriko.mx/v1/webhooks/{id}/test' \
  -H 'Authorization: Bearer veriko_••••' \
  -H 'Content-Type: application/json'

Python example — coming soon.

JavaScript example — coming soon.

PHP example — coming soon.

**Response 200**`SendWebhookTestAttributes` — Inline result of the test delivery attempt. `delivered=false` when the URL fails SSRF re-validation (`error` carries the detail) or when the receiver responded with a non-2xx code.
Field	Type	Description
`delivered`*	`boolean`	`true` when the receiver responded with a `2xx` status within the timeout. `false` when URL SSRF re-validation fails, DNS doesn't resolve, the receiver times out, or it answers with a non-`2xx` status code. e.g. `true`
`http_status`*	`integer`	HTTP status code the receiver answered with. `0` when no HTTP response was received (DNS, timeout, SSRF re-validation failure before the connection). e.g. `200`
`response_time_ms`*	`integer`	Total elapsed time between the start of the delivery attempt and the response (or timeout) in milliseconds. Includes DNS + TLS + roundtrip. e.g. `184`
`error`	`string \| null`nullable	Failure detail when `delivered=false`. `null` when the delivery succeeded. e.g. `Connection timed out after 10s`

**Response status codes**`POST /v1/webhooks/{id}/test`
Status	Class	Description	Body
200	`2xx`	Inline result of the test delivery attempt. `delivered=false` when the URL fails SSRF re-validation (`error` carries the detail) or when the receiver responded with a non-2xx code.	No body
400	`4xx`	The endpoint address could not be reached or was blocked. The code is `url_dns_failed` when the name does not resolve, and `url_ssrf_blocked` when it points at an internal network address.	`ErrorResponse`
401	`4xx`	Authentication is required or the provided credentials are invalid.	`ErrorResponse`
403	`4xx`	Insufficient permissions.	`ErrorResponse`
404	`4xx`	`not_found` — endpoint does not exist or does not belong to the user.	`ErrorResponse`
429	`4xx`	Rate limit exceeded	`ErrorResponse`

**Errors from `POST /v1/webhooks/{id}/test`**
Status	Code	Example
400	`url_dns_failed`	The host name could not be resolved. Envelope meta.request_id `a2b3c4d5e6f7`
400	`url_ssrf_blocked`	The URL points at an internal address. Envelope meta.request_id `b3c4d5e6f7a8`
401	`unauthorized`	Invalid or missing authentication credentials. Envelope meta.request_id `c4d5e6f7a8b9`
403	`forbidden`	You do not have permission to access this resource. Envelope meta.request_id `d5e6f7a8b9c0`
429	`rate_limit_exceeded`	Rate limit exceeded. Try again in 45 seconds. Envelope meta.request_id `f7a8b9c0d1e2` Response headers `Retry-After`: integer — Seconds to wait before retrying. Matches the endpoint's rate-limit window (typically 60s for list endpoints, 1-5s for in-flight idempotent operations). `X-RateLimit-Limit`: integer — Configured request cap for this bucket (emitted only on 429). `X-RateLimit-Remaining`: integer — Requests remaining in the current window — always 0 at the moment of the 429 (emitted only on 429). `X-RateLimit-Reset`: integer — Absolute Unix epoch (seconds) when the window resets. Emitted only on 429, alongside Retry-After. Per-endpoint overrides exist (e.g. `rate_limited_login`).