Send a test event to the webhook

POST https://api.veriko.mx/v1/webhooks/{id}/test

Audience: public
Auth: API key
Permission: webhooks:create

Sends a synthetic test notification to the endpoint. Test deliveries do not increment the consecutive failure counter used for automatic endpoint disabling. Useful right after creating or updating an endpoint via POST /v1/webhooks to confirm the receiver returns 2xx and verifies the HMAC-SHA256 body signature. The id is the UUID returned by GET /v1/webhooks.

Parameters
Parameter	In	Type	Required	Description
`id` *	path	`string (uuid)`	required	UUID of the webhook endpoint.

Request

cURLPython•JavaScript•PHP•

curl -X POST 'https://api.veriko.mx/v1/webhooks/{id}/test' \
  -H 'Authorization: Bearer mxcep_••••' \
  -H 'Content-Type: application/json'

Python example — coming soon.

JavaScript example — coming soon.

PHP example — coming soon.

**Response 200** `SendWebhookTestAttributes` — Inline result of the test delivery attempt. `delivered=false` when the URL fails SSRF re-validation (`error` carries the detail) or when the receiver responded with a non-2xx code.
Field	Type	Description
`delivered` *	`boolean`	`true` when the receiver responded with a `2xx` status within the timeout. `false` when URL SSRF re-validation fails, DNS doesn't resolve, the receiver times out, or it answers with a non-`2xx` status code.
`http_status` *	`integer`	HTTP status code the receiver answered with. `0` when no HTTP response was received (DNS, timeout, SSRF re-validation failure before the connection).
`response_time_ms` *	`integer`	Total elapsed time between the start of the delivery attempt and the response (or timeout) in milliseconds. Includes DNS + TLS + roundtrip.
`error`	`string \| null` nullable	Failure detail when `delivered=false`. `null` when the delivery succeeded.

**Response status codes** `POST /v1/webhooks/{id}/test`
Status	Class	Description	Body
200	`2xx`	Inline result of the test delivery attempt. `delivered=false` when the URL fails SSRF re-validation (`error` carries the detail) or when the receiver responded with a non-2xx code.	No body
401	`4xx`	Authentication is required or the provided credentials are invalid.	`ErrorResponse`
403	`4xx`	Permisos insuficientes	`ErrorResponse`
404	`4xx`	`not_found` — endpoint does not exist or does not belong to the user.	`ErrorResponse`
429	`4xx`	Rate limit exceeded	`ErrorResponse`

**Errors from `POST /v1/webhooks/{id}/test`**
Status	Code	Detail
401	`unauthorized`	Invalid or missing authentication credentials. Envelope meta.request_id `c4d5e6f7a8b9`
403	`forbidden`	You do not have permission to access this resource. Envelope meta.request_id `d5e6f7a8b9c0`
429	`rate_limit_exceeded`	Rate limit exceeded. Try again in 45 seconds. Envelope meta.request_id `f7a8b9c0d1e2` Response headers `Retry-After` : integer — Seconds to wait before retrying. Matches the endpoint's rate-limit window (typically 60s for list endpoints, 1-5s for in-flight idempotent operations). `X-RateLimit-Limit` : integer — Configured request cap for this bucket (emitted only on 429). `X-RateLimit-Remaining` : integer — Requests remaining in the current window — always 0 at the moment of the 429 (emitted only on 429). `X-RateLimit-Reset` : integer — Absolute Unix epoch (seconds) when the window resets. Emitted only on 429, alongside Retry-After. Per-endpoint overrides exist (e.g. `rate_limited_login`).