POSThttps://api.veriko.mx/v1/webhooks/{id}/test

Send a test event to the webhook

Audience: public
Auth: API key
Permission: webhooks:create

Sends a synthetic delivery to the endpoint to check the receiver is standing. It is the natural next step after registering or updating an endpoint: it confirms the receiver answers with an HTTP 2xx status and validates the body signature.

A failed test does not count against the endpoint. The consecutive failure counter that eventually disables it is not touched here, so testing as often as needed does not bring the endpoint closer to automatic disabling.

Before anything is sent, the address is re-checked. A name that does not resolve, or an address pointing at the internal network, leaves the result with delivered=false and the detail in error.

Parameters
Parameter	In	Type	Required	Description
`id`*	path	`string (uuid)`	required	Unique identifier of the webhook endpoint (UUID v4). e.g. `f47ac10b-58cc-4372-a567-0e02b2c3d479`

Request

cURLPython•JavaScript•PHP•

curl -X POST 'https://api.veriko.mx/v1/webhooks/{id}/test' \
  -H 'Authorization: Bearer veriko_••••' \
  -H 'Content-Type: application/json'

Python example — coming soon.

JavaScript example — coming soon.

PHP example — coming soon.

**Response 200**`SendWebhookTestAttributes` — Result of the test delivery attempt. `delivered=false` when the URL fails SSRF re-validation (`error` carries the detail) or when the receiver responded with a non-`2xx` code.
Field	Type	Description
`delivered`*	`boolean`	`true` when the receiver answered with an HTTP `2xx` status within the timeout. `false` when SSRF re-validation fails, DNS does not resolve, the receiver times out, or it answers with a non-`2xx` status code. e.g. `true`
`http_status`*	`integer`	HTTP status code the receiver answered with. `0` when no HTTP response was received (DNS, timeout, or SSRF re-validation failure before the connection). e.g. `200`
`response_time_ms`*	`integer`	Duration of the delivery attempt, in milliseconds. Includes DNS, TLS, and the roundtrip. e.g. `184`
`error`*	`string \| null`nullable	Transport or URL-validation failure detail. It can be `null` even when `delivered=false` if the receiver returned a non-`2xx` status but the request completed. e.g. `Connection timed out after 10s`

**Response status codes**`POST /v1/webhooks/{id}/test`
Status	Class	Description	Body
200	`2xx`	Result of the test delivery attempt. `delivered=false` when the URL fails SSRF re-validation (`error` carries the detail) or when the receiver responded with a non-`2xx` code.	`SendWebhookTestAttributes`
401	`4xx`	Authentication is required or the provided credentials are invalid.	`ErrorResponse`
403	`4xx`	Insufficient permissions.	`ErrorResponse`
404	`4xx`	`not_found`: Endpoint does not exist or does not belong to the user.	`ErrorResponse`
429	`4xx`	Rate limit exceeded	`ErrorResponse`

**Errors from `POST /v1/webhooks/{id}/test`**
Status	Code	Example
401	`unauthorized`	Invalid or missing authentication credentials. Envelope meta.request_id `c4d5e6f7a8b99b8a7f6e5d4c`
403	`permission_denied`	You do not have permission to access this resource. Envelope meta.request_id `d5e6f7a8b9c00c9b8a7f6e5d`
429	`rate_limit_exceeded`	Rate limit exceeded. Try again in 45 seconds. Envelope meta.request_id `f7a8b9c0d1e22e1d0c9b8a7f` Response headers `Retry-After`: integer — Seconds to wait before retrying. Matches the endpoint's rate-limit window (typically 60s for list endpoints, 1-5s for in-flight idempotent operations). `X-RateLimit-Limit`: integer — Configured request cap for this bucket. It is emitted on every 429 and, on the authenticated API, also on successful responses, where it is the per-key cap of the account plan. `X-RateLimit-Remaining`: integer — Requests remaining in the current window. Always 0 at the moment of the 429; on a successful response of the authenticated API it is what is left of the per-key cap. `X-RateLimit-Reset`: integer — Absolute Unix epoch (seconds) when the window resets. Emitted on every 429, alongside Retry-After, and on successful responses of the authenticated API. Per-endpoint overrides exist (e.g. `rate_limited_login`).