Webhooks API
Manage endpoints and deliveries programmatically — the same operations as Developers › Webhooks and Events, with your API key.
Everything you do in Developers › Webhooks and Developers › Events is also available through the API, with the same authentication as the rest of Tonder's API.
Webhooks 2.0 is enabled per account. If Developers in your dashboard has no Events tab, your account is on the previous version: ask your Tonder contact to enable it.
Base URL. Your Tonder contact gives you the base URL for each environment (sandbox and production). The paths on this page are relative to it.
Authentication
Authorization: Token YOUR_API_KEY
Content-Type: application/jsonKeep this key on your server. With your API key anyone can add an endpoint and receive your events, rotate a signing secret or disable an endpoint. Never put it in front-end or mobile code. If an endpoint you don't recognize appears in the list, delete it and rotate the key.
Operations
| Method and path | Purpose |
|---|---|
GET /v1/endpoints | List your endpoints. |
POST /v1/endpoints | Create an endpoint (10 maximum). |
GET /v1/endpoints/{id} | Get one endpoint. |
PATCH /v1/endpoints/{id} | Edit an endpoint, including disabling it. |
DELETE /v1/endpoints/{id} | Delete an endpoint. |
POST /v1/endpoints/{id}/rotate-secret | Generate a new signing secret. |
POST /v1/endpoints/{id}/test | Send an endpoint.test event. |
GET /v1/event-types | The event catalog and the retry policy. |
GET /v1/deliveries | List deliveries. |
GET /v1/deliveries/stats | Count deliveries by status. |
GET /v1/deliveries/{id} | Get one delivery with all its attempts. |
POST /v1/deliveries/{id}/retry | Resend one delivery. |
POST /v1/deliveries/retry | Retry the Failed deliveries that match a filter. |
List deliveries
GET /v1/deliveries accepts these query parameters:
| Parameter | Description |
|---|---|
status | Delivery status. |
event_type | Event type. Repeat the parameter to match several. |
endpoint_id | One endpoint. |
from, to | Date range in ISO 8601. The last 7 days by default, 60 at most. |
search | The same search as the Events log: transaction id, client_reference or metadata.external_id, Tonder's transaction id, evt_… or dlv_…. |
limit | Page size, up to 100. 25 by default. |
cursor | The next_cursor from the previous page. |
When more results exist, the response carries next_cursor: pass it as cursor, with the same
filters, to get the next page.
Rate limits
300 reads and 60 writes per minute per merchant, shared with the dashboard. Above that you get a
429 with a Retry-After header.
Errors
Every error answers with an error object:
| Field | Description |
|---|---|
error.code | Machine-readable code. |
error.message | Human-readable explanation. |
error.details | Extra context about the error. |
error.code | Meaning |
|---|---|
url_not_allowed | The endpoint URL is not https://, or points to a private or internal address. |
retry_in_progress | An attempt for that delivery is already in progress. |
endpoint_unavailable | The endpoint is disabled or deleted. |