Webhook deliveries and activity

GET /webhooks/{id}/deliveries reads one endpoint’s delivery log and GET /webhooks/deliveries reads every endpoint’s at once, optionally narrowed by endpointIds. Both take status (failed is the console’s "only failed" switch), since and until, page with limit and cursor, and keep the cursor valid under every filter as long as each page sends the same ones. Each row carries its endpointId. Nothing is pruned.

{  "object": "list",  "data": [    { "object": "webhook_delivery", "id": "whd_8c1e4a7f2b9d3e6a0c5f1b28", "endpointId": "whe_3f9c2a7b1e4d8f60a5c7b92d", "eventType": "email.bounced", "status": "failed", "responseCode": 503, "attempt": 2, "maxAttempts": 8, "nextAttemptAt": "2026-09-23T10:35:00.000Z" }  ],  "hasMore": true,  "nextCursor": "whd_8c1e4a7f2b9d3e6a0c5f1b28"}

GET /webhooks/{id}/deliveries/{deliveryId} returns the body that was sent, what the receiver answered and every try of the event, and POST …/replay sends that event again, one at a time. The body names the addresses the event is about, so a key narrowed to some addresses may open a delivery only on an endpoint whose own allowlists sit inside the key’s, and holding one address never covers its whole domain. Over OAuth only the owner of the workspace, or a member whose role reaches every address, may open or replay one. That member’s token is held to the domains the workspace has now, so it opens only a delivery of an endpoint with allowlists, and one with none answers 422 capability_unsupported and needs the owner’s app or a workspace key. The console and the MCP server have no such limit: there such a member reads and replays the deliveries of every endpoint, on MCP through an app connected with every address.

GET /webhooks/activity and GET /webhooks/{id}/activity read the audit log: created, updated, enabled, disabled, auto_disabled, secret_rotated, tested, replayed and removed. actor names who did it, a person as @username and a key as API key <name>, and is null when Nextmail did it on its own. endpointIds, since and until narrow it, and a removed endpoint keeps its history.

• GET/webhooks/deliveriesFull reference
• GET/webhooks/{id}/deliveriesFull reference
• GET/webhooks/{id}/deliveries/{deliveryId}Full reference
• POST/webhooks/{id}/deliveries/{deliveryId}/replayFull reference
• GET/webhooks/activityFull reference
• GET/webhooks/{id}/activityFull reference