---
title: "Webhook deliveries and activity"
description: "Every delivery attempt and every change to an endpoint, filtered the way the console filters them."
url: "https://nextmail.sh/docs/api/webhooks/logs"
area: "API"
category: "Keys & webhook logs"
---

# Webhook deliveries and activity

Every delivery attempt and every change to an endpoint, filtered the way the console filters them.

**Also documents:** `GET /webhooks/deliveries`, `GET /webhooks/{id}/deliveries`, `GET /webhooks/{id}/deliveries/{deliveryId}`, `POST /webhooks/{id}/deliveries/{deliveryId}/replay`, `GET /webhooks/activity`, `GET /webhooks/{id}/activity`

## Deliveries

`GET /webhooks/{id}/deliveries` reads one endpoint’s delivery log and `GET /webhooks/deliveries` reads every endpoint’s at once, optionally narrowed by `endpointIds`. Both take `status` (`failed` is the console’s "only failed" switch), `since` and `until`, page with `limit` and `cursor`, and keep the cursor valid under every filter as long as each page sends the same ones. Each row carries its `endpointId`. Nothing is pruned.

**GET /webhooks/deliveries?status=failed&since=2026-09-22T00:00:00Z**

```
{
  "object": "list",
  "data": [
    { "object": "webhook_delivery", "id": "whd_8c1e4a7f2b9d3e6a0c5f1b28", "endpointId": "whe_3f9c2a7b1e4d8f60a5c7b92d", "eventType": "email.bounced", "status": "failed", "responseCode": 503, "attempt": 2, "maxAttempts": 8, "nextAttemptAt": "2026-09-23T10:35:00.000Z" }
  ],
  "hasMore": true,
  "nextCursor": "whd_8c1e4a7f2b9d3e6a0c5f1b28"
}
```

## Reading and replaying one

`GET /webhooks/{id}/deliveries/{deliveryId}` returns the body that was sent, what the receiver answered and every try of the event, and `POST …/replay` sends that event again, one at a time. The body names the addresses the event is about, so a key narrowed to some addresses may open a delivery only on an endpoint whose own allowlists sit inside the key’s, and holding one address never covers its whole domain. Over OAuth only the owner of the workspace, or a member whose role reaches every address, may open or replay one. That member’s token is held to the domains the workspace has now, so it opens only a delivery of an endpoint with allowlists, and one with none answers `422` `capability_unsupported` and needs the owner’s app or a workspace key. The console and the MCP server have no such limit: there such a member reads and replays the deliveries of every endpoint, on MCP through an app connected with every address.

## Activity

`GET /webhooks/activity` and `GET /webhooks/{id}/activity` read the audit log: created, updated, enabled, disabled, auto_disabled, secret_rotated, tested, replayed and removed. `actor` names who did it, a person as `@username` and a key as `API key <name>`, and is null when Nextmail did it on its own. `endpointIds`, `since` and `until` narrow it, and a removed endpoint keeps its history.

## Reference

- [`GET /webhooks/deliveries`](https://nextmail.sh/docs/api/reference/webhooks#get-webhooks-deliveries): full reference
- [`GET /webhooks/{id}/deliveries`](https://nextmail.sh/docs/api/reference/webhooks#get-webhooks-id-deliveries): full reference
- [`GET /webhooks/{id}/deliveries/{deliveryId}`](https://nextmail.sh/docs/api/reference/webhooks#get-webhooks-id-deliveries-deliveryid): full reference
- [`POST /webhooks/{id}/deliveries/{deliveryId}/replay`](https://nextmail.sh/docs/api/reference/webhooks#post-webhooks-id-deliveries-deliveryid-replay): full reference
- [`GET /webhooks/activity`](https://nextmail.sh/docs/api/reference/webhooks#get-webhooks-activity): full reference
- [`GET /webhooks/{id}/activity`](https://nextmail.sh/docs/api/reference/webhooks#get-webhooks-id-activity): full reference