Inspect and search events

Every request your ingest URL receives is a captured event you can browse, filter, read in full, and tail live. This guide covers finding events and reading their contents; to forward them to your machine, see replay to localhost. Reading events needs an API key with events:read.

List and filter

events.list returns events newest-first, through an opaque keyset cursor. Pass an endpointId for a single endpoint, or omit it to browse your whole org’s events on one page — the same consolidated view the dashboard’s Events page shows. All filters are optional and combine with AND:

endpointId — one endpoint, or omit for the whole org.
provider — repeatable; matches any of the given providers.
verification state — verified, authenticated, failed, or unattempted; repeatable.
method — the request’s HTTP method (GET, POST, …); repeatable.
event type — the parsed event type (e.g. charge.succeeded); repeatable. Only stripe, github, and shopify populate it today — for every other provider it’s null, so filtering by it returns nothing (not “no events”).
dedup strategy — how the event’s dedup key was derived (content_hash, sw_webhook_id, provider_event_id, fields, unique); repeatable.
after / before — a received-at range (after is inclusive, before is exclusive). after accepts an RFC 3339 timestamp or a relative duration — 7d, 24h, 30m, or now.
search — a case-insensitive substring (minimum 3 characters) across the event’s provider event id and dedup key; an exact match when the term is an event id. Request headers and payload bodies are not searched.

limit caps a page at 200. On the CLI, --all follows the cursor to the end for you.

# failed Stripe events across the WHOLE org in the last 7 days, following every page
wbhk events list \
  --provider stripe \
  --status failed \
  --after 7d \
  --all

# one endpoint, POSTs only, by dedup strategy
wbhk events list <endpoint-id> --method POST --dedup-strategy content_hash

# free-text search across the provider event id + dedup key
wbhk events list <endpoint-id> --search "evt_1P9x"

# Omit endpointId for the whole org. The nested /v1/endpoints/<id>/events is a deprecated alias.
curl -G "https://api.webhook.co/v1/events" \
  -H "Authorization: Bearer $WEBHOOK_API_KEY" \
  --data-urlencode "endpointId=<endpoint-id>" \
  --data-urlencode "provider=stripe" \
  --data-urlencode "verificationState=failed" \
  --data-urlencode "receivedAfter=2026-07-09T00:00:00Z" \
  --data-urlencode "limit=200"

for await (const event of webhook.events.list({
  endpointId,
  provider: ["stripe"],
  verificationState: ["failed"],
  receivedAfter: "2026-07-09T00:00:00Z",
})) {
  console.log(event.id, event.verificationState);
}

for event in client.events.list(
    endpoint_id=endpoint_id,
    provider=["stripe"],
    verification_state=["failed"],
    received_after="2026-07-09T00:00:00Z",
):
    print(event.id, event.verification_state)

On the CLI, --provider and --status are repeatable (or comma-separated) for multi-select, and --before bounds the top of the range. Add --output json for a machine-readable stream.

Read one event

events.get returns a single event in full — request headers, its verification result, timing, and a pointer to the raw body.

wbhk events get <event-id>

curl "https://api.webhook.co/v1/events/<event-id>" \
  -H "Authorization: Bearer $WEBHOOK_API_KEY"

const event = await webhook.events.get(eventId);
console.log(event.headers, event.verification);

Get the raw body

events.getPayload returns the exact captured bytes. On the wire the body rides a JSON envelope — contentType, bytes (the decoded length), and the base64-wrapped body — so binary payloads and exact-byte signature fidelity survive intact. The CLI writes the raw bytes verbatim, so redirecting to a file is byte-exact:

wbhk events payload <event-id> > event.json
# lossless envelope (the safe view for a binary body):
wbhk events payload <event-id> --output json

TypeScript

const { contentType, bytes, body } = await webhook.events.getPayload(eventId);
console.log(contentType, bytes, body.byteLength);

Payload retrieval is available on the CLI, API, and SDKs. It isn’t exposed over MCP — an agent reads event metadata with events.get instead.

Tail live

events.tail is a forward, cursor-based tail with a since grammar (now, beginning, a duration, or an RFC 3339 instant) and cursor bookkeeping — headCursor for the current head, caughtUp once a page reaches it, and lag for how far behind you are. It’s the pull form the API and SDKs expose. For a live stream in your terminal, the CLI wraps it as wbhk listen <endpoint-id>, which prints each event as it arrives. Add --forward to re-deliver them to your local server instead — see replay to localhost.

How-to guides

Providers

Recipes

Inspect and search events

List and filter

Read one event

Get the raw body

Tail live

​List and filter

​Read one event

​Get the raw body

​Tail live

List and filter

Read one event

Get the raw body

Tail live