Webhooks
Send a test event
https://ecdsa.com/api/v1/webhooks/testSends a "webhook.test" event to one endpoint of the API key's account — also to one that is switched off — and answers once the first attempt is made: status delivered, or pending with the receiver's HTTP status or the failure in lastError (a failed test event is retried like any other delivery). The event's data is {"endpoint": {"id", "url"}}. At most 10 test events per endpoint and hour (rate_limited with Retry-After). Deliveries are POST requests with a JSON body, signed with ECDSA P-256 (ES256): headers ECDSA-Webhook-Id, ECDSA-Webhook-Timestamp and ECDSA-Signature (t=<unix seconds>,kid=<key id>,es256=<base64url r‖s>) over the UTF-8 bytes of "<id>.<t>.<raw body>". The public keys are the JWKS at https://ecdsa.com/.well-known/ecdsa-webhook-keys.json; every official SDK verifies deliveries with verifyWebhook().
- Clave de API
- Obligatoria, con el ámbito webhooks
- Consumo de cuota con clave
- 1 unidad por llamada
- Límite de frecuencia
- 60 solicitudes/min por IP
Solicitud
Cuerpo JSON: SendWebhookTestRequest
| Campo | Tipo | Obligatorio | Descripción |
|---|---|---|---|
| id | string | sí | The endpoint's id (listWebhooks lists them). |
Respuestas
200The test delivery after its first attempt.
| Campo | Tipo | Obligatorio | Descripción |
|---|---|---|---|
| delivery | WebhookDelivery | sí |
Encabezados: X-Request-Id · X-RateLimit-Limit · X-RateLimit-Remaining · X-RateLimit-Reset · X-Quota-Limit · X-Quota-Remaining · X-Quota-Reset
| Estado | Significado | Códigos |
|---|---|---|
| 400 | Bad request. Input limits: a request body of at most 100 KB (a larger one is answered with 413) and arrays and objects nested at most 64 levels deep, JSON documents inside string fields included. | |
| 401 | Unauthorized. | |
| 403 | Forbidden. | |
| 404 | Not found. | |
| 405 | Method not allowed. | |
| 413 | Payload too large. | |
| 429 | Too many requests. | |
| 500 | Internal server error. | |
| 503 | Service unavailable. | |
| 504 | Gateway timeout. |
Todas las respuestas de error incluyen el sobre JSON; la tabla de errores explica qué significa cada código y qué hacer.
Ejemplo
Send a test event
curl -sS 'https://ecdsa.com/api/v1/webhooks/test' \
-H "authorization: Bearer $ECDSA_API_KEY" \
-H 'content-type: application/json' \
-d '{
"id": "7349e17c-8b41-4fc1-b1a9-dca88578ca1c"
}'const response = await fetch("https://ecdsa.com/api/v1/webhooks/test", {
method: "POST",
headers: { "content-type": "application/json", authorization: `Bearer ${process.env.ECDSA_API_KEY}` },
body: JSON.stringify({
"id": "7349e17c-8b41-4fc1-b1a9-dca88578ca1c"
}),
});
console.log(response.status, await response.json());import os
import httpx
response = httpx.post(
"https://ecdsa.com/api/v1/webhooks/test",
headers={"authorization": f"Bearer {os.environ['ECDSA_API_KEY']}"},
json={
"id": "7349e17c-8b41-4fc1-b1a9-dca88578ca1c",
},
timeout=30.0,
)
print(response.status_code, response.json()){
"delivery": {
"id": "6491ad3b-5b71-417e-a73a-efdb977de0e1",
"type": "webhook.test",
"status": "delivered",
"attempts": 1,
"createdAt": "2026-10-20T07:34:27.000Z",
"lastAttemptAt": "2026-10-20T07:34:27.000Z",
"lastStatusCode": 204,
"lastError": null,
"nextAttemptAt": null,
"deliveredAt": "2026-10-20T07:34:27.000Z"
}
}La respuesta de la API a este ejemplo, generada para esta página el 20 de octubre de 2026; los tiempos relativos y los recuentos de días que contiene se refieren a ese día.
Códigos de error
| Código | Estado | Significado |
|---|---|---|
| invalid_json | 400 | The body is not valid JSON or not a JSON object; or the input nests arrays and objects more than 64 levels deep (JSON documents inside string fields count too), or is too complex to inspect for private keys. |
| missing_field | 400 | A required field is absent or empty. |
| private_key_rejected | 400 | The request contains private-key material (a PEM PRIVATE KEY block, an OpenSSH, SSH2 or PuTTY private key, or a JWK with "d"). Never send private keys anywhere. |
| unauthorized | 401 | The Authorization or X-API-Key header is malformed, the API key is not valid (wrong checksum, unknown, revoked or expired), or the operation needs a key. |
| forbidden_scope | 403 | The API key is valid but lacks a scope this operation requires; the message names it. |
| not_found | 404 | No operation exists at this path. |
| webhook_not_found | 404 | The API key's account has no webhook endpoint with this id. |
| method_not_allowed | 405 | The path exists but does not accept this HTTP method; see the Allow header. |
| payload_too_large | 413 | The body exceeds 100 KB. |
| rate_limited | 429 | Too many requests — see Retry-After. |
| quota_exceeded | 429 | A daily or monthly quota of the API key's account is used up. X-Quota-Reset (and Retry-After) say when it starts over; retrying earlier cannot succeed. |
| internal_error | 500 | Unexpected server error. |
| service_unavailable | 503 | API keys cannot be verified right now (the key store is unreachable); retry shortly. |
| webhooks_unavailable | 503 | Webhooks are switched off on this server: it has no signing keys configured. |
| timeout | 504 | The operation did not finish within its time budget. |
Esquemas
WebhookDelivery
| Campo | Tipo | Obligatorio | Descripción |
|---|---|---|---|
| id | string | sí | Delivery id, sent as ECDSA-Webhook-Id and as the body's id; the same on every retry. |
| type | string | sí | Event type, e.g. "monitor.grade_changed" or "webhook.test". |
| status | string | sí |
|
| attempts | integer | sí |
|
| createdAt | string | sí | UTC time, ISO 8601.
|
| lastAttemptAt | string | null | sí | |
| lastStatusCode | integer | null | sí | HTTP status of the last attempt; null when no response arrived. |
| lastError | string | null | sí | Why the last attempt failed: "http_status" (any status outside 200–299, redirects included), "timeout", "address_refused", "tls_certificate", "endpoint_disabled", … ; null after a success. |
| nextAttemptAt | string | null | sí | When a pending delivery is tried again. |
| deliveredAt | string | null | sí |
Error
The error envelope of every non-2xx response.
| Campo | Tipo | Obligatorio | Descripción |
|---|---|---|---|
| error | object | sí | |
| error.code | string | sí | Machine-readable error code. Each response lists the codes it can carry; new codes may be added within v1, so treat an unknown code by its HTTP status. |
| error.message | string | sí | Human-readable explanation (English). |
| error.requestId | string | no | The X-Request-Id of this request — quote it when reporting a problem. Sent since v1.1. |
| error.detail | object | no | Structured context for the error, such as the offending field; omitted when there is none.
|
| error.docs | string | no | Where the error codes are explained. Sent since v1.1.
|
Todas las operaciones aparecen en la referencia de la API.