Webhooks
Send a test event
https://ecdsa.com/api/v1/webhooks/testSends a "webhook.test" event to one endpoint of the API key's account — also to one that is switched off — and answers once the first attempt is made: status delivered, or pending with the receiver's HTTP status or the failure in lastError (a failed test event is retried like any other delivery). The event's data is {"endpoint": {"id", "url"}}. At most 10 test events per endpoint and hour (rate_limited with Retry-After). Deliveries are POST requests with a JSON body, signed with ECDSA P-256 (ES256): headers ECDSA-Webhook-Id, ECDSA-Webhook-Timestamp and ECDSA-Signature (t=<unix seconds>,kid=<key id>,es256=<base64url r‖s>) over the UTF-8 bytes of "<id>.<t>.<raw body>". The public keys are the JWKS at https://ecdsa.com/.well-known/ecdsa-webhook-keys.json; every official SDK verifies deliveries with verifyWebhook().
- API-ключ
- Обязателен, с областью доступа webhooks
- Расход квоты при вызове с ключом
- 1 единица за вызов
- Лимит запросов
- 60 запросов в минуту с одного IP
Запрос
Тело запроса (JSON): SendWebhookTestRequest
| Поле | Тип | Обязательное | Описание |
|---|---|---|---|
| id | string | да | The endpoint's id (listWebhooks lists them). |
Ответы
200The test delivery after its first attempt.
| Поле | Тип | Обязательное | Описание |
|---|---|---|---|
| delivery | WebhookDelivery | да |
Заголовки: X-Request-Id · X-RateLimit-Limit · X-RateLimit-Remaining · X-RateLimit-Reset · X-Quota-Limit · X-Quota-Remaining · X-Quota-Reset
| Статус | Значение | Коды |
|---|---|---|
| 400 | Bad request. Input limits: a request body of at most 100 KB (a larger one is answered with 413) and arrays and objects nested at most 64 levels deep, JSON documents inside string fields included. | |
| 401 | Unauthorized. | |
| 403 | Forbidden. | |
| 404 | Not found. | |
| 405 | Method not allowed. | |
| 413 | Payload too large. | |
| 429 | Too many requests. | |
| 500 | Internal server error. | |
| 503 | Service unavailable. | |
| 504 | Gateway timeout. |
Каждый ответ с ошибкой содержит JSON-объект ошибки; что означает каждый код и что с ним делать, сказано в таблице ошибок.
Пример
Send a test event
curl -sS 'https://ecdsa.com/api/v1/webhooks/test' \
-H "authorization: Bearer $ECDSA_API_KEY" \
-H 'content-type: application/json' \
-d '{
"id": "7349e17c-8b41-4fc1-b1a9-dca88578ca1c"
}'const response = await fetch("https://ecdsa.com/api/v1/webhooks/test", {
method: "POST",
headers: { "content-type": "application/json", authorization: `Bearer ${process.env.ECDSA_API_KEY}` },
body: JSON.stringify({
"id": "7349e17c-8b41-4fc1-b1a9-dca88578ca1c"
}),
});
console.log(response.status, await response.json());import os
import httpx
response = httpx.post(
"https://ecdsa.com/api/v1/webhooks/test",
headers={"authorization": f"Bearer {os.environ['ECDSA_API_KEY']}"},
json={
"id": "7349e17c-8b41-4fc1-b1a9-dca88578ca1c",
},
timeout=30.0,
)
print(response.status_code, response.json()){
"delivery": {
"id": "6491ad3b-5b71-417e-a73a-efdb977de0e1",
"type": "webhook.test",
"status": "delivered",
"attempts": 1,
"createdAt": "2026-10-20T07:34:27.000Z",
"lastAttemptAt": "2026-10-20T07:34:27.000Z",
"lastStatusCode": 204,
"lastError": null,
"nextAttemptAt": null,
"deliveredAt": "2026-10-20T07:34:27.000Z"
}
}Ответ API на этот пример, полученный для этой страницы 20 октября 2026 г.; относительное время и количество дней в нём отсчитываются от этого дня.
Коды ошибок
| Код | Статус | Значение |
|---|---|---|
| invalid_json | 400 | The body is not valid JSON or not a JSON object; or the input nests arrays and objects more than 64 levels deep (JSON documents inside string fields count too), or is too complex to inspect for private keys. |
| missing_field | 400 | A required field is absent or empty. |
| private_key_rejected | 400 | The request contains private-key material (a PEM PRIVATE KEY block, an OpenSSH, SSH2 or PuTTY private key, or a JWK with "d"). Never send private keys anywhere. |
| unauthorized | 401 | The Authorization or X-API-Key header is malformed, the API key is not valid (wrong checksum, unknown, revoked or expired), or the operation needs a key. |
| forbidden_scope | 403 | The API key is valid but lacks a scope this operation requires; the message names it. |
| not_found | 404 | No operation exists at this path. |
| webhook_not_found | 404 | The API key's account has no webhook endpoint with this id. |
| method_not_allowed | 405 | The path exists but does not accept this HTTP method; see the Allow header. |
| payload_too_large | 413 | The body exceeds 100 KB. |
| rate_limited | 429 | Too many requests — see Retry-After. |
| quota_exceeded | 429 | A daily or monthly quota of the API key's account is used up. X-Quota-Reset (and Retry-After) say when it starts over; retrying earlier cannot succeed. |
| internal_error | 500 | Unexpected server error. |
| service_unavailable | 503 | API keys cannot be verified right now (the key store is unreachable); retry shortly. |
| webhooks_unavailable | 503 | Webhooks are switched off on this server: it has no signing keys configured. |
| timeout | 504 | The operation did not finish within its time budget. |
Схемы
WebhookDelivery
| Поле | Тип | Обязательное | Описание |
|---|---|---|---|
| id | string | да | Delivery id, sent as ECDSA-Webhook-Id and as the body's id; the same on every retry. |
| type | string | да | Event type, e.g. "monitor.grade_changed" or "webhook.test". |
| status | string | да |
|
| attempts | integer | да |
|
| createdAt | string | да | UTC time, ISO 8601.
|
| lastAttemptAt | string | null | да | |
| lastStatusCode | integer | null | да | HTTP status of the last attempt; null when no response arrived. |
| lastError | string | null | да | Why the last attempt failed: "http_status" (any status outside 200–299, redirects included), "timeout", "address_refused", "tls_certificate", "endpoint_disabled", … ; null after a success. |
| nextAttemptAt | string | null | да | When a pending delivery is tried again. |
| deliveredAt | string | null | да |
Error
The error envelope of every non-2xx response.
| Поле | Тип | Обязательное | Описание |
|---|---|---|---|
| error | object | да | |
| error.code | string | да | Machine-readable error code. Each response lists the codes it can carry; new codes may be added within v1, so treat an unknown code by its HTTP status. |
| error.message | string | да | Human-readable explanation (English). |
| error.requestId | string | нет | The X-Request-Id of this request — quote it when reporting a problem. Sent since v1.1. |
| error.detail | object | нет | Structured context for the error, such as the offending field; omitted when there is none.
|
| error.docs | string | нет | Where the error codes are explained. Sent since v1.1.
|
Все операции перечислены в справочнике API.