Webhook

Generates the signing secret and returns it once in the response; it is never shown again. Fails with 400 webhook_endpoints_limit_reached when the shop already keeps the configured maximum number of endpoints (30).

Replace the subscription list with enabled_events, or change it incrementally with add_events / remove_events; the two styles cannot be combined in one request. Disabling an endpoint marks its scheduled and queued deliveries as skipped (an attempt already in flight finishes); enabling resets the failure counters. Enabling may carry resend_since: every skipped or failed delivery of the endpoint created at or after that time goes back to scheduled (due now, attempt count kept) and the response gains meta.resent_deliveries with the number of rows re-scheduled. resend_since is rejected (422) unless status is enabled in the same request.

Soft delete. Scheduled and queued deliveries become skipped with reason endpoint_disabled. All its deliveries stay listed, filterable by its id and readable; a retry of one is a 409 endpoint_disabled.

Returns the new secret once. The previous secret keeps verifying deliveries until previous_secret_expires_at; pass grace_period_seconds: 0 to drop it immediately.

Records a webhook.ping event for this endpoint and sends it through the normal pipeline (render, fan-out, delivery). A ping is delivered only to the endpoint it was requested on, whatever its enabled_events say. Every newly created endpoint receives one automatically. No request body.

Deliveries of the shop, newest first, across every endpoint, deleted endpoints included. Narrow them to one endpoint with endpoint_id or to one event with event_id.

One more attempt of a succeeded, failed or skipped delivery of an enabled, not deleted endpoint. The row goes to queued (failure_reason cleared, attempt_count kept) and is handed to the delivery workers once the change is saved; the response shows the row as queued with its attempts so far. The attempt is a single manual try: a retryable failure of a delivery whose attempts are already spent finalises it as failed / exhausted again, a success is a success. A delivery that is still scheduled, queued or in_flight is a 409 delivery_already_scheduled; a disabled or deleted endpoint is a 409 endpoint_disabled. Rate limited to 60 requests per minute per shop. No request body.

Returns the stored envelope of each event, newest first. type and types[] are mutually exclusive. delivered=0 returns events with at least one delivery that has not succeeded; delivered=1 returns events whose deliveries all succeeded.