List inbound rejections

GET

/v1/inbound-rejections

• Production

Retrieve a log of rejected inbound webhooks. Rejections occur when incoming requests fail verification (invalid token, HMAC mismatch, IP not allowed, etc.).

Authorizations

• BearerAuth

Parameters

Query Parameters

inbound_endpoint_id

string format: uuid

Filter by inbound endpoint ID

Example

01935abc-def0-7123-4567-890abcdef012

start_time

string format: date-time

Filter rejections after this time (ISO 8601)

Example

2025-12-01T00:00:00Z

end_time

string format: date-time

Filter rejections before this time (ISO 8601)

Example

2025-12-06T23:59:59Z

limit

integer

default: 50 >= 1 <= 500

Maximum number of results to return

Example

50

cursor

string

Pagination cursor from previous response

Responses

200

Inbound rejections retrieved successfully

object

data

Array<object>

object

id

Rejection record ID

string

Example

01935abc-def0-7123-4567-890abcdef050

reason_code

Machine-readable reason for rejection

string

Allowed values: endpoint_not_found endpoint_deleted invalid_secret static_token_failed hmac_failed ip_not_allowed payload_too_large invalid_method

Example

hmac_failed

received_at

string format: date-time

Example

2025-12-06T12:00:00Z

inbound_endpoint_id

Inbound endpoint ID (null when reason_code is endpoint_not_found)

string format: uuid

nullable

Example

01935abc-def0-7123-4567-890abcdef012

reason_detail

Additional detail about the rejection

string

Example

HMAC signature mismatch

source_ip

IP address of the sender

string

Example

203.0.113.42

headers_redacted

JSON string of request headers with values masked

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

req_xyz123

next_cursor

Cursor for the next page of results

string

has_more

Whether more results are available

boolean

Example

{
  "data": [
    {
      "id": "01935abc-def0-7123-4567-890abcdef050",
      "reason_code": "hmac_failed",
      "received_at": "2025-12-06T12:00:00Z",
      "inbound_endpoint_id": "01935abc-def0-7123-4567-890abcdef012",
      "reason_detail": "HMAC signature mismatch",
      "source_ip": "203.0.113.42"
    }
  ],
  "meta": {
    "request_id": "req_xyz123",
    "has_more": false
  }
}

400

Invalid request

object

error

object

code

Machine-readable error code

string

Example

INVALID_REQUEST

message

Human-readable error message

string

Example

endpoint must be a valid HTTPS URL

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

req_xyz123

Examples

Endpoint not found

{
  "error": {
    "code": "ENDPOINT_NOT_FOUND",
    "message": "endpoint not found"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid endpoint ID format

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "endpoint_id must be in format ep_xxx"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid payload

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "payload must be valid JSON"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid headers

{
  "error": {
    "code": "INVALID_HEADERS",
    "message": "header 'Host' is forbidden and cannot be overridden"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

401

Unauthorized - Invalid or missing API key

object

error

object

code

Machine-readable error code

string

Example

INVALID_REQUEST

message

Human-readable error message

string

Example

endpoint must be a valid HTTPS URL

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

req_xyz123

Example

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}