List inbound rejections

GET

/v1/inbound-rejections

curl --request GET \
  --url 'https://api.hookbridge.io/v1/inbound-rejections?inbound_endpoint_id=01935abc-def0-7123-4567-890abcdef012&start_time=2025-12-01T00%3A00%3A00Z&end_time=2025-12-06T23%3A59%3A59Z&limit=50' \
  --header 'Authorization: Bearer <token>'

• Production

Retrieve a log of rejected inbound webhooks. Rejections occur when incoming requests fail verification (invalid token, HMAC mismatch, IP not allowed, etc.).

Authorizations

• BearerAuth

Parameters

Query Parameters

inbound_endpoint_id

string format: uuid

Filter by inbound endpoint ID

Example

01935abc-def0-7123-4567-890abcdef012

start_time

string format: date-time

Filter rejections after this time (ISO 8601)

Example

2025-12-01T00:00:00Z

end_time

string format: date-time

Filter rejections before this time (ISO 8601)

Example

2025-12-06T23:59:59Z

limit

integer

default: 50 >= 1 <= 500

Maximum number of results to return

Example

50

cursor

string

Pagination cursor from previous response

Responses

200

Inbound rejections retrieved successfully

Media typeapplication/json

object

data

Array<object>

object

id

Rejection record ID

string

reason_code

Machine-readable reason for rejection

string

Allowed values: endpoint_not_found endpoint_deleted invalid_secret static_token_failed hmac_failed ip_not_allowed payload_too_large invalid_method

received_at

string format: date-time

inbound_endpoint_id

Inbound endpoint ID (null when reason_code is endpoint_not_found)

string format: uuid

nullable

reason_detail

Additional detail about the rejection

string

source_ip

IP address of the sender

string

headers_redacted

JSON string of request headers with values masked

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

next_cursor

Cursor for the next page of results

string

has_more

Whether more results are available

boolean

Example

{
  "data": [
    {
      "id": "01935abc-def0-7123-4567-890abcdef050",
      "reason_code": "hmac_failed",
      "received_at": "2025-12-06T12:00:00Z",
      "inbound_endpoint_id": "01935abc-def0-7123-4567-890abcdef012",
      "reason_detail": "HMAC signature mismatch",
      "source_ip": "203.0.113.42"
    }
  ],
  "meta": {
    "request_id": "req_xyz123",
    "has_more": false
  }
}

400

Invalid request

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Examples

Endpoint not found

{
  "error": {
    "code": "ENDPOINT_NOT_FOUND",
    "message": "endpoint not found"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid endpoint ID format

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "endpoint_id must be in format ep_xxx"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid payload

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "payload must be valid JSON"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid headers

{
  "error": {
    "code": "INVALID_HEADERS",
    "message": "header 'Host' is forbidden and cannot be overridden"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

401

Unauthorized - Invalid or missing API key

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}