List webhook deliveries

0Gate is the primary public integration path for hosted payment, ramp, and swap experiences. Keep secret-key operations on your server and hand only browser-safe values to the widget.

This is the hub for webhook observability. It also carries the full event catalogue, the signature recipe, and the delivery and retry semantics that the replay and test endpoints refer back to.

Endpoint

Use it for

Read your own outbound webhook delivery log, most-recent first: which events delivered, which are still retrying, and which dead-lettered and why. The log is scoped to your partner — you never see another partner's deliveries.

Use it to diagnose a missed event, to confirm an endpoint outage has cleared, and to find the delivery id you then pass to replay. The payload_raw body is never returned here — the log is about delivery health, not payload inspection.

Request

Query parameters

Response

A list envelope whose data is an array of WebhookDelivery records, most-recent first.

The WebhookDelivery record

Event catalogue

Every delivery carries one event_type. These are the partner-observable events:

Signature and headers

Every webhook POST to your webhook_url carries a signature plus three companion headers:

Verify the signature

The v1 value is an HMAC-SHA256 (hex) computed over the string formed by the timestamp, a literal ., then the raw request body — sign the bytes you received, before any JSON re-serialization. Reject anything older than the 300-second skew tolerance, and compare with a constant-time equality check.

const crypto = require('crypto');

function verify(rawBody, header, secret, skewSeconds = 300) {
  const parts = Object.fromEntries(
    header.split(',').map((p) => p.split('=')),
  );
  const t = parseInt(parts.t, 10);
  if (Math.abs(Date.now() / 1000 - t) > skewSeconds) return false;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${rawBody}`)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(parts.v1, 'hex'),
  );
}

Delivery and retry

• At-least-once. Acknowledge with any 2xx; dedupe on the event id.
• 10-second timeout per attempt. A 408 or 429 from your endpoint is treated as transient and retried.
• Retry schedule: 1m, 5m, 30m, 2h. After 5 attempts with no 2xx, the delivery is dead-lettered.
• A dead-lettered delivery surfaces here with status: dead_lettered and a last_error. Fix your handler, then replay it.

Examples

curl -G https://gate-api.0bit.app/v1/webhooks/deliveries \
  -H "Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  --data-urlencode "status=dead_lettered" \
  --data-urlencode "limit=20"

{
  "object": "list",
  "data": [
    {
      "object": "webhook_delivery",
      "id": "whd_test_67a1f3b9e4b0c10001234567",
      "event_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
      "event_type": "gate_session.completed",
      "target_url": "https://partner.example/webhooks/0bit",
      "status": "succeeded",
      "attempts": 1,
      "last_response_status": 200,
      "last_error": null,
      "next_attempt_at": null,
      "delivered_at": "2026-01-01T00:00:02Z",
      "created_at": "2026-01-01T00:00:01Z",
      "updated_at": "2026-01-01T00:00:02Z"
    }
  ],
  "has_more": false,
  "url": "/v1/webhooks/deliveries"
}

{
  "object": "webhook_delivery",
  "id": "whd_test_67a1f3b9e4b0c10009999999",
  "event_id": "9b2d6c1a-1111-2222-3333-444455556666",
  "event_type": "gate_session.completed",
  "target_url": "https://partner.example/webhooks/0bit",
  "status": "dead_lettered",
  "attempts": 5,
  "last_response_status": 500,
  "last_error": "HTTP 500: (empty body)",
  "next_attempt_at": null,
  "delivered_at": null,
  "created_at": "2026-01-01T00:00:01Z",
  "updated_at": "2026-01-01T02:36:01Z"
}

Errors

All errors use the unified envelope and carry an X-Request-Id response header. Branch on code/type/statusCode, not on the free-form message.

{
  "type": "unauthorized",
  "code": "unauthorized",
  "message": "Example error using fake data.",
  "request_id": "req_test_000000000123",
  "doc_url": null,
  "statusCode": 401
}

Production rules

• Keep secret keys on your server. This endpoint requires an sk_* key.
• Page with limit (≤ 200) and skip; do not assume unbounded list reads.
• Dedupe on the event id; treat delivery as at-least-once.
• Verify Gate-Signature over the raw body, enforce the 300-second skew, and compare in constant time.
• Branch on machine-readable status, error code, object id, and request id.
• Treat examples and placeholder ids as fake data only.

Public boundary

This reference covers partner-scoped endpoint behavior, authentication, idempotency, webhook verification, and support-safe records. Internal operations, administrative routes, settlement venues, and unsupported availability claims are outside the public API contract.

Related pages