> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # List delivery attempts > Every POST the endpoint received, newest first: the `event_id` and `event_type`, which `attempt` it was, whether it was a `replay`, `delivered` or `failed`, the `response_code`, the `failure` reason and `latency_ms`. Attempts are kept for 30 days, or your `retention_days` when that is shorter, and are deleted with the assessment they carried. Pass `next_cursor` back unchanged as `cursor` to read the next page; a changed, foreign or expired cursor answers 400 `invalid_cursor`. Read-only and safe to retry. Requires the `webhooks` scope. ## OpenAPI ````yaml /openapi.json get /v1/webhooks/{endpoint_id}/deliveries openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses a signup, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys your signup gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: Rotate your own API key. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS or Auth0 sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. paths: /v1/webhooks/{endpoint_id}/deliveries: get: tags: - webhooks summary: List delivery attempts description: >- Every POST the endpoint received, newest first: the `event_id` and `event_type`, which `attempt` it was, whether it was a `replay`, `delivered` or `failed`, the `response_code`, the `failure` reason and `latency_ms`. Attempts are kept for 30 days, or your `retention_days` when that is shorter, and are deleted with the assessment they carried. Pass `next_cursor` back unchanged as `cursor` to read the next page; a changed, foreign or expired cursor answers 400 `invalid_cursor`. Read-only and safe to retry. Requires the `webhooks` scope. operationId: listWebhookDeliveries parameters: - $ref: '#/components/parameters/EndpointId' - name: limit in: query required: false description: Attempts per page. schema: type: integer minimum: 1 maximum: 100 default: 20 - name: cursor in: query required: false description: next_cursor from the previous page, unchanged. schema: type: string minLength: 1 maxLength: 256 pattern: ^[A-Za-z0-9_-]+$ not: pattern: \n responses: '200': $ref: '#/components/responses/WebhookDeliveryList' '400': $ref: '#/components/responses/InvalidWebhookDeliveriesRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/WorkspaceForbidden' '404': $ref: '#/components/responses/WebhookEndpointNotFound' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request GET \ --url 'https://api.noresponse.org/v1/webhooks/whe_01JA2ZD0E1F2G3H4J5K6M7N8P9/deliveries?limit=20' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.webhookEndpoints.listDeliveries({ endpointId: "whe_01JA2ZD0E1F2G3H4J5K6M7N8P9", }); for await (const page of result) { console.log(page); } } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.webhook_endpoints.list_deliveries(endpoint_id="whe_01JA2ZD0E1F2G3H4J5K6M7N8P9", limit=20) while res is not None: # Handle items res = res.next() - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v5\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.WebhookEndpoints.ListDeliveries(ctx, \"whe_01JA2ZD0E1F2G3H4J5K6M7N8P9\", noresponse.Pointer[int64](20), nil)\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n for {\n // handle items\n\n res, err = res.Next()\n\n if err != nil {\n // handle error\n }\n\n if res == nil {\n break\n }\n }\n }\n}\n" - lang: java label: Java source: > package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.ListWebhookDeliveriesResponse; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); sdk.webhookEndpoints().listDeliveries() .endpointId("whe_01JA2ZD0E1F2G3H4J5K6M7N8P9") .limit(20L) .callAsStream() .forEach((ListWebhookDeliveriesResponse item) -> { // handle page }); } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Operations; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); ListWebhookDeliveriesResponse? res = await sdk.WebhookEndpoints.ListDeliveriesAsync( endpointId: "whe_01JA2ZD0E1F2G3H4J5K6M7N8P9", limit: 20 ); while(res != null) { // handle items res = await res.Next!(); } - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $responses = $sdk->webhookEndpoints->listDeliveries( endpointId: 'whe_01JA2ZD0E1F2G3H4J5K6M7N8P9', limit: 20 ); foreach ($responses as $response) { if ($response->statusCode === 200) { // handle response } } - lang: ruby label: Ruby source: > require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) res = s.webhook_endpoints.list_deliveries(endpoint_id: 'whe_01JA2ZD0E1F2G3H4J5K6M7N8P9', limit: 20) unless res.nil? # handle response end components: parameters: EndpointId: name: endpoint_id in: path required: true schema: type: string pattern: ^whe_[0-9A-HJKMNP-TV-Z]{26}$ not: description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n description: Opaque id of the endpoint registration. description: >- The endpoint's whe_ id. An id that is unknown, malformed or another workspace's answers 404. responses: WebhookDeliveryList: description: One page of the endpoint's delivery attempts, newest first. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/WebhookDeliveryList' examples: attempts: value: endpoint_id: whe_01JA2ZD0E1F2G3H4J5K6M7N8P9 items: - event_id: evt_01JA2ZD3K4M5N6P7Q8R9S0T1V2 event_type: assessment.updated attempt: 1 replay: true status: delivered response_code: 200 latency_ms: 184 attempted_at: '2026-10-22T10:15:02.118Z' - event_id: evt_01JA2ZD3K4M5N6P7Q8R9S0T1V2 event_type: assessment.updated attempt: 2 replay: false status: failed response_code: 500 failure: non_2xx latency_ms: 96 attempted_at: '2026-10-22T09:00:31.402Z' - event_id: evt_01JA2ZD3K4M5N6P7Q8R9S0T1V2 event_type: assessment.updated attempt: 1 replay: false status: failed failure: timeout latency_ms: 5000 attempted_at: '2026-10-22T09:00:00.951Z' next_cursor: AQAAAABpG1CXAAYqJ2gK4cQAx1dJ2Hk3Q6CjhYbJ9xU8Pz0qRkL1n3VbW2c InvalidWebhookDeliveriesRequest: description: >- A query parameter is unknown, repeated or out of range (invalid_request), or the cursor is empty, fails its MAC, belongs to another workspace or endpoint, or has expired (invalid_cursor). invalid_params names the offending parameters without their values. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request - invalid_cursor Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized WorkspaceForbidden: description: >- The API key is valid but may not use this operation: it lacks the operation's scope, or its workspace is not entitled or is suspended. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden examples: missingScope: value: type: https://docs.noresponse.org/problems/workspace-forbidden title: Forbidden status: 403 detail: The API key does not carry a scope this operation accepts. code: workspace_forbidden request_id: 0123456789abcdef0123456789abcdef WebhookEndpointNotFound: description: >- No endpoint with this id for the calling workspace, including a malformed id and another workspace's endpoint. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found RateLimited: description: >- The workspace's rate or concurrency limit is exhausted. Retry-After says when to retry; the provider applies its own fallback meanwhile. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - rate_limited examples: limited: value: type: https://docs.noresponse.org/problems/rate-limited title: Rate limited status: 429 detail: >- The tenant's assessment rate is exhausted; retry after the Retry-After interval. code: rate_limited request_id: 0123456789abcdef0123456789abcdef ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable schemas: WebhookDeliveryList: title: Webhook delivery attempts description: >- The 200 answer of GET /v1/webhooks/{endpoint_id}/deliveries: one page of the endpoint's delivery attempts, newest first. Each item is one POST to the endpoint. Attempts are kept for 30 days, or the workspace's retention_days when that is shorter, and are deleted with the assessment they carried. next_cursor is present only when another page exists. type: object additionalProperties: false required: - endpoint_id - items properties: endpoint_id: type: string pattern: ^whe_[0-9A-HJKMNP-TV-Z]{26}$ not: description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n description: Opaque id of the endpoint registration. items: type: array maxItems: 100 items: type: object additionalProperties: false required: - event_id - event_type - attempt - replay - status - latency_ms - attempted_at properties: event_id: type: string pattern: ^evt_[0-9A-HJKMNP-TV-Z]{26}$ description: >- The event id the receiver saw as NR-Webhook-Id and as the body's id. Replay it with POST /v1/webhooks/{endpoint_id}/deliveries/{event_id}/replay. not: description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n event_type: type: string pattern: ^[a-z]+(\.[a-z_]+)+$ description: >- The event's type, as its body's type: assessment.updated, account.deleted or account.risk_changed. attempt: type: integer minimum: 1 maximum: 9 description: >- Which attempt of this delivery this was: 1 for the first send, up to 9 with retries. A replay counts its own attempts from 1. replay: type: boolean description: true for an attempt of a replay you asked for. status: enum: - delivered - failed description: >- delivered when the endpoint answered 2xx; failed otherwise, with failure naming why. response_code: type: integer minimum: 100 maximum: 599 description: >- The HTTP status the endpoint answered. Absent when no response was read. failure: enum: - invalid_url - resolve_failed - address_refused - timeout - connection_failed - redirect - non_2xx description: >- Why the attempt failed: the URL is no longer valid, the host did not resolve, it resolved to an address that is not public, no answer within 5 seconds, the connection failed, a 3xx (redirects are not followed) or another non-2xx status. Absent for a delivered attempt. latency_ms: type: integer minimum: 0 description: >- Milliseconds from sending the request to the answer or the failure. attempted_at: type: string format: date-time description: >- When the request was sent. Its NR-Webhook-Timestamp is this time in Unix seconds. if: properties: status: const: delivered required: - status then: required: - response_code not: required: - failure else: required: - failure next_cursor: type: string minLength: 1 maxLength: 256 pattern: ^[A-Za-z0-9_-]+$ description: >- Opaque cursor for the next page, MAC'd by the server and bound to the workspace and endpoint it was issued for. Pass it back unchanged as cursor; a tampered, foreign or expired cursor answers 400 invalid_cursor. not: description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n $defs: webhook_delivery_attempt: type: object additionalProperties: false required: - event_id - event_type - attempt - replay - status - latency_ms - attempted_at properties: event_id: type: string pattern: ^evt_[0-9A-HJKMNP-TV-Z]{26}$ description: >- The event id the receiver saw as NR-Webhook-Id and as the body's id. Replay it with POST /v1/webhooks/{endpoint_id}/deliveries/{event_id}/replay. not: description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n event_type: type: string pattern: ^[a-z]+(\.[a-z_]+)+$ description: >- The event's type, as its body's type: assessment.updated, account.deleted or account.risk_changed. attempt: type: integer minimum: 1 maximum: 9 description: >- Which attempt of this delivery this was: 1 for the first send, up to 9 with retries. A replay counts its own attempts from 1. replay: type: boolean description: true for an attempt of a replay you asked for. status: enum: - delivered - failed description: >- delivered when the endpoint answered 2xx; failed otherwise, with failure naming why. response_code: type: integer minimum: 100 maximum: 599 description: >- The HTTP status the endpoint answered. Absent when no response was read. failure: enum: - invalid_url - resolve_failed - address_refused - timeout - connection_failed - redirect - non_2xx description: >- Why the attempt failed: the URL is no longer valid, the host did not resolve, it resolved to an address that is not public, no answer within 5 seconds, the connection failed, a 3xx (redirects are not followed) or another non-2xx status. Absent for a delivered attempt. latency_ms: type: integer minimum: 0 description: >- Milliseconds from sending the request to the answer or the failure. attempted_at: type: string format: date-time description: >- When the request was sent. Its NR-Webhook-Timestamp is this time in Unix seconds. if: properties: status: const: delivered required: - status then: required: - response_code not: required: - failure else: required: - failure Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. A key sees only its own environment's data. Each key has one or more scopes: `assess` creates and reads assessments, records outcomes and reports key usage; `history` reads assessments, an account's current risk and an account's history, and erases an account; `detailed` adds the detailed view; `webhooks` registers, tests, rotates and deletes webhook endpoints; `integrations` registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.