Skip to content
aerandil.com
GitHub

Get a webhook subscription

GET
/v1/webhook-subscriptions/{id}
curl --request GET \
  --url https://api.aerandil.com/v1/webhook-subscriptions/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \
  --header 'Authorization: Bearer <token>'

Read the current state of one subscription. Cross-tenant requests return 404 (indistinguishable from “no such id”) to prevent enumeration.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

Subscription id.

Responses

Section titled “Responses”

200

Section titled “200”

Subscription state.

Media typeapplication/json

Subscription state without the signing key. The *_key_fingerprint fields are the first 8 hex chars of sha256(key) — enough to confirm a rotation worked without exposing the secret.

object
consecutive_failures
required

Resets to 0 on the first 2xx after any failure. Transitioning to dead_letter happens at 12 consecutive failures (~3-day retry window).

integer
created_at
required
string format: date-time
filter
required

Filter narrowing what the worker delivers. Empty / absent means “every event in the tenant”.

object
object_types

Narrow to events whose object_type matches one of the listed api_names. For link events, either endpoint type matching counts — a filter of ["hospitality.reservation"] includes reservation_for_guest events.

Array<string>
id
required
string format: uuid
last_delivered_seq
required

Cursor into the event log. Advances to the highest seq read on every successful delivery — filtered-out events are still cursored past so the worker stays bounded under a narrow filter.

integer
next_attempt_at

Earliest moment the worker will retry. Unset when the subscription is caught up; set in the future when an exponential-backoff retry is scheduled.

string format: date-time
primary_key_fingerprint
required

First 8 hex chars of sha256(primary_signing_key) — 16 chars in total. Exposed instead of the secret on every read.

string
/^[0-9a-f]{16}$/
secondary_key_fingerprint

Present during a key-rotation window. Cleared on promote-key.

string
/^[0-9a-f]{16}$/
status
required

Lifecycle of a webhook subscription. dead_letter is sticky — the worker stops attempting further deliveries until the customer PATCHes status back to active (and typically advances last_delivered_seq past the poison batch).

Allowed values: active paused dead_letter
tenant_id
required
string format: uuid
updated_at
required
string format: date-time
url
required

Receiver URL. HTTPS-only (except loopback in dev).

string format: uri
Example
{
  "status": "active"
}

404

Section titled “404”

No subscription with that id for this tenant.

Media typeapplication/json

Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.

object
error
required
object
code
required

Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).

string
instance_id

Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.

string
message
required

Human-readable explanation of the failure.

string
parameters

Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).

Examplegenerated
{
  "error": {
    "code": "example",
    "instance_id": "example",
    "message": "example",
    "parameters": "example"
  }
}