Auth webhooks: several endpoints, Send test, an event log and replay
An Auth app can now send its events to up to 10 webhook endpoints, each with its own events and secret, test any of them on the spot, and replay anything from a 30-day event log. Deliveries are signed with Standard Webhooks; the single-webhook routes are deprecated with a sunset on 2027-01-15.
/v1/apps/:appId/webhooks/endpoints manages several endpoints per app, each with its own URL, description, events and signing secret. New endpoints start with the events you pick (an empty list means every event), and GET …/webhooks/event-types describes each event with an example payload.
POST …/webhooks/endpoints/:id/test sends a signed example of any event right away and returns what your receiver answered. GET …/webhooks/events lists the last 30 days of events with the state of each delivery and when the next retry is due, and POST …/webhooks/events/:id/replay sends one again. Failed deliveries are retried after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours and 24 hours; an endpoint that keeps failing is switched off until you turn it back on. Secret rotation now has a grace period during which both secrets sign.
Deliveries carry the Standard Webhooks headers webhook-id, webhook-timestamp and webhook-signature, so any Standard Webhooks library verifies them with your whsec_… secret.
Deprecated: /v1/apps/:appId/webhook and its sub-routes. They keep working on the app's first endpoint, now with Deprecation and Sunset headers, until 2027-01-15. Your existing webhook became that first endpoint with the same URL, events and secret, and keeps receiving the older X-Auth-Signature header until the same date. See the webhooks guide.