Replay stored events
Queues a new delivery to this endpoint for every stored event created between from and to
(inclusive) that matches the endpoint’s current events and filters. Use it after a receiver
outage, or to backfill a newly created endpoint. Each replayed event keeps its original id, so
the webhook-id header matches the original delivery and existing deduplication applies.
Events are retained for 30 days, and only events from the last 30 days can be replayed. A range
containing more than 1000 events is rejected; narrow it or filter by types. Test events
(webhook.test, and the examples sent with POST /api/webhooks/{webhookId}/test) are never
replayed. Events are stored only while the workspace has at least one webhook (active or
disabled), so events from before the first webhook cannot be replayed.
Replayed deliveries are processed by the standard dispatcher (same retries, same headers), are
marked manual: true in the log, and do not affect endpoint health. A disabled endpoint cancels
them; enable it first.
Side effects. Inserts one delivery per matching event; they are sent within seconds.
Idempotency. Not idempotent: calling it twice queues every event twice (with the same
webhook-id, so a deduplicating receiver is unaffected).
Access
- Required scope:
full. Human users need the owner or admin role. - Rate limit: General API (120–600 requests/min per workspace, by plan) plus the configuration-mutations limit — 10 requests/min per workspace, shared with other configuration changes. See Rate limits.
- Plan: Requires an active subscription (
active,trialingorpast_due); without one the request is refused with403 BILLING_ERROR(metadata.kind: subscription_required). See Billing and usage.
Authentication
Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the
dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once,
at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.
Operations restricted to admins or owners reject keys without the full scope with 403, and say so in
their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret —
that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds.
See Authentication.
Path parameters
UUID of the outbound webhook endpoint, returned as id by GET /api/webhooks. It must belong to the authenticated workspace; an id from another workspace, an unknown id or a value that is not a UUID answers 404.
Request
Start of the range, ISO 8601 with a time zone offset or Z. No earlier than 30 days ago.
End of the range, ISO 8601. Must not be before from.
Only replay these event types. Each must be a subscribable type ("*" is not accepted). Omit to replay every type the endpoint receives.
Response
Deliveries queued. count is the number of events that matched the endpoint and were queued (may be 0).

