CoderHelm Docs
APIWebhook endpoints

Send a test event

POST
/api/webhooks/endpoints/{endpoint_id}/test

Sends one webhook.test event to the endpoint now, signed like every other event, and answers with the attempt. A test is tried once (no retries) and is sent even when the endpoint is off or doesn't subscribe to it.

Authorization

api_key webhooks
headerAuthorizationBearer <token>

A team API key, made by an admin under Settings, API keys. Send it as Authorization: Bearer chk_....

Scope: webhooks

Path Parameters

endpoint_id*string

The endpoint's id.

Response Body

The delivery, delivered or not.

application/json
  1. response

One delivery of an event to an endpoint.

attempts*array<>

Every attempt, oldest first (the last 20).

created_at*string

When the event was first sent to this endpoint.

Example"2026-10-26T14:31:47.780Z"
event*string

The event type.

Example"run.completed"
event_id*string

The event's id: the same webhook-id on every attempt.

Example"evt_01JBEVNT8M1N4P7Q0R3S6T9V2W"
headers*

The request's headers, the signature removed.

Example
{  "webhook-id": "evt_01JBEVNT8M1N4P7Q0R3S6T9V2W",  "webhook-signature": "[redacted]",  "webhook-timestamp": "1792420307"}
id*string

The Deliveries record's id.

Example"01JBDLVR5T8V1W4X7Y0Z3A6B9C"
next_retry_at?|

When the next retry is due, while one is.

Examplenull
outcome*string

What happened, in a few words.

Example"Refused (401)"
payload_preview*string

The body that was sent, with secret-looking values masked, cut at 4 KB.

Example"{\n \"id\": \"evt_01JBEVNT8M1N4P7Q0R3S6T9V2W\" …"
reason*string

A reason code when it failed.

Example"webhook_refused"
reason_fix*string

What to do about it.

Example"Check that the endpoint verifies signatures with the right secret and accepts JSON, then press Resend."
reason_message*string

The reason in plain words.

Example"Your webhook endpoint refused the event (a 4xx answer), so it isn't retried."
status*string

pending (being retried), handled (delivered) or failed.

Example"failed"
curl -X POST 'https://api.coderhelm.com/api/webhooks/endpoints/ep_01jbendpt4a7b0c3d6e9f2g5h8/test' \  -H "Authorization: Bearer $CODERHELM_API_KEY"
{  "attempts": [    {      "at": "2026-10-26T14:31:47.901Z",      "code": 401,      "duration_ms": 112,      "error": "Answered 401: bad signature"    }  ],  "created_at": "2026-10-26T14:31:47.780Z",  "event": "run.completed",  "event_id": "evt_01JBEVNT8M1N4P7Q0R3S6T9V2W",  "headers": {    "webhook-id": "evt_01JBEVNT8M1N4P7Q0R3S6T9V2W",    "webhook-signature": "[redacted]",    "webhook-timestamp": "1792420307"  },  "id": "01JBDLVR5T8V1W4X7Y0Z3A6B9C",  "next_retry_at": null,  "outcome": "Refused (401)",  "payload_preview": "{\n  \"id\": \"evt_01JBEVNT8M1N4P7Q0R3S6T9V2W\" …",  "reason": "webhook_refused",  "reason_fix": "Check that the endpoint verifies signatures with the right secret and accepts JSON, then press Resend.",  "reason_message": "Your webhook endpoint refused the event (a 4xx answer), so it isn't retried.",  "status": "failed"}
Edit on GitHub

Rotate the signing secret POST

Makes a new secret. For `overlap_hours` (24 unless set) every request carries two signatures, one per secret, so a receiver verifying with either keeps working while you update it. Then only the new secret signs.

List event types GET

Every event type CoderHelm sends, with an example event. The `webhooks` section of this document has each one's schema.