Skip to main content

Authentication

These routes are for the app owner’s merchant session, never an app_ token:
Every call checks that the app belongs to the signed-in developer. The log holds no request or response bodies, no headers, no signatures and no secrets. Each row is one attempt: the first try, each retry, each replay and each test.

List deliveries

url is the target without its query string or fragment. error is a short transport message, never a response body. next is null when the page was not full.

Replay one delivery

The log holds no body, so a replay rebuilds the notify-only envelope from the stored topic, resource, resourceId and shop. It gets a new event id, so it is a new delivery rather than a byte-for-byte copy; a dedupe check keyed on the original id will not suppress it. The replay goes to the installation’s current URL and is signed with the current secret for that environment, with one attempt and no retries. You can replay up to 30 deliveries an hour per app. Over the limit returns 429. POST /api/v1/apps/developer/:id/webhook-deliveries/:deliveryId/resend is an accepted older name for the same operation.

Send a test event

Sends one synthetic app/test event to one active installation. It carries test: true, the installation id as resourceId and no store record, so it can never leak real data.
  • topic is optional and must be app/test if present. Any other topic returns 400.
  • installationId is optional. Without it the most recent active installation is used.
  • The app must have a webhook URL and at least one active installation, or the call returns 400.
  • One attempt, no retries. Up to 10 test events an hour per app; over the limit returns 429.

Retention

Rows are removed after 14 days by a TTL index. retentionDays in the list response repeats that number. The developer analytics webhook totals read the same rows, so they cover at most the last 14 days.

Next steps

Webhooks

Topics, signatures and retry rules.

Developer analytics

The totals that sit on top of this log.