Authentication
These routes are for the app owner’s merchant session, never anapp_ token:
List deliveries
url is the target without its query string or fragment. error is a short transport message, never
a response body. next is null when the page was not full.
Replay one delivery
resourceId and shop. It gets a new event id, so it is a new delivery rather than a
byte-for-byte copy; a dedupe check keyed on the original id will not suppress it. The replay goes
to the installation’s current URL and is signed with the current secret for that environment, with
one attempt and no retries.
You can replay up to 30 deliveries an hour per app. Over the limit returns 429. POST /api/v1/apps/developer/:id/webhook-deliveries/:deliveryId/resend is an accepted older name for the
same operation.
Send a test event
app/test event to one active installation. It carries test: true, the
installation id as resourceId and no store record, so it can never leak real data.
topicis optional and must beapp/testif present. Any other topic returns400.installationIdis optional. Without it the most recent active installation is used.- The app must have a webhook URL and at least one active installation, or the call returns
400. - One attempt, no retries. Up to 10 test events an hour per app; over the limit returns
429.
Retention
Rows are removed after 14 days by a TTL index.retentionDays in the list response repeats that
number. The developer analytics webhook totals read the same rows,
so they cover at most the last 14 days.
Next steps
Webhooks
Topics, signatures and retry rules.
Developer analytics
The totals that sit on top of this log.

