Worked request and response samples

Copy a request body as written, substitute your own ids, and compare the response envelope. Errors follow Devotel Orbit’s { error, meta } envelope, shown once below under Error envelope.

Create a webhook endpoint

POST /api/v1/webhooks/

The body needs at least one subscribed event. Subscribe only the events you plan to consume — a broad ["*"] receiver is harder to debug and racy. Request

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/webhooks/" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://receiver.example.dev/webhooks",
  "events": [
    "message.delivered",
    "message.failed"
  ],
  "description": "Project delivery notifications"
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/webhooks/', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "url": "https://receiver.example.dev/webhooks",
  "events": [
    "message.delivered",
    "message.failed"
  ],
  "description": "Project delivery notifications"
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/webhooks/", headers=headers, json={
  "url": "https://receiver.example.dev/webhooks",
  "events": [
    "message.delivered",
    "message.failed"
  ],
  "description": "Project delivery notifications"
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/webhooks/", bytes.NewBuffer([]byte(`{
  "url": "https://receiver.example.dev/webhooks",
  "events": [
    "message.delivered",
    "message.failed"
  ],
  "description": "Project delivery notifications"
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/webhooks/')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "url": "https://receiver.example.dev/webhooks",
  "events": [
    "message.delivered",
    "message.failed"
  ],
  "description": "Project delivery notifications"
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/webhooks/');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "url": "https://receiver.example.dev/webhooks",
  "events": [
    "message.delivered",
    "message.failed"
  ],
  "description": "Project delivery notifications"
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "id": "wh_5f8a1c2d7a4b9e02c3d4e5f6",
    "url": "https://receiver.example.dev/webhooks",
    "events": ["message.delivered", "message.failed"],
    "status": "active"
  },
  "meta": {
    "request_id": "req_webhook",
    "timestamp": "2026-08-01T12:00:00.000Z"
  }
}

List outgoing deliveries for an endpoint

GET /api/v1/webhooks/deliveries

string

Restrict to one webhook endpoint id.

string

e.g. delivered, failed, pending.

Request

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/webhooks/deliveries" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/webhooks/deliveries', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/webhooks/deliveries", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/webhooks/deliveries", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/webhooks/deliveries')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/webhooks/deliveries');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": [
    {
      "id": "del_7c4e2a9b1d3f50618293a4b5",
      "event": "message.delivered",
      "status": "failed",
      "response_code": 502
    }
  ],
  "meta": {
    "request_id": "req_deliveries",
    "timestamp": "2026-08-01T12:01:00.000Z"
  }
}

Replay a delivery

POST /api/v1/webhooks/dlq/{delivery_id}/replay

Redispatches a delivery whose previous attempt failed, without changing subscriptions.

{
  "data": {
    "id": "del_7c4e2a9b1d3f50618293a4b5",
    "status": "replayed"
  },
  "meta": {
    "request_id": "req_replay",
    "timestamp": "2026-08-01T12:02:00.000Z"
  }
}

Verify signatures on receipt

Registering the endpoint is half the work — the receiver must verify the X-Orbit-Signature header before trusting a body. A complete, copy-pasteable verification handler per SDK language (Node, Python, Go, PHP, Ruby, Java, C#) lives at Verify webhook signatures; draft-07 payload schemas come from GET /webhooks/event-schemas on this page.

Error envelope

422

{
  "error": {
    "code": "VALIDATION_ERROR",
    "status": 422,
    "message": "events: subscribe to at least one event"
  },
  "meta": {
    "request_id": "req_...",
    "timestamp": "2026-08-01T12:00:00.000Z"
  }
}

API Reference

All Endpoints

Worked request and response samples