> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # Resend Session Webhook Delivery > Send a recorded session webhook again to the same URL, with fresh signatures, and get the new delivery with your endpoint's answer. Resend Session Webhook Delivery API Prompt Copy prompt to clipboard \

\`Resend a webhook delivery of a Didit verification session through the API.

Endpoint:
POST https://verification.didit.me/v3/session/{session_id}/webhook/{webhook_uuid}/resend
(no trailing slash, no request body)

Authentication:
Send my Didit API key in the x-api-key header. A scoped key needs webhooks: write and decisions: read.

Goal:
\- Replay a webhook my endpoint missed or rejected, after I fixed the endpoint.

Behavior:
\- {webhook_uuid} is the uuid of an entry from GET /v3/session/{session_id}/webhooks/, and it must belong to the session in the path.
\- Didit sends the recorded payload again to the URL the delivery was first sent to. The payload keeps its event_id; Didit refreshes the timestamp field, the X-Timestamp header and the signatures, using the destination's current signing secret (the application-level secret for a delivery sent to the legacy webhook_url).
\- Synchronous: Didit waits up to 5 seconds for my endpoint, records the attempt as a new delivery and returns it. The original delivery is not changed.
\- The call returns 200 even when my endpoint answered with an error: read response_status in the returned delivery.
\- A failed resend is not retried automatically. Every call sends one more request to my endpoint, so my handler must be idempotent on event_id.

Example call:
curl -X POST "https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/webhook/9f8e7d6c-5b4a-4321-8fed-cba987654321/resend" \
-H "x-api-key: YOUR_API_KEY"

What to read from the response:
\- uuid: the new delivery id.
\- response_status: what my endpoint answered this time (504 timeout, 503 connection failure, 400 URL refused as unsafe).
\- request_header and request_body: the headers and body actually sent.

Failure modes:
\- 400 with code webhook_url_missing: the delivery has no recorded URL.
\- 400 with code webhook_resend_error: the recorded payload could not be re-signed or sent.
\- 401: the API key has expired.
\- 403: missing or invalid key, a key of another application, a scoped key without the permissions above, or a request from outside the key's IP allowlist.
\- 404: the session does not exist, was deleted, or is outside a scoped key's limits, or the delivery does not belong to this session ({ "detail": "Webhook log not found" }).
\- 429: more than 300 writes per minute for this API key; honor Retry-After.

Side effects: sends one HTTP request to my webhook endpoint and adds one delivery to the session's webhook log.

For the full integration shape, see /integration/integration-prompt.`

\
Paste into > [!NOTE] > > The resend goes to the URL stored on the delivery, even if you changed the destination's URL since. Because the payload keeps its `event_id`, a receiver that [deduplicates on `event_id`](/integration/webhooks#envelope) treats the resend as the event it already knows.Find the delivery to resend with [List session webhook deliveries](/management-api/sessions/list-webhooks.md). ## OpenAPI ````yaml POST /v3/session/{sessionId}/webhook/{webhook_uuid}/resend openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: Identity verification API. Authenticate with x-api-key header. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/session/{sessionId}/webhook/{webhook_uuid}/resend: post: tags: - Sessions summary: Resend session webhook delivery description: >- Send a recorded session webhook again to the URL it first went to, with the same payload and `event_id` and a fresh `timestamp`, `X-Timestamp` header and signatures. Didit signs it with the current secret of the destination the delivery belongs to (or the application-level secret for a delivery to the legacy webhook URL), waits up to 5 seconds for your endpoint, records the attempt as a new delivery and returns it with `200` whatever your endpoint answered: read `response_status`. A resend is not retried automatically, and every call sends again, so make your endpoint idempotent on `event_id`. The path has no trailing slash and the request has no body. A scoped API key needs `webhooks: write` and `decisions: read`. operationId: post_v3_session_webhook_resend parameters: - name: sessionId in: path required: true description: >- UUID of the verification session, user (KYC) or business (KYB): the `session_id` returned by `POST /v3/session/`. The server resolves it against both session types. **Must be a valid UUID.** The route only matches well-formed UUIDs, so a malformed value is rejected by the URL router before any application code runs and the response is a `404` **HTML** page rather than the JSON `{"detail": ...}` envelope shown below. schema: type: string format: uuid example: 22222222-3333-4444-5555-666666666666 - name: webhook_uuid in: path required: true description: >- UUID of the delivery to resend: the `uuid` of an entry returned by `GET /v3/session/{sessionId}/webhooks/`. It must belong to the session in the path. schema: type: string format: uuid example: 66666666-7777-8888-9999-000000000001 responses: '200': description: >- The new delivery, already attempted. `response_status` is what your endpoint answered this time. The original delivery is unchanged. content: application/json: schema: $ref: '#/components/schemas/SessionWebhookDelivery' examples: Accepted on resend: value: uuid: 66666666-7777-8888-9999-000000000004 session_id: 22222222-3333-4444-5555-666666666666 request_url: https://yourapp.com/webhooks/didit response_status: 200 status: In Progress webhook_type: status.updated request_header: >- {"Content-Type": "application/json", "X-Signature": "b8eb1e376517ee0cad8ba98ff7f8fd35fc72eca231000963a96a335f82328835", "X-Signature-V2": "9efd2ce9ed1303e1d05273ef9608a59363ed9789a05253db4748b3e8e50cb109", "X-Signature-Simple": "bf3a9dc04b2c20ab539203b0cd5cca2a10f630bf62d8feb6d68d82af80f64774", "X-Timestamp": "1792159542", "User-Agent": "DiditWebhook/2.0 +https://didit.me"} request_body: >- {"application_id":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","created_at":1792056057,"environment":"live","event_id":"33333333-4444-5555-6666-777777777777","sandbox_scenario":null,"session_id":"22222222-3333-4444-5555-666666666666","status":"In Progress","timestamp":1792159542,"vendor_data":"user-123","webhook_type":"status.updated","workflow_id":"44444444-5555-6666-7777-888888888888","workflow_version":3} created_at: '2026-10-16T14:05:42.330981Z' '400': description: >- The delivery could not be resent. Branch on `code`: `webhook_url_missing` means the delivery has no recorded URL and nothing is sent; `webhook_resend_error` means the stored delivery could not be signed again or the attempt could not be completed. After `webhook_resend_error`, `detail` starts with `Error processing webhook resend:` followed by a diagnostic text that can change. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. code: type: string description: >- Stable machine-readable error code. Branch on this, not on `detail`. examples: No recorded URL: value: detail: >- The webhook delivery does not have a request URL configured code: webhook_url_missing Resend failed: value: detail: >- Error processing webhook resend: Invalid webhook data format code: webhook_resend_error '401': description: >- The API key has expired: it was created with an expiry date that has passed. A missing, invalid or revoked key gets `403`, not `401`. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Expired key: value: detail: This API key has expired. '403': description: >- The request is not allowed. No `x-api-key`, or an invalid or revoked key, gets `Authentication credentials were not provided or are invalid.` A key of another application gets `You do not have permission to perform this action.` A scoped key without the access this endpoint needs gets a message naming the missing access, and a key used from outside its IP allowlist gets `This API key can't be used from this IP address.` An unknown `sessionId` returns `404` before the credential is checked. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Missing or invalid key: value: detail: >- Authentication credentials were not provided or are invalid. Key of another application: value: detail: You do not have permission to perform this action. Scoped key without webhooks write: value: detail: This API key has no write access to webhooks. Scoped key without decisions read: value: detail: This API key has no read access to decisions. Outside the IP allowlist: value: detail: This API key can't be used from this IP address. '404': description: >- The session does not exist or has been deleted (`Not found.`, returned before the credential is checked), or it is outside the workflow or status limits of a scoped key (`Session not found.`). A delivery that does not exist, belongs to another session or is no longer available returns `Webhook log not found`. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Unknown session: value: detail: Not found. Outside the key's limits: value: detail: Session not found. Delivery not in this session: value: detail: Webhook log not found '429': description: >- Rate limit exceeded: more than 300 write requests (POST, PATCH, PUT, DELETE) in the current one-minute window for this API key. Wait `Retry-After` seconds before retrying. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 1 example: 30 X-RateLimit-Limit: description: Requests allowed in the one-minute window (300). schema: type: integer example: 300 X-RateLimit-Remaining: description: Requests left in the current window. schema: type: integer example: 0 X-RateLimit-Reset: description: Unix time (seconds) when the current window resets. schema: type: integer example: 1792056120 X-RateLimit-Scope: description: Name of the budget that was exceeded. schema: type: string example: generic-write content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Throttled: value: detail: >- Write request rate limit exceeded. You can make up to 300 requests per minute. security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: curl source: >- curl -X POST 'https://verification.didit.me/v3/session/22222222-3333-4444-5555-666666666666/webhook/66666666-7777-8888-9999-000000000001/resend' \ -H 'x-api-key: YOUR_API_KEY' - lang: python label: Python source: |- import os import requests session_id = '22222222-3333-4444-5555-666666666666' webhook_uuid = '66666666-7777-8888-9999-000000000001' resp = requests.post( f'https://verification.didit.me/v3/session/{session_id}/webhook/{webhook_uuid}/resend', # no trailing slash headers={'x-api-key': os.environ['DIDIT_API_KEY']}, timeout=10, ) resp.raise_for_status() resent = resp.json() print(resent['uuid'], resent['response_status']) - lang: javascript label: JavaScript source: >- const sessionId = '22222222-3333-4444-5555-666666666666'; const webhookUuid = '66666666-7777-8888-9999-000000000001'; // No trailing slash on this path. const resp = await fetch(`https://verification.didit.me/v3/session/${sessionId}/webhook/${webhookUuid}/resend`, { method: 'POST', headers: { 'x-api-key': process.env.DIDIT_API_KEY }, }); if (!resp.ok) throw new Error(await resp.text()); const resent = await resp.json(); console.log(resent.uuid, resent.response_status); components: schemas: SessionWebhookDelivery: type: object description: >- One webhook delivery attempt recorded for a verification session, with the exact request headers and body Didit sent. required: - uuid - session_id - request_url - response_status - status - webhook_type - request_header - request_body - created_at properties: uuid: type: string format: uuid description: >- Delivery ID. Use it as `{webhook_uuid}` to get or resend this delivery. session_id: type: string format: uuid description: The session the delivery belongs to (the session in the path). request_url: type: string format: uri nullable: true description: URL the delivery was sent to. response_status: type: integer nullable: true description: >- HTTP status your endpoint returned. `null` while the delivery is queued and not yet attempted. When no HTTP answer was received Didit records a status of its own: `504` when your endpoint did not answer within 5 seconds, `503` for a connection failure, `400` when the URL was refused as unsafe (for example a private or internal address), and `404` for any other request error. `400` or above counts as a failed delivery. status: type: string nullable: true description: >- Session status when the event was generated, for example `In Progress`, `Approved` or `Declined`. webhook_type: $ref: '#/components/schemas/WebhookEvent' request_header: type: string description: >- JSON text (a string) of the request headers Didit sent: `Content-Type`, `X-Signature`, `X-Signature-V2`, `X-Signature-Simple`, `X-Timestamp` and `User-Agent`. Parse it with a JSON parser. It holds signatures, never the signing secret. request_body: type: string description: >- JSON text (a string) of the exact payload Didit sent, keys sorted, including `event_id` and `timestamp`. Parse it with a JSON parser; see [Payload shape](https://docs.didit.me/integration/webhooks#payload-shape). For a scoped key without `media: read`, media URLs inside it are `null`; without `sessions: write`, session tokens and hosted verification links are `null`. A body changed that way no longer matches its signatures. Didit does not record the response body your endpoint returned. created_at: type: string format: date-time description: When the delivery was created. WebhookEvent: type: string description: >- Supported webhook event name. Use these exact strings in `subscribed_events`; unsupported values are rejected. enum: - status.updated - data.updated - user.status.updated - user.data.updated - business.status.updated - business.data.updated - activity.created - transaction.created - transaction.status.updated - travel_rule.status.updated - workflow.compliance_changed - auth.signup - auth.login - auth.login_failed - auth.password_reset_requested - auth.password_reset_completed - auth.mfa_changed - auth.new_device - auth.account_locked - investigator.report.ready - investigator.decision.automated - investigator.decision.overridden - investigator.decision.contested - investigator.question.raised - investigator.automation.paused - investigator.rfi.answered - investigator.rfi.overdue - investigator.drift.detected - investigator.sla.breached - investigator.qa.failed - investigator.external.report.ready securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.