> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # Get Webhook Destination Delivery > Read one webhook delivery attempt with the exact signature headers and JSON payload Didit sent, plus the status code your endpoint returned. Get Webhook Destination Delivery API Prompt Copy prompt to clipboard \

\`Read one delivery attempt made to a Didit webhook destination through the Management API.

Endpoint:
GET https://verification.didit.me/v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/

Authentication:
Use the x-api-key header with my Didit API key. A scoped API key needs webhooks: read and decisions: read. A key limited to some workflows or to approved sessions cannot use this endpoint.

Goal:
\- See exactly what Didit sent to my endpoint, to debug signature verification or payload handling.

Path parameters:
\- destination_uuid: the destination uuid from GET /v3/webhook/destinations/.
\- delivery_uuid: the uuid of an entry from GET /v3/webhook/destinations/{destination_uuid}/deliveries/.

Behavior:
\- Returns the delivery fields of the list (uuid, session_id, request_url, response_status, response_time_ms, status, webhook_type, created_at) plus request_header and request_body.
\- request_header and request_body are JSON text (strings). Parse them: request_header holds Content-Type, X-Signature, X-Signature-V2, X-Signature-Simple, X-Timestamp and User-Agent; request_body holds the event payload, including event_id.
\- A scoped key without media: read receives media URLs inside request_body as null; without sessions: write it receives session tokens and hosted verification links as null. A body changed that way is re-encoded and no longer matches the signatures.

Example call:
curl -X GET "https://verification.didit.me/v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/" \
-H "x-api-key: YOUR_API_KEY"

Failure modes:
\- 401: { "detail": "This API key has expired." }
\- 403: { "detail": "You do not have permission to perform this action." }, { "detail": "This API key has no read access to webhooks." }, { "detail": "This API key has no read access to decisions." }, or the limited-key message.
\- 404: { "detail": "Webhook destination not found." } or { "detail": "Webhook delivery not found." } (the delivery does not belong to this destination).
\- 429: more than 600 GET requests per minute with this key; wait for Retry-After.

Side effects: none. This is a pure read.

For the full integration shape, see /integration/integration-prompt.`

\
Paste into To check your signature code against a real delivery, recompute `X-Signature-V2` from `request_body` with the destination's `secret_shared_key`, as described in [Signature verification](/integration/webhooks.md#signature-verification). Use a key with full access for this: a body with redacted values no longer matches its signatures.To send the delivery again, call [Resend Webhook Destination Delivery](/management-api/webhook/resend-delivery.md). ## OpenAPI ````yaml GET /v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: Identity verification API. Authenticate with x-api-key header. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/: get: tags: - Webhook summary: Get webhook destination delivery description: >- Retrieve one delivery attempt to a webhook destination with the exact request headers and JSON body Didit sent, the HTTP status your endpoint returned and the response time. `request_header` and `request_body` are JSON text: parse them to read the signature headers and the payload, for example to check your [signature verification](https://docs.didit.me/integration/webhooks#signature-verification) against the destination's `secret_shared_key`. A delivery never contains the signing secret, and Didit does not record your endpoint's response body. A scoped API key needs `webhooks: read` and `decisions: read`; a key limited to some workflows or to approved sessions cannot use this endpoint. operationId: get_webhook_destination_delivery parameters: - name: destination_uuid in: path required: true description: UUID of the destination the delivery was sent to. schema: type: string format: uuid example: 11111111-2222-3333-4444-555555555555 - name: delivery_uuid in: path required: true description: >- UUID of the delivery: the `uuid` of an entry returned by `GET /v3/webhook/destinations/{destination_uuid}/deliveries/`. schema: type: string format: uuid example: 66666666-7777-8888-9999-000000000001 responses: '200': description: The delivery, with its request headers and body. content: application/json: schema: $ref: '#/components/schemas/WebhookDestinationDeliveryDetail' examples: Connection failure: value: uuid: 66666666-7777-8888-9999-000000000001 session_id: 22222222-3333-4444-5555-666666666666 request_url: https://yourapp.com/webhooks/didit response_status: 503 response_time_ms: 412 status: In Progress webhook_type: status.updated created_at: '2026-10-15T09:21:18.412345Z' request_header: >- {"Content-Type": "application/json", "X-Signature": "a5e02a03404e1337a0198e6be15d34abbd053c658a0e51e5d0e78554213ef29b", "X-Signature-V2": "927e7cb770c94ce745939bff73f04aa200015f3bc64795ba46c2aaf78a6cedc5", "X-Signature-Simple": "e37b0d4c716c72bb5ae7127b9cc455d28ab4686e9e22312b4ec2327409a73302", "X-Timestamp": "1792056078", "User-Agent": "DiditWebhook/2.0 +https://didit.me"} request_body: >- {"application_id":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","created_at":1792056057,"environment":"live","event_id":"33333333-4444-5555-6666-777777777777","sandbox_scenario":null,"session_id":"22222222-3333-4444-5555-666666666666","status":"In Progress","timestamp":1792056078,"vendor_data":"user-123","webhook_type":"status.updated","workflow_id":"44444444-5555-6666-7777-888888888888","workflow_version":3} '401': description: >- The API key has expired: it was created with an expiry date that has passed. A missing, invalid or revoked key gets `403`, not `401`. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Expired key: value: detail: This API key has expired. '403': description: >- The request is not allowed. A missing, invalid or revoked `x-api-key` gets `You do not have permission to perform this action.` A scoped key without the access this endpoint needs gets a message naming the missing access, and a key used from outside its IP allowlist gets `This API key can't be used from this IP address.` A key limited to some workflows or to approved sessions gets `This API key only reaches sessions inside its workflow or status limits, so it can't use this endpoint.` content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Missing or invalid key: value: detail: You do not have permission to perform this action. Scoped key without webhooks read: value: detail: This API key has no read access to webhooks. Scoped key without decisions read: value: detail: This API key has no read access to decisions. Key limited to workflows or approved sessions: value: detail: >- This API key only reaches sessions inside its workflow or status limits, so it can't use this endpoint. Outside the IP allowlist: value: detail: This API key can't be used from this IP address. '404': description: >- The destination does not exist for the application or has been deleted, or the delivery does not exist, belongs to another destination, or is no longer available. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Destination not found: value: detail: Webhook destination not found. Delivery not found: value: detail: Webhook delivery not found. '429': description: >- Rate limit exceeded: more than 600 GET requests in the current one-minute window for this API key. Wait `Retry-After` seconds before retrying. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 1 example: 30 X-RateLimit-Limit: description: Requests allowed in the one-minute window (600). schema: type: integer example: 600 X-RateLimit-Remaining: description: Requests left in the current window. schema: type: integer example: 0 X-RateLimit-Reset: description: Unix time (seconds) when the current window resets. schema: type: integer example: 1792056120 X-RateLimit-Scope: description: Name of the budget that was exceeded. schema: type: string example: generic-get content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Throttled: value: detail: >- GET request rate limit exceeded. You can make up to 600 requests per minute. security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: curl source: >- curl -X GET 'https://verification.didit.me/v3/webhook/destinations/11111111-2222-3333-4444-555555555555/deliveries/66666666-7777-8888-9999-000000000001/' \ -H 'x-api-key: YOUR_API_KEY' - lang: python label: Python source: >- import json import os import requests destination_uuid = '11111111-2222-3333-4444-555555555555' delivery_uuid = '66666666-7777-8888-9999-000000000001' resp = requests.get( f'https://verification.didit.me/v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/', headers={'x-api-key': os.environ['DIDIT_API_KEY']}, timeout=10, ) resp.raise_for_status() delivery = resp.json() headers = json.loads(delivery['request_header']) payload = json.loads(delivery['request_body']) print(delivery['response_status'], headers['X-Signature-V2'], payload['event_id']) - lang: javascript label: JavaScript source: >- const destinationUuid = '11111111-2222-3333-4444-555555555555'; const deliveryUuid = '66666666-7777-8888-9999-000000000001'; const resp = await fetch( `https://verification.didit.me/v3/webhook/destinations/${destinationUuid}/deliveries/${deliveryUuid}/`, { headers: { 'x-api-key': process.env.DIDIT_API_KEY } }, ); if (!resp.ok) throw new Error(`Request failed: ${resp.status}`); const delivery = await resp.json(); const headers = JSON.parse(delivery.request_header); const payload = JSON.parse(delivery.request_body); console.log(delivery.response_status, headers['X-Signature-V2'], payload.event_id); components: schemas: WebhookDestinationDeliveryDetail: type: object description: >- One delivery attempt to a webhook destination, with the exact request headers and body Didit sent. required: - uuid - session_id - request_url - response_status - response_time_ms - status - webhook_type - created_at - request_header - request_body properties: uuid: type: string format: uuid description: Delivery ID, for the detail and resend calls. session_id: type: string format: uuid nullable: true description: >- User verification session the event is about. `null` for business session, user, business, transaction, Travel Rule and workflow events. request_url: type: string format: uri nullable: true description: >- URL the delivery was sent to: the destination's URL when the event was generated. response_status: type: integer nullable: true description: >- HTTP status your endpoint returned. `null` while the delivery is queued and not yet attempted. When no HTTP answer was received Didit records a status of its own: `504` when your endpoint did not answer within 5 seconds, `503` for a connection failure, `400` when the URL was refused as unsafe (for example a private or internal address), and `404` for any other request error. `400` or above counts as a failed delivery. response_time_ms: type: integer nullable: true minimum: 0 description: >- Time the attempt took, in milliseconds. `null` while the delivery is queued. status: type: string nullable: true description: >- Status the event reported when it was generated: the session status for session events (for example `Approved` or `In Review`), the person's or company's status for user and business events, and the transaction status for transaction events. `null` for events that carry no status. webhook_type: $ref: '#/components/schemas/WebhookEvent' created_at: type: string format: date-time description: When the delivery was created. request_header: type: string description: >- JSON text (a string) of the request headers Didit sent: `Content-Type`, `X-Signature`, `X-Signature-V2`, `X-Signature-Simple`, `X-Timestamp` and `User-Agent`. Parse it with a JSON parser. It holds signatures, never the signing secret. request_body: type: string description: >- JSON text (a string) of the exact payload Didit sent, keys sorted, including `event_id` and `timestamp`. Parse it with a JSON parser; see [Payload shape](https://docs.didit.me/integration/webhooks#payload-shape). For a scoped key without `media: read`, media URLs inside it are `null`; without `sessions: write`, session tokens and hosted verification links are `null`. A body changed that way no longer matches its signatures. Didit does not record the response body your endpoint returned. WebhookEvent: type: string description: >- Supported webhook event name. Use these exact strings in `subscribed_events`; unsupported values are rejected. enum: - status.updated - data.updated - user.status.updated - user.data.updated - business.status.updated - business.data.updated - activity.created - transaction.created - transaction.status.updated - travel_rule.status.updated - workflow.compliance_changed - auth.signup - auth.login - auth.login_failed - auth.password_reset_requested - auth.password_reset_completed - auth.mfa_changed - auth.new_device - auth.account_locked - investigator.report.ready - investigator.decision.automated - investigator.decision.overridden - investigator.decision.contested - investigator.question.raised - investigator.automation.paused - investigator.rfi.answered - investigator.rfi.overdue - investigator.drift.detected - investigator.sla.breached - investigator.qa.failed - investigator.external.report.ready securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.