> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # 获取 Webhook 投递详情 API > 通过 Didit 查看单次 Webhook 投递尝试，包括 Didit 实际发送的签名请求头和 JSON payload，以及您的端点返回的状态码。 获取 Webhook 目标投递 API 提示词 将提示词复制到剪贴板 \

\`Read one delivery attempt made to a Didit webhook destination through the Management API.

Endpoint:
GET https://verification.didit.me/v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/

Authentication:
Use the x-api-key header with my Didit API key. A scoped API key needs webhooks: read and decisions: read. A key limited to some workflows or to approved sessions cannot use this endpoint.

Goal:
\- See exactly what Didit sent to my endpoint, to debug signature verification or payload handling.

Path parameters:
\- destination_uuid: the destination uuid from GET /v3/webhook/destinations/.
\- delivery_uuid: the uuid of an entry from GET /v3/webhook/destinations/{destination_uuid}/deliveries/.

Behavior:
\- Returns the delivery fields of the list (uuid, session_id, request_url, response_status, response_time_ms, status, webhook_type, created_at) plus request_header and request_body.
\- request_header and request_body are JSON text (strings). Parse them: request_header holds Content-Type, X-Signature, X-Signature-V2, X-Signature-Simple, X-Timestamp and User-Agent; request_body holds the event payload, including event_id.
\- A scoped key without media: read receives media URLs inside request_body as null; without sessions: write it receives session tokens and hosted verification links as null. A body changed that way is re-encoded and no longer matches the signatures.

Example call:
curl -X GET "https://verification.didit.me/v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/" \
-H "x-api-key: YOUR_API_KEY"

Failure modes:
\- 401: { "detail": "This API key has expired." }
\- 403: { "detail": "You do not have permission to perform this action." }, { "detail": "This API key has no read access to webhooks." }, { "detail": "This API key has no read access to decisions." }, or the limited-key message.
\- 404: { "detail": "Webhook destination not found." } or { "detail": "Webhook delivery not found." } (the delivery does not belong to this destination).
\- 429: more than 600 GET requests per minute with this key; wait for Retry-After.

Side effects: none. This is a pure read.

For the full integration shape, see /integration/integration-prompt.`

\
粘贴到 要用真实投递检查您的签名代码，请使用 Webhook 目标的 `secret_shared_key`，从 `request_body` 重新计算 `X-Signature-V2`，具体方法见[签名验证](https://docs.didit.me/zh/integration/webhooks.md#签名验证)。为此请使用具有完整权限的密钥：包含脱敏值的请求体将无法与其签名匹配。要再次发送此投递，请调用[重新发送 Webhook 目标投递](https://docs.didit.me/zh/management-api/webhook/resend-delivery.md)。 ## OpenAPI ````yaml zh/openapi-25.json GET /v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: 身份证件验证 API。使用 x-api-key 请求头进行身份验证。 servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/: get: tags: - Webhook summary: 获取 Webhook 目标投递记录 description: >- 获取向 Webhook 目标发起的一次投递尝试，包括 Didit 发送的准确请求头和 JSON 请求体、您的 endpoint 返回的 HTTP 状态以及响应时间。`request_header` 和 `request_body` 为 JSON 文本：解析它们以读取签名请求头和 payload，例如对照目标的 `secret_shared_key` 检查您的[签名验证](https://docs.didit.me/zh/integration/webhooks#签名验证)。投递记录中绝不会包含签名密钥，且 Didit 不会记录您 endpoint 的响应体。作用域受限的 API 密钥需要 `webhooks: read` 和 `decisions: read` 权限；仅限于某些工作流或仅限于已通过会话的密钥无法使用此 endpoint。 operationId: get_webhook_destination_delivery parameters: - name: destination_uuid in: path required: true description: 投递发送至的 Webhook 目标的 UUID。 schema: type: string format: uuid example: 11111111-2222-3333-4444-555555555555 - name: delivery_uuid in: path required: true description: >- 投递的 UUID：由 `GET /v3/webhook/destinations/{destination_uuid}/deliveries/` 返回的条目的 `uuid`。 schema: type: string format: uuid example: 66666666-7777-8888-9999-000000000001 responses: '200': description: 投递，包含其请求头和请求体。 content: application/json: schema: $ref: '#/components/schemas/WebhookDestinationDeliveryDetail' examples: Connection failure: value: uuid: 66666666-7777-8888-9999-000000000001 session_id: 22222222-3333-4444-5555-666666666666 request_url: https://yourapp.com/webhooks/didit response_status: 503 response_time_ms: 412 status: In Progress webhook_type: status.updated created_at: '2026-10-15T09:21:18.412345Z' request_header: >- {"Content-Type": "application/json", "X-Signature": "a5e02a03404e1337a0198e6be15d34abbd053c658a0e51e5d0e78554213ef29b", "X-Signature-V2": "927e7cb770c94ce745939bff73f04aa200015f3bc64795ba46c2aaf78a6cedc5", "X-Signature-Simple": "e37b0d4c716c72bb5ae7127b9cc455d28ab4686e9e22312b4ec2327409a73302", "X-Timestamp": "1792056078", "User-Agent": "DiditWebhook/2.0 +https://didit.me"} request_body: >- {"application_id":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee","created_at":1792056057,"environment":"live","event_id":"33333333-4444-5555-6666-777777777777","sandbox_scenario":null,"session_id":"22222222-3333-4444-5555-666666666666","status":"In Progress","timestamp":1792056078,"vendor_data":"user-123","webhook_type":"status.updated","workflow_id":"44444444-5555-6666-7777-888888888888","workflow_version":3} '401': description: API 密钥已过期：它在创建时设置的到期日期已过。错误或已撤销的密钥也会收到 `401`；缺失密钥则收到 `403`。 content: application/json: schema: type: object properties: detail: type: string description: 便于人类阅读的错误消息。 examples: Expired key: value: detail: This API key has expired. '403': description: >- 该请求不被允许。缺失、无效或已撤销的 `x-api-key` 会收到 `You do not have permission to perform this action.`。缺少此 endpoint 所需访问权限的限定作用域密钥会收到指明所缺权限的消息，而在其 IP 白名单之外使用的密钥会收到 `This API key can't be used from this IP address.`。仅限于某些工作流或已通过的会话的密钥会收到 `This API key only reaches sessions inside its workflow or status limits, so it can't use this endpoint.`。 content: application/json: schema: type: object properties: detail: type: string description: 便于人类阅读的错误消息。 examples: Missing or invalid key: value: detail: You do not have permission to perform this action. Scoped key without webhooks read: value: detail: This API key has no read access to webhooks. Scoped key without decisions read: value: detail: This API key has no read access to decisions. Key limited to workflows or approved sessions: value: detail: >- This API key only reaches sessions inside its workflow or status limits, so it can't use this endpoint. Outside the IP allowlist: value: detail: This API key can't be used from this IP address. '404': description: 该目标在应用中不存在或已被删除，或者投递不存在、属于其他目标或不再可用。 content: application/json: schema: type: object properties: detail: type: string description: 便于人类阅读的错误消息。 examples: Destination not found: value: detail: Webhook destination not found. Delivery not found: value: detail: Webhook delivery not found. '429': description: 超出速率限制：当前一分钟窗口内该 API 密钥的 GET 请求超过 600 次。请等待 `Retry-After` 秒后再重试。 headers: Retry-After: description: 重试前需要等待的秒数。 schema: type: integer minimum: 1 example: 30 X-RateLimit-Limit: description: 一分钟时间窗口内允许的请求数（600）。 schema: type: integer example: 600 X-RateLimit-Remaining: description: 当前时间窗口内剩余的请求数。 schema: type: integer example: 0 X-RateLimit-Reset: description: 当前窗口重置的 Unix 时间（秒）。 schema: type: integer example: 1792056120 X-RateLimit-Scope: description: 发生超支的预算名称。 schema: type: string example: generic-get content: application/json: schema: type: object properties: detail: type: string description: 便于人类阅读的错误消息。 examples: Throttled: value: detail: >- GET request rate limit exceeded. You can make up to 600 requests per minute. security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: curl source: >- curl -X GET 'https://verification.didit.me/v3/webhook/destinations/11111111-2222-3333-4444-555555555555/deliveries/66666666-7777-8888-9999-000000000001/' \ -H 'x-api-key: YOUR_API_KEY' - lang: python label: Python source: |- from didit import Didit # Reads DIDIT_API_KEY. client = Didit() result = client.webhooks.destinations.retrieve_delivery( "11111111-2222-3333-4444-555555555555", "66666666-7777-8888-9999-000000000001", ) print(result) - lang: javascript label: Node.js source: |- import Didit from "@didit-protocol/sdk-node"; // Reads DIDIT_API_KEY. const didit = new Didit(); const result = await didit.webhooks.destinations.retrieveDelivery( "11111111-2222-3333-4444-555555555555", "66666666-7777-8888-9999-000000000001", ); console.log(result); - lang: go label: Go source: "ctx := context.Background()\n// Reads DIDIT_API_KEY.\nclient := didit.NewClient()\n\nresult, err := client.Webhooks.Destinations.RetrieveDelivery(ctx, \"11111111-2222-3333-4444-555555555555\", \"66666666-7777-8888-9999-000000000001\")\nif err != nil {\n\tlog.Fatal(err)\n}\nfmt.Printf(\"%+v\\n\", result)" - lang: java label: Java source: >- import me.didit.Didit; // Reads DIDIT_API_KEY. Didit client = new Didit(); var result = client.webhooks().destinations().retrieveDelivery("11111111-2222-3333-4444-555555555555", "66666666-7777-8888-9999-000000000001"); System.out.println(result); - lang: php label: PHP source: >- webhooks->destinations->retrieveDelivery('11111111-2222-3333-4444-555555555555', '66666666-7777-8888-9999-000000000001'); print_r($result->toArray()); - lang: ruby label: Ruby source: |- require "didit" # Reads DIDIT_API_KEY. didit = Didit::Client.new result = didit.webhooks.destinations.retrieve_delivery( "11111111-2222-3333-4444-555555555555", "66666666-7777-8888-9999-000000000001" ) puts result.to_h - lang: csharp label: .NET source: >- using System; using System.Text.Json; using Didit; // Reads DIDIT_API_KEY. using var client = new DiditClient(); var result = await client.Webhooks.Destinations.RetrieveDeliveryAsync("11111111-2222-3333-4444-555555555555", "66666666-7777-8888-9999-000000000001"); Console.WriteLine(JsonSerializer.Serialize(result)); components: schemas: WebhookDestinationDeliveryDetail: type: object description: 向 Webhook 目标发送的一次投递尝试，包含 Didit 发送的确切请求头和请求体。 required: - uuid - session_id - request_url - response_status - response_time_ms - status - webhook_type - created_at - request_header - request_body properties: uuid: type: string format: uuid description: 投递 ID，用于获取详情和重新发送调用。 session_id: type: string format: uuid nullable: true description: 该事件涉及的用户验证会话。对于企业会话、用户、企业、交易、Travel Rule 和工作流事件为 `null`。 request_url: type: string format: uri nullable: true description: 投递发送的目标 URL：生成事件时目标的 URL。 response_status: type: integer nullable: true description: >- 您的 endpoint 返回的 HTTP 状态码。在投递已排队且尚未尝试时为 `null`。未收到 HTTP 响应时，Didit 会记录自身的状态码：您的 endpoint 未在 5 秒内响应记录为 `504`，连接失败记录为 `503`，因 URL 不安全而被拒绝（例如私有或内部地址）记录为 `400`，其他任何请求错误记录为 `404`。`400` 或更高视为投递失败。 response_time_ms: type: integer nullable: true minimum: 0 description: 尝试所花费的时间，以毫秒为单位。投递处于队列中时为 `null`。 status: type: string nullable: true description: >- 事件生成时报告的状态：会话事件对应会话状态（例如 `Approved` 或 `In Review`），用户和企业事件对应个人或公司的状态，交易事件对应交易状态。对于不携带状态的事件为 `null`。 webhook_type: $ref: '#/components/schemas/WebhookEvent' created_at: type: string format: date-time description: 投递创建的时间。 request_header: type: string description: >- Didit 发送的请求头的 JSON 文本（字符串）：`Content-Type`、`X-Signature`、`X-Signature-V2`、`X-Signature-Simple`、`X-Timestamp` 和 `User-Agent`。请使用 JSON 解析器进行解析。其中包含签名，绝不会包含签名密钥。 request_body: type: string description: >- Didit 发送的准确 payload 的 JSON 文本（字符串），键已排序，包括 `event_id` 和 `timestamp`。请使用 JSON 解析器进行解析；参见 [Payload 结构](https://docs.didit.me/zh/integration/webhooks#payload-结构)。对于没有 `media: read` 权限的作用域密钥，其中的媒体 URL 为 `null`；没有 `sessions: write` 权限时，会话 token 和托管验证链接为 `null`。以此方式修改的请求体将不再与其签名匹配。Didit 不会记录您的 endpoint 返回的响应体。 WebhookEvent: type: string description: 支持的 Webhook 事件名称。请在 `subscribed_events` 中使用这些完全匹配的字符串；不支持的值将被拒绝。 enum: - status.updated - data.updated - user.status.updated - user.data.updated - business.status.updated - business.data.updated - activity.created - transaction.created - transaction.status.updated - travel_rule.status.updated - workflow.compliance_changed - transaction_rule_suggestions.created - auth.signup - auth.login - auth.login_failed - auth.password_reset_requested - auth.password_reset_completed - auth.mfa_changed - auth.new_device - auth.account_locked - investigator.report.ready - investigator.decision.automated - investigator.decision.overridden - investigator.decision.contested - investigator.question.raised - investigator.automation.paused - investigator.rfi.answered - investigator.rfi.overdue - investigator.drift.detected - investigator.sla.breached - investigator.qa.failed - investigator.external.report.ready securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- 您的应用 API 密钥，可在 Business Console 的“开发者 -> API 密钥”中获取。主密钥拥有完整访问权限。指定名称的密钥可设置作用域：针对每个资源设为无权限、只读或读写，限定于特定工作流或已通过的会话、限定于 IP 地址列表，以及设置到期日期。401 表示密钥错误、已撤销或已过期；403 表示未发送密钥、密钥无权访问该资源或操作，或请求来自其 IP 列表之外的地址；在会话路由上返回 404 表示该会话不在该密钥允许的工作流或状态范围内。没有媒体访问权限的密钥获取到的图片、视频和 PDF URL 将为 null；没有会话写入权限的密钥获取到的会话链接和 token 将为 null。请参阅 https://docs.didit.me/console/api-keys。 ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.