API reference · Platform / Webhooks

Webhooks

Have events sent to your own URL: resources finishing or failing a change, invoices, payments and credit.

View as Markdown Open in Claude Open in ChatGPT

A webhook is an https URL that Pantech POSTs a signed JSON event to whenever something it subscribes to happens: an operation finishing or failing, an invoice, a payment, credit running low. Subscribe to exact types from GET /webhook-event-types, to one resource with <resource>.*, or to everything with *. The signing secret (whsec_…) is returned only when the webhook is created and when its secret is rotated.

Verify every delivery's Pantech-Signature before trusting it, and deduplicate on the event id: delivery is at least once and unordered. See the webhooks guide, verifying signatures and the event types.

The webhook object

A URL Pantech sends your organization's events to.

Fields

idstringrequired
e.g. whk_....
urlstringrequired
Where events are sent: an https URL on the public internet.
descriptionstringrequired
Your note about it; may be empty.
eventsarray of stringrequired
What it subscribes to: event types, <resource>.*, or *.
enabledbooleanrequired
Whether events are sent to it.
disabled_reasonstring or nullrequired
Why it is disabled: disabled_by_user, or failing after three days of failed deliveries. Null while enabled.
One of disabled_by_user, failing, null.
failing_sincestring or nullrequired
When its deliveries started failing with no success since (RFC 3339, UTC); null while they succeed.
created_atstringrequired
When it was created (RFC 3339, UTC).
updated_atstringrequired
When it last changed (RFC 3339, UTC).

The webhook delivery object

One event sent, or waiting to be sent, to one webhook.

Fields

idstringrequired
e.g. whd_....
webhook_idstringrequired
The webhook it is for.
event_idstringrequired
The event's id, the same in every delivery of it: deduplicate on it.
event_typestringrequired
e.g. instance.created.
statusstringrequired
pending until it succeeds, fails eight times, or is cancelled because the webhook was disabled or deleted.
One of pending, succeeded, failed, canceled.
attemptsintegerrequired
How many times it has been sent.
next_attempt_atstring or nullrequired
When it is next sent, while pending.
last_attempt_atstring or nullrequired
When it was last sent.
last_status_codeinteger or nullrequired
The HTTP status your endpoint last answered; null if it did not answer.
last_errorstring or nullrequired
Why the last attempt failed: http_<status>, timeout, connection_failed, dns_failed, tls_failed, blocked_address (the URL resolved to an address that is not on the public internet), invalid_url, endpoint_disabled or endpoint_deleted.
last_responsestring or nullrequired
The first 1,024 characters of your endpoint's last response body.
last_duration_msinteger or nullrequired
How long the last attempt took, in milliseconds.
delivered_atstring or nullrequired
When it succeeded.
created_atstringrequired
When the event was queued for this webhook.

The webhook event object

The body of every delivery. An infrastructure event's data names the resource and the change: resource_type, resource_id, operation_id, action, status (succeeded or failed) and, on failure, error with the same safe code and message the operations API returns. Read the resource through the API for more. A billing event's data carries its amounts in minor units.

Fields

idstring
The event's id (evt_…). Deduplicate on it.
typestring
e.g. instance.created, invoice.paid, webhook.test.
api_versionstring
The shape of this body, as a date: 2026-10-22.
created_atstring
When it happened (RFC 3339, UTC).
organization_idstring
Your organization.
project_idstring
The project (acc_…) the resource is in.
dataobject
What happened; depends on type.

List webhook event types

Every event type a webhook can subscribe to, with what it means. Subscribe to an exact type, to every type of one resource with <resource>.* (for example instance.*), or to everything with *.

Infrastructure events are named <resource>.<past tense> when a change finished (instance.created, volume.attached) and <resource>.<verb>_failed when it failed (instance.create_failed).

GET/public/v1/webhook-event-types

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Response 200

Event types.

dataarray of WebhookEventTyperequired
Show 3 child fieldsHide child fields
- typestringrequired
  e.g. instance.created.
- resourcestringrequired
  What it is about, for <resource>.* subscriptions.
- descriptionstringrequired
  What it means.
next_cursorstring or nullrequired
Always null: this list is returned whole.

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

curl "https://api.pantechdynamics.com/public/v1/webhook-event-types" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "data": [
    {
      "type": "instance.created",
      "resource": "instance",
      "description": "Instance: create finished."
    }
  ],
  "next_cursor": null
}

List webhooks

Your organization's webhooks: the URLs Pantech sends events to. The signing secret is never part of a webhook; it is shown once, when the webhook is created and when its secret is rotated.

GET/public/v1/webhooks

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Response 200

Webhooks.

dataarray of Webhookrequired
Show 9 child fieldsHide child fields
- idstringrequired
  e.g. whk_....
- urlstringrequired
  Where events are sent: an https URL on the public internet.
- descriptionstringrequired
  Your note about it; may be empty.
- eventsarray of stringrequired
  What it subscribes to: event types, <resource>.*, or *.
- enabledbooleanrequired
  Whether events are sent to it.
- disabled_reasonstring or nullrequired
  Why it is disabled: disabled_by_user, or failing after three days of failed deliveries. Null while enabled.
  One of disabled_by_user, failing, null.
- failing_sincestring or nullrequired
  When its deliveries started failing with no success since (RFC 3339, UTC); null while they succeed.
- created_atstringrequired
  When it was created (RFC 3339, UTC).
- updated_atstringrequired
  When it last changed (RFC 3339, UTC).
next_cursorstring or nullrequired
Always null: this list is returned whole.

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

curl "https://api.pantechdynamics.com/public/v1/webhooks" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "data": [
    {
      "id": "whk_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "url": "https://example.com/hooks/pantech",
      "description": "Production alerts",
      "events": [
        "instance.*",
        "invoice.paid"
      ],
      "enabled": true,
      "disabled_reason": null,
      "failing_since": null,
      "created_at": "2026-10-03T09:30:00Z",
      "updated_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": null
}

Create a webhook

Adds a URL Pantech sends events to. Every delivery is a JSON POST signed with the webhook's secret, which is in this response only: store it now.

Verifying a delivery. Each request carries Pantech-Signature: t=<unix seconds>,v1=<hex>. Compute HMAC-SHA256 of <t>.<raw body> with the secret and compare it, in constant time, with any v1 value; reject a t more than five minutes old. During the 24 hours after a rotation there are two v1 values, one per secret. Pantech-Event-Id, Pantech-Event-Type and Pantech-Delivery-Id name what was sent.

Delivery. Any 2xx within 10 seconds is success. Anything else, including a redirect, is retried after 1 minute, 5 minutes, 30 minutes, 2 hours, 5 hours, 10 hours and 10 hours, then marked failed. A webhook that has failed for three days without a single success is disabled. Events can arrive more than once and out of order: deduplicate on the event id.

At most 10 webhooks per organization. Owners and admins only.

Idempotency: a retry with the same Idempotency-Key returns the webhook the first request made, with secret: null: the secret is never shown again. The same key with a different request returns 409 IDEMPOTENCY_CONFLICT.

POST/public/v1/webhooks

Write keyNeeds Idempotency-KeyReturns201Created

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Body

application/json

urlstringrequired
An https URL on the public internet, at most 2,048 characters, with no user name or password.
descriptionstring
A note for yourself, at most 255 characters.
eventsarray of stringrequired
1 to 100 entries: event types from GET /webhook-event-types, <resource>.*, or *.

Response 201

The webhook, with its secret, or secret: null on a replay.

idstringrequired
e.g. whk_....
urlstringrequired
Where events are sent: an https URL on the public internet.
descriptionstringrequired
Your note about it; may be empty.
eventsarray of stringrequired
What it subscribes to: event types, <resource>.*, or *.
enabledbooleanrequired
Whether events are sent to it.
disabled_reasonstring or nullrequired
Why it is disabled: disabled_by_user, or failing after three days of failed deliveries. Null while enabled.
One of disabled_by_user, failing, null.
failing_sincestring or nullrequired
When its deliveries started failing with no success since (RFC 3339, UTC); null while they succeed.
created_atstringrequired
When it was created (RFC 3339, UTC).
updated_atstringrequired
When it last changed (RFC 3339, UTC).
secretstring or nullrequired
The signing secret (whsec_…). Shown only in this response; null when a create is replayed.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the write scope. Use a key with that scope. FORBIDDEN: the member who created the key is not an owner or admin. Use a key created by one. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server. An owner can turn it on in the console under Organization › AI apps. WEBHOOK_LIMIT_REACHED: your organization already has 10 webhooks. Delete one first.
409IDEMPOTENCY_CONFLICT: this Idempotency-Key was already used for a different webhook. Use a new key.
413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
422VALIDATION_FAILED: a field is invalid. Each entry of errors names the field and its code: url REQUIRED or INVALID_WEBHOOK_URL: send an https URL on the public internet, with no user name or password, of at most 2,048 characters. events INVALID_WEBHOOK_EVENTS: send 1 to 100 entries, each an event type from GET /webhook-event-types, <resource>.*, or *. description INVALID_DESCRIPTION: send at most 255 characters. UNKNOWN_FIELD: the body has a field this endpoint does not take (named in field). Remove it or fix its spelling.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/webhooks" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/hooks/pantech",
    "events": [
      "instance.*",
      "invoice.paid"
    ]
  }'

Response 201

{
  "id": "whk_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "url": "https://example.com/hooks/pantech",
  "description": "Production alerts",
  "events": [
    "instance.*",
    "invoice.paid"
  ],
  "enabled": true,
  "disabled_reason": null,
  "failing_since": null,
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z",
  "secret": "whsec_Jx2Qm9vR4tY7wK1pZ8nB3cF6hL0sD5gA2eU9iO4rT7y"
}

Get a webhook

One webhook. failing_since is when its deliveries started failing without a success since; null while they succeed.

GET/public/v1/webhooks/{webhook_id}

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

webhook_idstringrequired
The webhook's id (whk_…).

Response 200

The webhook.

idstringrequired
e.g. whk_....
urlstringrequired
Where events are sent: an https URL on the public internet.
descriptionstringrequired
Your note about it; may be empty.
eventsarray of stringrequired
What it subscribes to: event types, <resource>.*, or *.
enabledbooleanrequired
Whether events are sent to it.
disabled_reasonstring or nullrequired
Why it is disabled: disabled_by_user, or failing after three days of failed deliveries. Null while enabled.
One of disabled_by_user, failing, null.
failing_sincestring or nullrequired
When its deliveries started failing with no success since (RFC 3339, UTC); null while they succeed.
created_atstringrequired
When it was created (RFC 3339, UTC).
updated_atstringrequired
When it last changed (RFC 3339, UTC).

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404WEBHOOK_NOT_FOUND: no webhook with this id in your organization. List your webhooks to find it. RESOURCE_NOT_FOUND: the id is not a webhook id (whk_…). Check the id.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

webhook_idrequiredThe webhook's id (`whk_…`).

curl "https://api.pantechdynamics.com/public/v1/webhooks/whk_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "id": "whk_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "url": "https://example.com/hooks/pantech",
  "description": "Production alerts",
  "events": [
    "instance.*",
    "invoice.paid"
  ],
  "enabled": true,
  "disabled_reason": null,
  "failing_since": null,
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z"
}

Change a webhook

Changes the URL, description, events or enabled; fields you leave out keep their value. Enabling a disabled webhook clears its failure history. Deliveries still waiting for a disabled webhook are cancelled when they come due.

Idempotency: the same request applied twice leaves the webhook the same.

PATCH/public/v1/webhooks/{webhook_id}

Write keyNeeds Idempotency-KeyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

webhook_idstringrequired
The webhook's id (whk_…).

Body

application/json

urlstring
A new https URL.
descriptionstring
A new note, at most 255 characters.
eventsarray of string
The new subscriptions, replacing the old ones.
enabledboolean
false stops deliveries; true resumes them and clears the failure history.

Response 200

The changed webhook.

idstringrequired
e.g. whk_....
urlstringrequired
Where events are sent: an https URL on the public internet.
descriptionstringrequired
Your note about it; may be empty.
eventsarray of stringrequired
What it subscribes to: event types, <resource>.*, or *.
enabledbooleanrequired
Whether events are sent to it.
disabled_reasonstring or nullrequired
Why it is disabled: disabled_by_user, or failing after three days of failed deliveries. Null while enabled.
One of disabled_by_user, failing, null.
failing_sincestring or nullrequired
When its deliveries started failing with no success since (RFC 3339, UTC); null while they succeed.
created_atstringrequired
When it was created (RFC 3339, UTC).
updated_atstringrequired
When it last changed (RFC 3339, UTC).

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404WEBHOOK_NOT_FOUND: no webhook with this id in your organization. List your webhooks to find it. RESOURCE_NOT_FOUND: the id is not a webhook id (whk_…). Check the id.
409CONFLICT: the webhook was changed at the same time. Get it again and retry.
413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
422VALIDATION_FAILED: a field is invalid. Each entry of errors names the field and its code: url REQUIRED or INVALID_WEBHOOK_URL: send an https URL on the public internet, with no user name or password, of at most 2,048 characters. events INVALID_WEBHOOK_EVENTS: send 1 to 100 entries, each an event type from GET /webhook-event-types, <resource>.*, or *. description INVALID_DESCRIPTION: send at most 255 characters. UNKNOWN_FIELD: the body has a field this endpoint does not take (named in field). Remove it or fix its spelling.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

webhook_idrequiredThe webhook's id (`whk_…`).

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X PATCH "https://api.pantechdynamics.com/public/v1/webhooks/whk_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true
  }'

Response 200

{
  "id": "whk_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "url": "https://example.com/hooks/pantech",
  "description": "Production alerts",
  "events": [
    "instance.*",
    "invoice.paid"
  ],
  "enabled": true,
  "disabled_reason": null,
  "failing_since": null,
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z"
}

Delete a webhook

Deletes a webhook and its delivery history. Nothing more is sent to it.

Idempotency: a retry is not replayed. Once the webhook is deleted, a repeat returns 404; treat that as done.

Scope: write. Destructive: an AI app's key also needs delete.

DELETE/public/v1/webhooks/{webhook_id}

Write keyNeeds Idempotency-KeyReturns204No Content

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

webhook_idstringrequired
The webhook's id (whk_…).

Response 204

Deleted. No body.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404WEBHOOK_NOT_FOUND: no webhook with this id in your organization. List your webhooks to find it. RESOURCE_NOT_FOUND: the id is not a webhook id (whk_…). Check the id.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

webhook_idrequiredThe webhook's id (`whk_…`).

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account and deletes what it names.

curl -X DELETE "https://api.pantechdynamics.com/public/v1/webhooks/whk_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

HTTP/1.1 204 No Content

Send a test event

Queues a webhook.test event to this webhook, whatever it subscribes to, and returns the delivery. It is sent within a few seconds and retried like any other.

Idempotency: a retry is not replayed: each request sends another test event.

POST/public/v1/webhooks/{webhook_id}/test

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

webhook_idstringrequired
The webhook's id (whk_…).

Response 202

The queued delivery.

idstringrequired
e.g. whd_....
webhook_idstringrequired
The webhook it is for.
event_idstringrequired
The event's id, the same in every delivery of it: deduplicate on it.
event_typestringrequired
e.g. instance.created.
statusstringrequired
pending until it succeeds, fails eight times, or is cancelled because the webhook was disabled or deleted.
One of pending, succeeded, failed, canceled.
attemptsintegerrequired
How many times it has been sent.
next_attempt_atstring or nullrequired
When it is next sent, while pending.
last_attempt_atstring or nullrequired
When it was last sent.
last_status_codeinteger or nullrequired
The HTTP status your endpoint last answered; null if it did not answer.
last_errorstring or nullrequired
Why the last attempt failed: http_<status>, timeout, connection_failed, dns_failed, tls_failed, blocked_address (the URL resolved to an address that is not on the public internet), invalid_url, endpoint_disabled or endpoint_deleted.
last_responsestring or nullrequired
The first 1,024 characters of your endpoint's last response body.
last_duration_msinteger or nullrequired
How long the last attempt took, in milliseconds.
delivered_atstring or nullrequired
When it succeeded.
created_atstringrequired
When the event was queued for this webhook.
payloadWebhookEventrequired
The body of every delivery. An infrastructure event's data names the resource and the change: resource_type, resource_id, operation_id, action, status (succeeded or failed) and, on failure, error with the same safe code and message the operations API returns. Read the resource through the API for more. A billing event's data carries its amounts in minor units.
Show 7 child fieldsHide child fields
- idstring
  The event's id (evt_…). Deduplicate on it.
- typestring
  e.g. instance.created, invoice.paid, webhook.test.
- api_versionstring
  The shape of this body, as a date: 2026-10-22.
- created_atstring
  When it happened (RFC 3339, UTC).
- organization_idstring
  Your organization.
- project_idstring
  The project (acc_…) the resource is in.
- dataobject
  What happened; depends on type.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404WEBHOOK_NOT_FOUND: no webhook with this id in your organization. List your webhooks to find it. RESOURCE_NOT_FOUND: the id is not a webhook id (whk_…). Check the id.
409WEBHOOK_DISABLED: the webhook is disabled. Enable it first.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

webhook_idrequiredThe webhook's id (`whk_…`).

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/webhooks/whk_06gk3x9tq7m2v8r4y1c5d0zp8w/test" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 202

{
  "id": "whd_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "webhook_id": "whk_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "event_id": "evt_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "event_type": "webhook.test",
  "status": "pending",
  "attempts": 0,
  "next_attempt_at": "2026-10-03T09:30:00Z",
  "last_attempt_at": null,
  "last_status_code": null,
  "last_error": null,
  "last_response": null,
  "last_duration_ms": null,
  "delivered_at": null,
  "created_at": "2026-10-03T09:30:00Z",
  "payload": {
    "id": "evt_06gk3x9tq7m2v8r4y1c5d0zp8w",
    "type": "webhook.test",
    "api_version": "2026-10-22",
    "created_at": "2026-10-03T09:30:00Z",
    "organization_id": "org_06gk3x9tq7m2v8r4y1c5d0zp8w",
    "project_id": "acc_06gk3x9tq7m2v8r4y1c5d0zp8w",
    "data": {
      "endpoint_id": "whk_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "message": "This is a test event from Pantech."
    }
  }
}

Rotate a webhook's secret

Replaces the signing secret, which is in this response only. For 24 hours every delivery is signed with both the new and the old secret, so you can update your receiver without dropping events.

Idempotency: a retry is not replayed: each request rotates again, and only the latest secret and the one before it sign.

POST/public/v1/webhooks/{webhook_id}/rotate-secret

Write keyNeeds Idempotency-KeyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

webhook_idstringrequired
The webhook's id (whk_…).

Response 200

The webhook with its new secret.

idstringrequired
e.g. whk_....
urlstringrequired
Where events are sent: an https URL on the public internet.
descriptionstringrequired
Your note about it; may be empty.
eventsarray of stringrequired
What it subscribes to: event types, <resource>.*, or *.
enabledbooleanrequired
Whether events are sent to it.
disabled_reasonstring or nullrequired
Why it is disabled: disabled_by_user, or failing after three days of failed deliveries. Null while enabled.
One of disabled_by_user, failing, null.
failing_sincestring or nullrequired
When its deliveries started failing with no success since (RFC 3339, UTC); null while they succeed.
created_atstringrequired
When it was created (RFC 3339, UTC).
updated_atstringrequired
When it last changed (RFC 3339, UTC).
secretstring or nullrequired
The signing secret (whsec_…). Shown only in this response; null when a create is replayed.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404WEBHOOK_NOT_FOUND: no webhook with this id in your organization. List your webhooks to find it. RESOURCE_NOT_FOUND: the id is not a webhook id (whk_…). Check the id.
409CONFLICT: the webhook was changed at the same time. Retry.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

webhook_idrequiredThe webhook's id (`whk_…`).

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/webhooks/whk_06gk3x9tq7m2v8r4y1c5d0zp8w/rotate-secret" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 200

{
  "id": "whk_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "url": "https://example.com/hooks/pantech",
  "description": "Production alerts",
  "events": [
    "instance.*",
    "invoice.paid"
  ],
  "enabled": true,
  "disabled_reason": null,
  "failing_since": null,
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z",
  "secret": "whsec_Jx2Qm9vR4tY7wK1pZ8nB3cF6hL0sD5gA2eU9iO4rT7y"
}

List a webhook's deliveries

Every event sent or waiting to be sent to this webhook, newest first, kept for 30 days: its status, attempts, and how the last attempt went.

GET/public/v1/webhooks/{webhook_id}/deliveries

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

webhook_idstringrequired
The webhook's id (whk_…).

Query parameters

limitinteger
Items per page, 1 to 100. Defaults to 50.
From 1 to 100. Defaults to 50.
cursorstring
The previous page's next_cursor, to get the next page. Leave out for the first page; keep the other parameters the same.

Response 200

Deliveries.

dataarray of WebhookDeliveryrequired
Show 14 child fieldsHide child fields
- idstringrequired
  e.g. whd_....
- webhook_idstringrequired
  The webhook it is for.
- event_idstringrequired
  The event's id, the same in every delivery of it: deduplicate on it.
- event_typestringrequired
  e.g. instance.created.
- statusstringrequired
  pending until it succeeds, fails eight times, or is cancelled because the webhook was disabled or deleted.
  One of pending, succeeded, failed, canceled.
- attemptsintegerrequired
  How many times it has been sent.
- next_attempt_atstring or nullrequired
  When it is next sent, while pending.
- last_attempt_atstring or nullrequired
  When it was last sent.
- last_status_codeinteger or nullrequired
  The HTTP status your endpoint last answered; null if it did not answer.
- last_errorstring or nullrequired
  Why the last attempt failed: http_<status>, timeout, connection_failed, dns_failed, tls_failed, blocked_address (the URL resolved to an address that is not on the public internet), invalid_url, endpoint_disabled or endpoint_deleted.
- last_responsestring or nullrequired
  The first 1,024 characters of your endpoint's last response body.
- last_duration_msinteger or nullrequired
  How long the last attempt took, in milliseconds.
- delivered_atstring or nullrequired
  When it succeeded.
- created_atstringrequired
  When the event was queued for this webhook.
next_cursorstring or nullrequired
Pass as cursor for the next page; null on the last page.

Errors

400INVALID_PAGE: limit is not an integer from 1 to 100. INVALID_CURSOR: the cursor is not valid for this list. Start again without one.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404WEBHOOK_NOT_FOUND: no webhook with this id in your organization. List your webhooks to find it. RESOURCE_NOT_FOUND: the id is not a webhook id (whk_…). Check the id.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

webhook_idrequiredThe webhook's id (`whk_…`).

Query

limitItems per page, 1 to 100. Defaults to 50.

cursorThe previous page's `next_cursor`, to get the next page. Leave out for the first page; keep the other parameters the same.

curl "https://api.pantechdynamics.com/public/v1/webhooks/whk_06gk3x9tq7m2v8r4y1c5d0zp8w/deliveries" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "data": [
    {
      "id": "whd_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "webhook_id": "whk_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "event_id": "evt_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "event_type": "instance.created",
      "status": "succeeded",
      "attempts": 1,
      "next_attempt_at": null,
      "last_attempt_at": "2026-10-03T09:30:00Z",
      "last_status_code": 200,
      "last_error": null,
      "last_response": "ok",
      "last_duration_ms": 184,
      "delivered_at": "2026-10-03T09:30:00Z",
      "created_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": "eyJhdCI6IjIwMjYtMTAtMDNUMDk6MzA6MDBaIiwiaWQiOiJ2bV8wNmdrIn0"
}

Get a delivery

One delivery, with payload: the exact body sent.

GET/public/v1/webhooks/{webhook_id}/deliveries/{delivery_id}

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

webhook_idstringrequired
The webhook's id (whk_…).
delivery_idstringrequired
The delivery's id (whd_…).

Response 200

The delivery.

idstringrequired
e.g. whd_....
webhook_idstringrequired
The webhook it is for.
event_idstringrequired
The event's id, the same in every delivery of it: deduplicate on it.
event_typestringrequired
e.g. instance.created.
statusstringrequired
pending until it succeeds, fails eight times, or is cancelled because the webhook was disabled or deleted.
One of pending, succeeded, failed, canceled.
attemptsintegerrequired
How many times it has been sent.
next_attempt_atstring or nullrequired
When it is next sent, while pending.
last_attempt_atstring or nullrequired
When it was last sent.
last_status_codeinteger or nullrequired
The HTTP status your endpoint last answered; null if it did not answer.
last_errorstring or nullrequired
Why the last attempt failed: http_<status>, timeout, connection_failed, dns_failed, tls_failed, blocked_address (the URL resolved to an address that is not on the public internet), invalid_url, endpoint_disabled or endpoint_deleted.
last_responsestring or nullrequired
The first 1,024 characters of your endpoint's last response body.
last_duration_msinteger or nullrequired
How long the last attempt took, in milliseconds.
delivered_atstring or nullrequired
When it succeeded.
created_atstringrequired
When the event was queued for this webhook.
payloadWebhookEventrequired
The body of every delivery. An infrastructure event's data names the resource and the change: resource_type, resource_id, operation_id, action, status (succeeded or failed) and, on failure, error with the same safe code and message the operations API returns. Read the resource through the API for more. A billing event's data carries its amounts in minor units.
Show 7 child fieldsHide child fields
- idstring
  The event's id (evt_…). Deduplicate on it.
- typestring
  e.g. instance.created, invoice.paid, webhook.test.
- api_versionstring
  The shape of this body, as a date: 2026-10-22.
- created_atstring
  When it happened (RFC 3339, UTC).
- organization_idstring
  Your organization.
- project_idstring
  The project (acc_…) the resource is in.
- dataobject
  What happened; depends on type.

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404WEBHOOK_NOT_FOUND: no webhook with this id in your organization. List your webhooks to find it. WEBHOOK_DELIVERY_NOT_FOUND: no delivery with this id for this webhook. RESOURCE_NOT_FOUND: an id is not a webhook id (whk_…) or delivery id (whd_…). Check the ids.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

webhook_idrequiredThe webhook's id (`whk_…`).

delivery_idrequiredThe delivery's id (`whd_…`).

curl "https://api.pantechdynamics.com/public/v1/webhooks/whk_06gk3x9tq7m2v8r4y1c5d0zp8w/deliveries/whd_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "id": "whd_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "webhook_id": "whk_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "event_id": "evt_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "event_type": "instance.created",
  "status": "succeeded",
  "attempts": 1,
  "next_attempt_at": null,
  "last_attempt_at": "2026-10-03T09:30:00Z",
  "last_status_code": 200,
  "last_error": null,
  "last_response": "ok",
  "last_duration_ms": 184,
  "delivered_at": "2026-10-03T09:30:00Z",
  "created_at": "2026-10-03T09:30:00Z",
  "payload": {
    "id": "evt_06gk3x9tq7m2v8r4y1c5d0zp8w",
    "type": "instance.created",
    "api_version": "2026-10-22",
    "created_at": "2026-10-03T09:30:00Z",
    "organization_id": "org_06gk3x9tq7m2v8r4y1c5d0zp8w",
    "project_id": "acc_06gk3x9tq7m2v8r4y1c5d0zp8w",
    "data": {
      "resource_type": "instance",
      "resource_id": "vm_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "action": "create",
      "status": "succeeded"
    }
  }
}

Send a delivery again

Queues a delivery that succeeded, failed or was cancelled to be sent again from its first attempt, with the same event id.

Idempotency: a retry while it is being sent returns 409 WEBHOOK_DELIVERY_IN_PROGRESS; treat that as done.

POST/public/v1/webhooks/{webhook_id}/deliveries/{delivery_id}/redeliver

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

webhook_idstringrequired
The webhook's id (whk_…).
delivery_idstringrequired
The delivery's id (whd_…).

Response 202

The queued delivery.

idstringrequired
e.g. whd_....
webhook_idstringrequired
The webhook it is for.
event_idstringrequired
The event's id, the same in every delivery of it: deduplicate on it.
event_typestringrequired
e.g. instance.created.
statusstringrequired
pending until it succeeds, fails eight times, or is cancelled because the webhook was disabled or deleted.
One of pending, succeeded, failed, canceled.
attemptsintegerrequired
How many times it has been sent.
next_attempt_atstring or nullrequired
When it is next sent, while pending.
last_attempt_atstring or nullrequired
When it was last sent.
last_status_codeinteger or nullrequired
The HTTP status your endpoint last answered; null if it did not answer.
last_errorstring or nullrequired
Why the last attempt failed: http_<status>, timeout, connection_failed, dns_failed, tls_failed, blocked_address (the URL resolved to an address that is not on the public internet), invalid_url, endpoint_disabled or endpoint_deleted.
last_responsestring or nullrequired
The first 1,024 characters of your endpoint's last response body.
last_duration_msinteger or nullrequired
How long the last attempt took, in milliseconds.
delivered_atstring or nullrequired
When it succeeded.
created_atstringrequired
When the event was queued for this webhook.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404WEBHOOK_NOT_FOUND: no webhook with this id in your organization. List your webhooks to find it. WEBHOOK_DELIVERY_NOT_FOUND: no delivery with this id for this webhook. RESOURCE_NOT_FOUND: an id is not a webhook id (whk_…) or delivery id (whd_…). Check the ids.
409WEBHOOK_DISABLED: the webhook is disabled. Enable it first. WEBHOOK_DELIVERY_IN_PROGRESS: the delivery is still being attempted. Wait for it to finish.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503WEBHOOKS_UNAVAILABLE: webhooks are not available on this deployment yet. Try again later. SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

webhook_idrequiredThe webhook's id (`whk_…`).

delivery_idrequiredThe delivery's id (`whd_…`).

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/webhooks/whk_06gk3x9tq7m2v8r4y1c5d0zp8w/deliveries/whd_06gk3x9tq7m2v8r4y1c5d0zp8w/redeliver" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 202

{
  "id": "whd_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "webhook_id": "whk_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "event_id": "evt_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "event_type": "instance.created",
  "status": "succeeded",
  "attempts": 1,
  "next_attempt_at": null,
  "last_attempt_at": "2026-10-03T09:30:00Z",
  "last_status_code": 200,
  "last_error": null,
  "last_response": "ok",
  "last_duration_ms": 184,
  "delivered_at": "2026-10-03T09:30:00Z",
  "created_at": "2026-10-03T09:30:00Z"
}