Skip to main content
Open an endpoint from the Webhooks list and a drawer shows its settings, its current state, and every delivery Nylon has attempted to it.

​
What the drawer tells you

Four tiles at the top:

​
The delivery log

Every delivery, newest first, with the event, the status, the HTTP status your endpoint returned, and how many attempts it has taken. Select a row to see the full payload Nylon sent and the body your endpoint returned. Both filters — status and event — are worth knowing about when you are looking for one delivery among thousands.

​
Retries

A delivery that does not get a 2xx is retried on a fixed schedule: Seven attempts in total, spanning a little over 32 hours. The schedule is coarse on purpose: an endpoint is usually either fine or down for a deploy, and the useful retries are the first few minutes plus a couple of chances much later. Attempts a second apart would be a denial-of-service attack on the thing Nylon is trying to reach. A connection that times out and a 500 are treated identically — from Nylon’s side, the event did not arrive either way.
Nylon retries until it gets a 2xx, so your handler must be idempotent. A delivery your endpoint processed but timed out while acknowledging will arrive again. Key on the event id.

​
Why an endpoint gets disabled

After 20 consecutive failed deliveries, Nylon stops sending to that endpoint and marks it Disabled, with the reason recorded on it. The count is consecutive — a single success resets it to zero — so an endpoint that fails intermittently is never disabled, only one that has been dead for a sustained stretch. A disabled endpoint shows a red banner in its drawer and a Disabled badge in the list. Events are not queued while it is disabled; they are simply not sent. To bring it back: fix the endpoint, then open the ⋯ menu and select Re-enable. That clears the failure count and the reason. Send a test event afterwards to confirm before you rely on it again.
A disabled endpoint refuses test events too, with “This endpoint is disabled. Set status to active before testing it.” Re-enable first, then test.

​
Rotating the signing secret

Open the ⋯ menu and select Rotate secret.
There is no overlap window. The moment you rotate, the previous secret stops working, and every delivery signed with the new one will fail verification on a receiver still holding the old secret. Deploy the new secret as soon as you have it.
Like the original, the new secret is shown once. Rotate when someone with access to it leaves, when it may have been exposed, or on whatever schedule your policy sets.

​
Deleting an endpoint

The ⋯ menu’s Delete removes the endpoint and its entire delivery history. It cannot be undone. If you only want to stop events temporarily, there is no pause — delete and re-add, or point the URL at something that returns 2xx and discards.

A webhook never arrived

Working through it when you expected a delivery and got nothing.

Webhook reference

Headers, payload shapes and verification code.