/v4/webhooks/deliveries/{deliveryId}, NOT nested under a webhook id — a delivery id is globally unique and self-sufficient (it's also the value your receiver saw as the webhook-id header), so no endpoint id is needed to look one up directly.Authorization and webhook-signature are never present in attemptLog[].requestHeaders even though they were genuinely sent — replaying a logged request verbatim will not reproduce a valid signature or your bearer token. This is deliberate: the delivery log is readable by anyone with API access to your website, and it must not double as a way to exfiltrate a live credential.attemptLog[]) are purged 7 days after the delivery completes; the delivery's own summary fields (status, attempt count, timestamps) persist for 30 days. A delivery older than 30 days returns 404.curl --location '/v4/webhooks/deliveries/whd_75b14900-1b9d-4cf1-910b-1ee7f014ed60' \
--header 'Authorization: Bearer eyJhbGciOiJFZERTQSIsImtpZCI6Im1haW4ta2V5IiwidHlwIjoiSldUIn0...'{"id": "whd_75b14900-1b9d-4cf1-910b-1ee7f014ed60", "endpointId": "7b5bea64-cd4f-4d97-a4ea-cef565d7c0c3", "topic": "contact.created", "status": "succeeded", "attempts": 1, "nextAttemptAt": null, "createdAt": "2026-08-25T23:41:54.000Z", "completedAt": "2026-08-25T23:41:57.000Z", "attemptLog": [{"attemptNo": 0, "responseStatus": 200, "durationMs": 812, "error": null, "at": "2026-08-25T23:41:57.000Z", "requestHeaders": {"content-type": "application/json", "webhook-id": "whd_75b14900-1b9d-4cf1-910b-1ee7f014ed60", "webhook-timestamp": "1787696517", "webhook-signature": "***", "authorization": "***"}, "responseBody": "{\"ok\":true}"}]}