curl --request POST \
--url https://api.citadel.example/api/v1/webhook_endpoints/{id}/test \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.citadel.example/api/v1/webhook_endpoints/{id}/test', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.citadel.example/api/v1/webhook_endpoints/{id}/test"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.citadel.example/api/v1/webhook_endpoints/{id}/test"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "0199a3d0-0000-7000-8000-000000000002",
"type": "test.ping",
"resource": {
"type": "webhook_endpoint",
"id": "0199a2f0-1b00-7a11-8c22-3d4e5f6a7b8c"
},
"data": {},
"endpoint": {
"id": "0199a2f0-1b00-7a11-8c22-3d4e5f6a7b8c",
"url": "https://merchant.example/hooks/citadel"
},
"status": "pending",
"attempts": 0,
"next_attempt_at": "2026-10-09T08:00:00Z",
"delivered_at": null,
"last_response_code": null,
"last_error": null,
"created_at": "2026-10-09T08:00:00Z"
}Send a test delivery
Posts a test.ping to the endpoint now: a real delivery, signed and retried like any other,
with an empty data. The answer is that delivery; follow it in GET /webhook_deliveries
(?endpoint=<id>&type=test.ping).
An endpoint that is not active (paused, or disabled by Citadel) answers
409 endpoint_disabled: resume it first. Needs the webhooks.write scope. A key limited
to vaults is refused with 403 vault_limited.
curl --request POST \
--url https://api.citadel.example/api/v1/webhook_endpoints/{id}/test \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.citadel.example/api/v1/webhook_endpoints/{id}/test', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.citadel.example/api/v1/webhook_endpoints/{id}/test"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.citadel.example/api/v1/webhook_endpoints/{id}/test"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "0199a3d0-0000-7000-8000-000000000002",
"type": "test.ping",
"resource": {
"type": "webhook_endpoint",
"id": "0199a2f0-1b00-7a11-8c22-3d4e5f6a7b8c"
},
"data": {},
"endpoint": {
"id": "0199a2f0-1b00-7a11-8c22-3d4e5f6a7b8c",
"url": "https://merchant.example/hooks/citadel"
},
"status": "pending",
"attempts": 0,
"next_attempt_at": "2026-10-09T08:00:00Z",
"delivered_at": null,
"last_response_code": null,
"last_error": null,
"created_at": "2026-10-09T08:00:00Z"
}Authorizations
An API key minted in the console (ctd_…). Authenticates; never authorizes funds. A key
carries scopes (read, wallets.write, transactions.write, events.write,
webhooks.write, policy.write) and may be limited to vaults, to IP addresses, and in
lifetime — see Authentication.
Path Parameters
The endpoint id — id in its row, endpoint.id in a delivery.
Response
The test delivery, queued.
The delivery id — id in the webhook body and X-Citadel-Delivery. Stable across retries.
The event type.
What the event is about, as in the webhook body.
Show child attributes
Show child attributes
The event's data, as the endpoint receives it.
Show child attributes
Show child attributes
pending while attempts remain; delivered once the endpoint answered 2xx; failed
when every attempt failed, or the endpoint was disabled with the delivery in flight.
pending, delivered, failed Attempts made since the delivery was recorded, or since its last retry.
When the next attempt goes out; null unless pending.
The endpoint's HTTP status on the last attempt; null when it did not answer or nothing was tried yet.
Why the last attempt failed. Human-readable; not stable.
When Citadel recorded the event for this endpoint. from and to filter on it.