{ "auth": { "bearer": [ { "key": "token", "type": "string", "value": "{{accessToken}}" } ], "type": "bearer" }, "info": { "name": "EDFlow API", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "version": "1.0.0" }, "item": [ { "item": [ { "name": "OAuth authorization server metadata", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ ".well-known", "oauth-authorization-server" ], "raw": "{{baseUrl}}/.well-known/oauth-authorization-server" }, "description": "RFC 8414 authorization server metadata. Lists every client authentication method this deployment supports." } }, { "name": "Token signing keys", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "oauth", "jwks.json" ], "raw": "{{baseUrl}}/oauth/jwks.json" }, "description": "Public keys of the access-token signing keys (ES256). Two keys are published during a rotation." } }, { "name": "Revoke an access token", "request": { "header": [], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "oauth", "revoke" ], "raw": "{{baseUrl}}/oauth/revoke" }, "description": "RFC 7009. Always answers 200, even for unknown tokens. The next request with a revoked token gets `401 token_revoked`." } }, { "name": "Get an access token", "request": { "header": [], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "oauth", "token" ], "raw": "{{baseUrl}}/oauth/token" }, "description": "Issues a short-lived (≤ 300 s) ES256 access token (RFC 9068). Cache it and refresh 30 s before `expires_in`. Errors use RFC 6749 bodies; failed client authentication is rate-limited per (client id, source address)." } } ], "name": "OAuth" }, { "item": [ { "name": "Signed ingest: events", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "ehr", "v1", "events" ], "raw": "{{baseUrl}}/ehr/v1/events" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"events\": []\n}" }, "description": "Normalized events signed with the source key (`EDFlow-Source`, `EDFlow-Timestamp`, `EDFlow-Delivery-Id`, `EDFlow-Signature`). An exact replay of a processed delivery returns the stored 200 result." } }, { "name": "Signed ingest: FHIR", "request": { "header": [], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "ehr", "v1", "fhir" ], "raw": "{{baseUrl}}/ehr/v1/fhir" }, "description": "A FHIR R4 Bundle signed with the source key; `EDFlow-Site-Code` names the site." } }, { "name": "Signed ingest: health", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "ehr", "v1", "health" ], "raw": "{{baseUrl}}/ehr/v1/health" }, "description": "Unauthenticated health of the signed ingest: `status`, `time` and `specVersions`." } }, { "name": "Signed ingest: HL7 v2", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "ehr", "v1", "hl7v2" ], "raw": "{{baseUrl}}/ehr/v1/hl7v2" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"messages\": []\n}" }, "description": "JSON-wrapped HL7 v2 messages (≤ 50) signed with the source key; ACKs follow the ACK table." } }, { "name": "Signed ingest: validate", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "ehr", "v1", "validate" ], "raw": "{{baseUrl}}/ehr/v1/validate" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"events\": []\n}" }, "description": "Dry run of any of the three inputs (`EDFlow-Input`); persists nothing." } } ], "name": "Signed ingest" }, { "item": [ { "name": "List code alerts", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "codes" ], "raw": "{{baseUrl}}/v1/codes" }, "description": "Department code alerts (default: active). `area` is omitted when the site turns `integration.api.includeCodeArea` off." } } ], "name": "Codes" }, { "item": [ { "name": "Get a visit document", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "documents", ":documentId" ], "raw": "{{baseUrl}}/v1/documents/:documentId" }, "description": "Fetch a visit document by id (Phase 3). Requires `documents:read` and a token obtained with `private_key_jwt` or mTLS; documents are available for 72 hours." } } ], "name": "Documents" }, { "item": [ { "name": "List encounters", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "encounters" ], "raw": "{{baseUrl}}/v1/encounters" }, "description": "Encounters ordered by `(updatedAt, id)`. `updatedSince` gives incremental sync; items updated in the last 10 seconds are held back (settle window)." } }, { "name": "Look up an encounter by visit number", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "encounters", "lookup" ], "raw": "{{baseUrl}}/v1/encounters/lookup" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"externalId\": \"SYN3000123456\",\n \"idSystem\": \"epic-csn\",\n \"site\": \"kb-main-ed\"\n}" }, "description": "Resolves an EHR visit number to an encounter without EDFlow storing the number. A miss is `200` with `found: false`. Rate-limited (`lookup`) and audited without the identifier." } }, { "name": "Get an encounter", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "encounters", ":encounterId" ], "raw": "{{baseUrl}}/v1/encounters/:encounterId" }, "description": "One encounter. `404` for unknown ids, other sites and archived encounters." } }, { "name": "Get an encounter's care team", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "encounters", ":encounterId", "care-team" ], "raw": "{{baseUrl}}/v1/encounters/:encounterId/care-team" }, "description": "The current care team. Zone-derived nurses are computed at read time (`id: null`, `source: zone`). Staff hidden from patients are listed with `hiddenFromPatients: true`." } } ], "name": "Encounters" }, { "item": [ { "name": "List ingest events", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "events" ], "raw": "{{baseUrl}}/v1/events" }, "description": "The ingest ledger of the app's source (30 days), ordered by `(updatedAt, id)`. Metadata only, never payloads." } }, { "name": "Ingest one event", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "events" ], "raw": "{{baseUrl}}/v1/events" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"data\": {\n \"queueDepth\": 0\n },\n \"id\": \"kb-engine:hb:1789387331\",\n \"occurredAt\": \"2026-09-14T08:02:11-04:00\",\n \"source\": {\n \"feed\": \"adt\",\n \"kind\": \"ehr\",\n \"system\": \"epic\"\n },\n \"specVersion\": \"1.0\",\n \"type\": \"system.heartbeat\"\n}" }, "description": "One normalized event (≤ 32 KiB). `accepted`, `duplicate`, `ignored` and `superseded` answer 200; `buffered` and `quarantined` answer 202; a data rejection is `422 event_rejected`; a reused id with another payload is `409 idempotency_conflict`; a processing error is `503` (retry the same event)." } }, { "name": "Ingest a batch of events", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "events", "batch" ], "raw": "{{baseUrl}}/v1/events/batch" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"events\": []\n}" }, "description": "1 to 100 normalized events, applied in array order, each atomically and independently. The 200 body is byte-compatible with `/ehr/v1/events`, so an engine can switch transports without changing response handling. A per-event `processing_error` is `retryable`: resend that event (same id)." } }, { "name": "Dry-run any input", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "events", "validate" ], "raw": "{{baseUrl}}/v1/events/validate" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"events\": [\n {\n \"data\": {\n \"queueDepth\": 0\n },\n \"id\": \"kb-engine:hb:1789387331\",\n \"occurredAt\": \"2026-09-14T08:02:11-04:00\",\n \"source\": {\n \"feed\": \"adt\",\n \"kind\": \"ehr\",\n \"system\": \"epic\"\n },\n \"specVersion\": \"1.0\",\n \"type\": \"system.heartbeat\"\n }\n ]\n}" }, "description": "Dry run for any input: nothing is persisted, notified or ledgered. The input kind comes from `Content-Type` (`application/json` events, `application/fhir+json`, `application/hl7-v2`, or JSON `{ messages }` with `?input=hl7v2`). The environment checks (processing id, sandbox tripwire) apply." } }, { "name": "Get an ingest event", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "events", ":eventId" ], "raw": "{{baseUrl}}/v1/events/:eventId" }, "description": "One ledger row of the app's source by the source event id (URL-encoded). Metadata only." } } ], "name": "Ingest" }, { "item": [ { "name": "Ingest a FHIR batch Bundle", "request": { "header": [], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "fhir" ], "raw": "{{baseUrl}}/v1/fhir" }, "description": "A FHIR R4 `batch` Bundle only (each entry processed independently). A `transaction` Bundle is refused with `422 transaction_not_supported`; other Bundle types go to `$ingest`. `Accept: application/fhir+json` answers a `batch-response` Bundle." } }, { "name": "Ingest another Bundle type ($ingest)", "request": { "header": [], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "fhir", "$ingest" ], "raw": "{{baseUrl}}/v1/fhir/$ingest" }, "description": "`$ingest`: Bundle types FHIR does not allow at the base (`collection`, `searchset`, `history`), including Subscriptions Backport notifications. Handshakes and heartbeats produce no events." } }, { "name": "Process a FHIR message", "request": { "header": [], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "fhir", "$process-message" ], "raw": "{{baseUrl}}/v1/fhir/$process-message" }, "description": "`$process-message`: a `message` Bundle whose first entry is a `MessageHeader`. Synchronous; duplicates (`Bundle.id` + `MessageHeader.id`, 30 days) replay the stored response. Data rejections answer 200 with `fatal-error`; transient failures answer 503 with `Retry-After`." } }, { "name": "SMART configuration", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "fhir", ".well-known", "smart-configuration" ], "raw": "{{baseUrl}}/v1/fhir/.well-known/smart-configuration" }, "description": "SMART Backend Services configuration: asymmetric client authentication (`private_key_jwt`) for token requests to the push endpoints only." } }, { "name": "$ingest OperationDefinition", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "fhir", "OperationDefinition", "ingest" ], "raw": "{{baseUrl}}/v1/fhir/OperationDefinition/ingest" }, "description": "The OperationDefinition of `$ingest` (canonical `https://edflow.space/fhir/OperationDefinition/ingest`)." } }, { "name": "FHIR CapabilityStatement", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "fhir", "metadata" ], "raw": "{{baseUrl}}/v1/fhir/metadata" }, "description": "FHIR R4 CapabilityStatement (`kind: instance`). Declares only `batch`, `$process-message` and `$ingest`; there is no FHIR read API." } } ], "name": "FHIR" }, { "item": [ { "name": "Health", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "health" ], "raw": "{{baseUrl}}/v1/health" }, "description": "Public liveness. Compare `time` with your own clock. `down` answers HTTP 503." } }, { "name": "Identity and configuration", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "meta" ], "raw": "{{baseUrl}}/v1/meta" }, "description": "Who the caller is and how the platform is configured for it: app, organization, sites, scopes, pinned version, credential, limits and webhook egress addresses." } }, { "name": "OpenAPI document", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "openapi.json" ], "raw": "{{baseUrl}}/v1/openapi.json" }, "description": "The OpenAPI 3.1 document of this deployment, generated from the operation registry. Identical to the published document except `servers`." } } ], "name": "Metadata" }, { "item": [ { "name": "Ingest HL7 v2", "request": { "header": [], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "hl7v2" ], "raw": "{{baseUrl}}/v1/hl7v2" }, "description": "Raw mode (`application/hl7-v2`, `x-application/hl7-v2+er7` or `text/plain`, optional `charset` that must agree with MSH-18): one ER7 message, answered with an ACK per the ACK table. JSON mode (`application/json`): `{ messages }` (≤ 50). Transient failures are `503`/`429` with `Retry-After` and no ACK. Site: `?site=`, else resolved from MSH-4 through the mapping profile. Engines must never hold their queue on a EDFlow ACK." } } ], "name": "HL7 v2" }, { "item": [ { "name": "List requests", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "requests" ], "raw": "{{baseUrl}}/v1/requests" }, "description": "The requests feed, ordered by `(updatedAt, id)`, with the 10-second settle window. Only requests past the patient's undo window appear." } }, { "name": "Get a request", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "requests", ":requestId" ], "raw": "{{baseUrl}}/v1/requests/:requestId" }, "description": "One request." } }, { "name": "Acknowledge a request from the EMR", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "requests", ":requestId", "acknowledge" ], "raw": "{{baseUrl}}/v1/requests/:requestId/acknowledge" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"by\": {\n \"practitioner\": {\n \"display\": \"Sam Rivera\",\n \"externalId\": \"SYN-N4455\",\n \"idSystem\": \"epic-ser\"\n }\n }\n}" }, "description": "Marks an open request as seen when a clinician handles it in the EMR. The patient sees the same result as a console acknowledgement: \"Seen by {name}\" for a linked practitioner, otherwise the generic care-team copy. Already acknowledged answers 200 with the current state; resolved or cancelled answers `409 conflict`. Requires the site's request write-back switch." } }, { "name": "Resolve a request from the EMR", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "requests", ":requestId", "resolve" ], "raw": "{{baseUrl}}/v1/requests/:requestId/resolve" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"outcome\": \"done\"\n}" }, "description": "Resolves a request from the EMR (acknowledging it first when open). Already resolved answers 200 with the current state; cancelled answers `409 conflict`." } } ], "name": "Requests" }, { "item": [ { "name": "Start a conformance run", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sandbox", "conformance" ], "raw": "{{baseUrl}}/v1/sandbox/conformance" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"profile\": \"ingest\"\n}" }, "description": "Starts a go-live conformance run: `ingest`, `webhooks`, `writeback`, `outage_recovery` (turns on a 30-minute `unavailable` fault), `clock_skew` (±90 s), `backfill_10k`." } }, { "name": "Get a conformance run", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sandbox", "conformance", ":runId" ], "raw": "{{baseUrl}}/v1/sandbox/conformance/:runId" }, "description": "A conformance run and its checks with evidence." } }, { "name": "Get fault settings", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sandbox", "faults" ], "raw": "{{baseUrl}}/v1/sandbox/faults" }, "description": "The app's active fault settings." } }, { "name": "Set fault injection", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sandbox", "faults" ], "raw": "{{baseUrl}}/v1/sandbox/faults" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"faults\": []\n}" }, "description": "Makes this app's own requests fail or slow down (`503` with `Retry-After`, `429`, latency, token endpoint down) for ≤ 24 h. Other apps are unaffected. At most 5 faults." } }, { "name": "Create a patient request", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sandbox", "requests" ], "raw": "{{baseUrl}}/v1/sandbox/requests" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"type\": \"blanket\"\n}" }, "description": "Creates a patient request on a synthetic encounter as if the patient tapped it (skipping the undo window), to test `request.created` webhooks and write-back." } }, { "name": "Reset the sandbox", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sandbox", "reset" ], "raw": "{{baseUrl}}/v1/sandbox/reset" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "Resets the org's sandbox sites: deletes the app's ledger rows and webhook history for those sites." } }, { "name": "Run a simulator scenario", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sandbox", "scenarios", ":scenarioKey", "run" ], "raw": "{{baseUrl}}/v1/sandbox/scenarios/:scenarioKey/run" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"transport\": \"direct\"\n}" }, "description": "Runs a simulator scenario (for example `chest_pain_admit`, `lwbs`) through the chosen transport." } } ], "name": "Sandbox" }, { "item": [ { "name": "List sites", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sites" ], "raw": "{{baseUrl}}/v1/sites" }, "description": "The sites bound to the app, with feed state, volume and the site's capability switches." } } ], "name": "Sites" }, { "item": [ { "name": "List tasks", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "tasks" ], "raw": "{{baseUrl}}/v1/tasks" }, "description": "Patient tasks ordered by `(updatedAt, id)`, with the 10-second settle window." } } ], "name": "Tasks" }, { "item": [ { "name": "Get a delivery", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-deliveries", ":deliveryId" ], "raw": "{{baseUrl}}/v1/webhook-deliveries/:deliveryId" }, "description": "One delivery with its thin payload and ≤ 10 attempts." } }, { "name": "Redeliver a message", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-deliveries", ":deliveryId", "redeliver" ], "raw": "{{baseUrl}}/v1/webhook-deliveries/:deliveryId/redeliver" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "A new delivery of the same message (same `webhook-id`). An expired sensitive event needs `allowExpired`." } }, { "name": "List webhook endpoints", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-endpoints" ], "raw": "{{baseUrl}}/v1/webhook-endpoints" }, "description": "The app's endpoints (≤ 20)." } }, { "name": "Create a webhook endpoint", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-endpoints" ], "raw": "{{baseUrl}}/v1/webhook-endpoints" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"eventTypes\": [\n \"request.created\"\n ],\n \"url\": \"https://10.0.0.5/hooks\"\n}" }, "description": "Creates an endpoint. The URL must pass the destination policy (HTTPS, public host, no private ranges). The `whsec_` signing secret is returned **once**." } }, { "name": "Get a webhook endpoint", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-endpoints", ":endpointId" ], "raw": "{{baseUrl}}/v1/webhook-endpoints/:endpointId" }, "description": "One endpoint. Secrets and header values are never returned." } }, { "name": "Delete a webhook endpoint", "request": { "header": [], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-endpoints", ":endpointId" ], "raw": "{{baseUrl}}/v1/webhook-endpoints/:endpointId" }, "description": "Deletes an endpoint and cancels its pending deliveries." } }, { "name": "Update a webhook endpoint", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-endpoints", ":endpointId" ], "raw": "{{baseUrl}}/v1/webhook-endpoints/:endpointId" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Mirth channel\"\n}" }, "description": "Updates an endpoint. Re-enabling an auto-disabled endpoint is `status: enabled`; then `recover`." } }, { "name": "List deliveries", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-endpoints", ":endpointId", "deliveries" ], "raw": "{{baseUrl}}/v1/webhook-endpoints/:endpointId/deliveries" }, "description": "Deliveries of an endpoint, newest first (without payloads)." } }, { "name": "Recover failed deliveries", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-endpoints", ":endpointId", "recover" ], "raw": "{{baseUrl}}/v1/webhook-endpoints/:endpointId/recover" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"since\": \"2026-09-14T00:00:00Z\"\n}" }, "description": "Redelivers every failed delivery since a time (≤ 14 days). Expired events are skipped unless `includeExpired`." } }, { "name": "Rotate the signing secret", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-endpoints", ":endpointId", "rotate-secret" ], "raw": "{{baseUrl}}/v1/webhook-endpoints/:endpointId/rotate-secret" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "Adds a new secret version; both sign during the overlap (1–168 h, default 24 h). The new secret is shown once." } }, { "name": "Send a test message", "request": { "header": [ { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-endpoints", ":endpointId", "test" ], "raw": "{{baseUrl}}/v1/webhook-endpoints/:endpointId/test" }, "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "Posts a `webhook.test` message synchronously and returns the attempt." } }, { "name": "List webhook event types", "request": { "header": [], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "webhook-event-types" ], "raw": "{{baseUrl}}/v1/webhook-event-types" }, "description": "The event catalogue with each type's data schema, sensitivity, expiry and `liveFrom`." } } ], "name": "Webhooks" } ], "variable": [ { "key": "baseUrl", "value": "https://api.sandbox.edflow.space" }, { "key": "accessToken", "value": "" } ] }