Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

Stream webhook events live (Server-Sent Events)

GET

/v1/webhook_events/stream

const url = 'http://localhost:8080/v1/webhook_events/stream';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url http://localhost:8080/v1/webhook_events/stream \
  --header 'Authorization: Bearer <token>'

A long-lived Server-Sent Events stream of the tenant’s outbound webhook events. Accepts the dashboard session cookie or a Bearer key with apikey:read. It has no 30-second request timeout.

On connect, the server sends the 50 newest events, newest first. It then sends a frame for each new event, replay, and delivery result. Every frame is event: webhook_event with a JSON data: line. A comment line : heartbeat is sent every 15 seconds to keep proxies from closing the connection. The same event can arrive more than once; de-duplicate by event_id.

Live frames are not filtered by mode: check livemode on each frame. The first batch holds only the caller’s mode. Live frames come from the server instance that handled the event, so with several replicas a client sees only that replica’s events.

Authorizations

BearerAuth

Responses

200

Event stream. Each frame’s data is a WebhookStreamFrame object in JSON.

text/event-stream

SSE frames: event: webhook_event\ndata: <WebhookStreamFrame JSON>\n\n, plus : heartbeat\n\n comments.

string

401

Missing or invalid credential

application/json

object

error

object

type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string

code

string

message

string

request_id

string

param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}

403

Caller lacks the apikey:read permission

application/json

object

error

object

type

string

code

string

message

string

request_id

string

param

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}