Mediflo
REST APIWebhooks

Get the payload a delivery carried

Returns the envelope CONTENT this delivery carried, as the projection for ITS endpoint — the same projection that composes real deliveries, so a content block the endpoint did not opt into is absent here exactly as it was absent on the wire. It is not an archive of the transmitted bytes: we store none, so this is rebuilt from the stored event and is a re-serialization — never verify a signature against it. `payloadConfig` is returned alongside because it is read as it is NOW; if the endpoint’s opt-ins changed after this delivery, you are seeing what it would receive today. Payloads disappear with their event after the retention window (410 once the event is pruned). Requires `webhook-payloads.read`, which is separate from `webhooks.manage` and is granted by NO wildcard — including `*` and `webhooks.*` — because for endpoints subscribed to the `outcome` or `transcript` blocks this content includes personal data, including sensitive data. Required scope: `webhook-payloads.read`.

GET/webhook-deliveries/{deliveryId}/payload

Authorization

ApiKeyAuth
AuthorizationBearer <token>

An external API key, sent as Authorization: Bearer mflo_…. Scopes are checked per route; see each operation’s description.

In: header

Path Parameters

deliveryId*string
Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/webhook-deliveries/497f6eca-6276-4993-bfeb-53cbbbba6f08/payload"
{  "data": {    "deliveryId": "73dc828d-801d-4d29-b7e4-e046662a5901",    "endpointId": "c8d2c7e1-e4b1-4108-9e29-3429a36a1ef3",    "payloadConfig": null,    "isTest": true,    "envelope": {      "id": "string",      "type": "ping",      "apiVersion": "string",      "occurredAt": "string",      "data": {        "property1": null,        "property2": null      }    }  }}