Send a test event
Sends a real event through the full delivery pipeline (signature, SSRF vetting, 10 s timeout), so a green result means your endpoint will actually work. The body is optional — omit it for a plain `ping`, or name any catalogued `eventType` to receive that type’s SAMPLE payload (the same object `GET /meta/event-types` publishes as `sampleEnvelope`). Every delivery from this route carries a `Mediflo-Event-Test: true` request header, which real events never do — branch on it to drop test traffic. Repeated sends of the SAME type within one minute collapse onto a single event (each still gets its own delivery row); different types never collapse. Asynchronous: poll the returned `deliveryId` in the delivery log. The endpoint must be `ENABLED`. Required scope: `webhooks.manage`.
/webhook-endpoints/{endpointId}/testAuthorization
ApiKeyAuth An external API key, sent as Authorization: Bearer mflo_…. Scopes are checked per route; see each operation’s description.
In: header
Path Parameters
uuidRequest Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/webhook-endpoints/497f6eca-6276-4993-bfeb-53cbbbba6f08/test" \ -H "Content-Type: application/json" \ -d '{}'{ "data": { "deliveryId": "73dc828d-801d-4d29-b7e4-e046662a5901", "eventType": "ping" }}Rotate an endpoint signing secret POST
Returns the new `secret` once. The previous secret keeps signing for 24 h — during that window every delivery carries TWO `v1=` entries, so accept the request if either verifies. `previousSecretExpiresAt` tells you when the old one stops. Required scope: `webhooks.manage`.
Create a webhook endpoint POST
Returns the signing `secret` ONCE — store it before you close the response. The URL must be https and must resolve to a public address; private and link-local targets are rejected at save time. Default payload is core fields only; opt into PHI-bearing content blocks explicitly via `payloadConfig`. Limit: 20 endpoints per workspace. Required scope: `webhooks.manage`.