> ## Documentation Index > Fetch the complete documentation index at: https://vexioncards.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Retry (resend) a webhook delivery > Manually re-send a past delivery - the manual counterpart to the automatic 12-attempt retry. A new delivery attempt is created for the SAME event: it carries the same `webhook-id` (event id) as the original, so an idempotent receiver de-duplicates it against the first delivery. The original delivery record is never modified. Works on any endpoint status; retrying a disabled endpoint records the attempt but does not re-enable it (re-enable via PATCH first). Scope: `webhooks:manage`. Send an `Idempotency-Key`. Rate limit: 10 retries per endpoint per minute. ## OpenAPI ````yaml /openapi.json post /v1/webhook_endpoints/{id}/deliveries/{delivery_id}/retry openapi: 3.1.0 info: title: VEXiON cards Public API description: >- ## Rate limiting Two independent layers, checked in this order: 1. **Per-IP throttle (pre-authentication).** Applied to every `/v1` request BEFORE the API key is checked, keyed on the caller's IP address: - **600 requests/minute** per IP - a flood ceiling, `429 rate_limit_error` / `rate_limited`. - **20 failed authentications per 15 minutes** per IP - a key-guessing ceiling. Only responses that are `401` (missing/invalid/revoked key) count against this ceiling; a `403` from a valid key that simply lacks a scope does not. `429 rate_limit_error` / `too_many_failed_attempts`. Both ceilings send `Retry-After` (seconds). 2. **Per-key, per-bucket limiter (post-authentication).** Documented per endpoint (see each operation's `429` response and the `rate_limit` field on the API Key resource) - e.g. 60/min default, 120/min for transactions, plus the notification-broadcast and lookup-filter buckets described on their own endpoints. ### Rate-limit response headers Every rate-limited response carries the legacy `X-RateLimit-Limit` / `X-RateLimit-Remaining` / `X-RateLimit-Reset` family (the last is an **epoch timestamp**) AND the IETF standards-track headers, side by side: - `RateLimit-Policy: "";q=;w=` - the static policy for the bucket that was hit. - `RateLimit: "";r=;t=` - live state. **`t` is a DURATION (seconds remaining), not the epoch timestamp `X-RateLimit-Reset` carries - the two are never the same value.** version: 1.0.0 servers: - url: https://api.vexioncards.one description: Production - url: https://migration.api.vexioncards.one description: Sandbox security: - apiKey: [] tags: - name: Customers - name: Cards - name: Transactions - name: Notifications - name: Locations - name: Products - name: API keys - name: Organization - name: Webhook endpoints - name: Events - name: Custom fields - name: Team members - name: Icons paths: /v1/webhook_endpoints/{id}/deliveries/{delivery_id}/retry: post: tags: - Webhook endpoints summary: Retry (resend) a webhook delivery description: >- Manually re-send a past delivery - the manual counterpart to the automatic 12-attempt retry. A new delivery attempt is created for the SAME event: it carries the same `webhook-id` (event id) as the original, so an idempotent receiver de-duplicates it against the first delivery. The original delivery record is never modified. Works on any endpoint status; retrying a disabled endpoint records the attempt but does not re-enable it (re-enable via PATCH first). Scope: `webhooks:manage`. Send an `Idempotency-Key`. Rate limit: 10 retries per endpoint per minute. operationId: retryWebhookDelivery parameters: - name: id in: path description: Endpoint identifier (`whk_` prefix). required: true schema: type: string pattern: ^whk_[A-Za-z0-9]+$ - name: delivery_id in: path description: Delivery identifier (`whd_` prefix) of the delivery to resend. required: true schema: type: string pattern: ^whd_[A-Za-z0-9]+$ - name: Idempotency-Key in: header required: true description: >- Required on every mutating POST. See [Idempotency](/api-reference/idempotency). schema: type: string minLength: 8 maxLength: 255 example: retry-9f3c1e7a-55b2-4d81-9a0e-7c4b2f61de03 responses: '202': description: >- Retry accepted - a new delivery attempt (same event id) has been queued. content: application/json: schema: $ref: '#/components/schemas/WebhookDelivery' examples: Retry queued: summary: Delivery re-queued after a failed attempt value: id: whd_01HW9RCZ4HJ7N8MTX1RVWHDDEF object: webhook_delivery webhook_endpoint_id: whk_01HW9RBZ4GH7N8MTX1RVWHKDEF event_id: evt_01HW9RDZ4JK7N8MTX1RVEVTDEF event_type: transaction.created status: retrying response_code: 500 attempts: 2 next_retry_at: 1750691900 delivered_at: null created_at: 1750691720 '400': description: Missing Idempotency-Key header. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Missing or invalid API key. content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Key lacks the required scope (webhooks:manage). content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Webhook endpoint or delivery not found in your organization. content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: Idempotency-Key reuse with a different request. content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: Rate limit exceeded. content: application/json: schema: $ref: '#/components/schemas/Error' '500': description: Server error. Retry-safe on idempotent calls. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: type: api_error code: internal_error message: >- An internal error occurred. The request may be retried with the same Idempotency-Key. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#internal_error request_id: req_5f8b2c4a9e1d3 examples: Http 500 default: summary: Http 500 default value: error: type: api_error code: internal_error message: >- An internal error occurred. The request may be retried with the same Idempotency-Key. doc_url: >- https://vexioncards.mintlify.site/api-reference/errors#internal_error request_id: req_5f8b2c4a9e1d3 headers: {} components: schemas: WebhookDelivery: type: object description: >- One delivery attempt record. Retained 90 days. High-volume listing: one row per attempt including retries. We store the response STATUS CODE only. No response headers, no response body bytes, and no request-body hash are retained, by design: see the privacy note in the Webhooks guide. Each attempt records its number, timestamp, status code, error string and duration. Replay is available over the API: POST /v1/webhook_endpoints/{id}/deliveries/{delivery_id}/retry. There is intentionally no single-delivery GET-by-id endpoint - list + retry only. required: - id - object - webhook_endpoint_id - event_id - event_type - status - attempts - created_at properties: id: type: string pattern: ^whd_[A-Za-z0-9]+$ description: Delivery record id (`whd_` prefix). Used as the pagination cursor. example: whd_01HW9RCZ4HJ7N8MTX1RVWHDDEF object: type: string const: webhook_delivery description: Always `"webhook_delivery"`. webhook_endpoint_id: type: string description: The endpoint this delivery targeted. example: whk_01HW9RBZ4GH7N8MTX1RVWHKDEF event_id: type: string pattern: ^evt_[A-Za-z0-9]+$ description: >- The event ULID - stable across retries; your receiver deduplicates on this. example: evt_01HW9RDZ4JK7N8MTX1RVEVTDEF event_type: $ref: '#/components/schemas/WebhookEventName' status: type: string enum: - pending - delivered - retrying - failed description: >- `delivered` = receiver returned 2xx within 10 s. `retrying` = on the backoff curve. `failed` = all 12 attempts exhausted (also fires `webhook_endpoint.delivery_failed` to other subscribed endpoints). example: delivered response_code: type: - integer - 'null' description: >- HTTP status the receiver returned on the most recent attempt. Null when the attempt never got a response (timeout, TCP/TLS error). example: 200 attempts: type: integer description: Attempt count so far (max 12 across 24 hours). example: 1 next_retry_at: type: - integer - 'null' description: >- Unix seconds of the next scheduled attempt. Null when delivered or failed. example: null delivered_at: type: - integer - 'null' description: Unix seconds of successful delivery. Null otherwise. example: 1750691720 created_at: type: integer description: Unix seconds when the event was first dispatched to this endpoint. example: 1750691720 Error: type: object required: - error properties: error: type: object required: - type - code - message properties: type: type: string enum: - invalid_request_error - authentication_error - permission_error - not_found_error - rate_limit_error - idempotency_error - api_error code: type: string message: type: string retry_after: type: integer description: >- Seconds to wait before retrying. Present on rate-limit (429) errors and on the retryable 409 conflicts (`idempotency_key_in_use`, `create_in_progress`, `concurrent_update`); mirrors the `Retry-After` HTTP header. Absent on error types that carry no retry guidance. example: 5 param: type: - string - 'null' request_id: type: string doc_url: type: string format: uri field_errors: type: array description: >- Per-field errors on a 422. At most 100 entries: a request with more errors gets the first 100. items: type: object properties: param: type: string code: type: string message: type: string expected_currency: type: string description: >- On `currency_mismatch`: the business currency the request must use. Absent on every other field error. description: >- The error payload: type (category), code (machine-readable), message (human-readable), retry_after (seconds, on rate-limit errors and retryable 409 conflicts only), param (offending field), request_id, doc_url, field_errors[]. description: >- Standard error envelope. Branch on `error.code`; include `error.request_id` in support requests. See the Errors guide. WebhookEventName: type: string enum: - customer.created - customer.updated - customer.deleted - customer.pass_installed - customer.pass_uninstalled - card.created - card.updated - card.deleted - custom_field.created - custom_field.updated - custom_field.deleted - product.created - product.updated - transaction.created - transaction.reversed - notification.sent - notification.delivery_updated - location.updated - team_member.added - team_member.updated - team_member.removed - webhook_endpoint.delivery_failed description: >- The locked v1 event catalog - 22 events across 9 subjects. Names follow `resource.action` with past-participle actions (`transaction.created`), never the dotted verb-stems used by transaction types - the two vocabularies never mix. `product.created`/`product.updated` fire for dashboard and API-created catalog changes; POS-synced catalog changes do not emit (they mirror the till, and a first sync would flood your endpoint). example: transaction.created securitySchemes: apiKey: type: http scheme: bearer description: >- Your secret API key as a Bearer token: `Authorization: Bearer vxn_sk_...`. Keys are created and scoped in the dashboard - see [Authentication](/api-reference/introduction#authentication). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.