> ## Documentation Index > Fetch the complete documentation index at: https://docs.closient.com/llms.txt > Use this file to discover all available pages before exploring further. # Resume a paused webhook endpoint > Resume deliveries on an endpoint previously paused via ``POST /{endpoint_id}/pause/``. Returns 422 if the endpoint is not currently ``paused`` (for example, if it was auto-disabled for delivery failures — re-activate it via ``PATCH`` with ``is_active: true`` once the underlying issue is fixed). ## OpenAPI ````yaml /openapi/openapi-integrations.json post /integrations/api/v1/webhooks/endpoints/{endpoint_id}/resume/ openapi: 3.1.0 info: title: Integrations API version: 1.0.0 description: > Webhook endpoint management, event catalog, delivery tracking, and event replay. ## Authentication All endpoints require an API key passed via the `X-API-Key` HTTP header, unless otherwise noted. ``` X-API-Key: csb__ ``` Generate API keys in **Settings > API Keys** in your dashboard, or via the Account API. Session-based (cookie) authentication is also accepted for browser-based access. ## Rate Limits | Tier | Requests / minute | Requests / day | |-------------|-------------------|----------------| | Default | 300 | 10,000 | | Custom | Contact us | Contact us | Rate-limit headers are included on every response so callers can self-throttle without hitting our 429s ("informed governor"): - `RateLimit-Policy` — every active window, e.g. `300;w=60, 10000;w=86400` - `RateLimit-Limit` — quota for the **most-restrictive** currently-active window - `RateLimit-Remaining` — requests left in that window - `RateLimit-Reset` — seconds until that window resets (relative; clock-skew safe) Legacy `X-RateLimit-*` aliases are also emitted for back-compat. `X-RateLimit-Reset` keeps the absolute Unix-timestamp shape to avoid breaking existing consumers. When rate-limited, you receive `429 Too Many Requests` with a `retry_after_seconds` field in the error envelope and a `Retry-After` header. ## Pagination List endpoints return paginated results in this envelope: ```json { "data": [...], "pagination": { "page": 1, "page_size": 25, "total_count": 342, "total_pages": 14, "has_next": true, "has_previous": false } } ``` Use `?page=2&page_size=50` query parameters. Maximum page size is 100. ## Error Responses All errors conform to [RFC 9457 Problem Details](https://www.rfc-editor.org/rfc/rfc9457) with `Content-Type: application/problem+json`: ```json { "type": "https://closient.com/docs/errors/not_found", "title": "Not Found", "status": 404, "detail": "The requested resource was not found.", "error_code": "not_found", "retryable": false, "timestamp": "2026-03-31T12:00:00+00:00" } ``` Common error codes: `unauthorized` (401), `forbidden` (403), `not_found` (404), `validation_error` (422), `rate_limited` (429), `internal_error` (500). termsOfService: https://www.closient.com/terms/ servers: - url: https://www.closient.com security: [] tags: - name: Webhook Endpoints description: Register and manage webhook delivery endpoints. - name: Webhook Event Catalog description: >- Discover every subscribable event type and the envelope versions available. - name: Webhook Deliveries description: Track and replay webhook delivery attempts. - name: Webhook Events description: >- Durable event log with cursor-based replay, for recovering from a subscriber outage. externalDocs: description: Closient Documentation url: https://docs.closient.com paths: /integrations/api/v1/webhooks/endpoints/{endpoint_id}/resume/: post: tags: - Webhook Endpoints summary: Resume a paused webhook endpoint description: >- Resume deliveries on an endpoint previously paused via ``POST /{endpoint_id}/pause/``. Returns 422 if the endpoint is not currently ``paused`` (for example, if it was auto-disabled for delivery failures — re-activate it via ``PATCH`` with ``is_active: true`` once the underlying issue is fixed). operationId: apps_integrations_webhooks_api_resume_endpoint_view parameters: - in: path name: endpoint_id schema: description: >- UUID of the webhook endpoint. Returned as the ``id`` field on every endpoint response. format: shortuuid maxLength: 22 minLength: 22 pattern: ^[23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]{22}$ title: Endpoint Id type: string required: true description: >- UUID of the webhook endpoint. Returned as the ``id`` field on every endpoint response. responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/EndpointResponseSchema' '400': description: Bad Request content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '401': description: Unauthorized content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '403': description: Forbidden content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '404': description: Not Found content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '405': description: Method Not Allowed content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '422': description: Unprocessable Content content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '429': description: Too Many Requests content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' security: - APIKeyHeaderAuth: [] - OAuthTokenAuth: [] - CookieGatedSessionAuth: [] components: schemas: EndpointResponseSchema: description: |- A webhook endpoint as read from the API. Returned by ``GET /webhooks/endpoints/{endpoint_id}/``, the list view, and the rotate-secret/test endpoints. ``signing_secret`` is masked except on the initial create response and on the rotate-secret response — see :data:`_SIGNING_SECRET_READ_DESC`. examples: - api_version: '2026-07-01' created_at: '2025-06-15T10:00:00Z' description: Production webhook endpoint event_types: - recall - adverse_report.threshold_alert id: f47ac10b-58cc-4372-a567-0e02b2c3d479 is_active: true metadata: order_id: '6735' signing_secret: whsec_12... updated_at: '2025-08-01T14:30:00Z' url: https://example.com/webhooks/closient properties: metadata: additionalProperties: maxLength: 500 type: string description: >- Developer-attached key/value data attached to this object. Up to 50 keys; key max 40 chars, value max 500 chars. maxProperties: 50 propertyNames: maxLength: 40 title: Metadata type: object id: description: >- UUID identifier of the endpoint. Use this in path params and the deliveries-list ``endpoint_id`` filter. format: shortuuid maxLength: 22 minLength: 22 pattern: ^[23456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]{22}$ title: Id type: string url: description: >- Target URL the webhook payload will be POSTed to. **HTTPS is required in production**; ``http://`` is accepted only by the local development server. Maximum 2048 characters. The request body is the raw event JSON; the signature lives in the ``X-Closient-Signature`` header (see ``signing_secret`` for the verification recipe). maxLength: 2048 title: Url type: string description: default: '' description: >- Optional human-readable label for this endpoint. Surfaced in the brand portal's webhooks list alongside the URL — useful when a single account has separate ``staging`` / ``production`` endpoints. Maximum 255 characters. Has no effect on delivery. maxLength: 255 title: Description type: string signing_secret: description: >- HMAC-SHA256 signing secret for verifying the ``X-Closient-Signature`` header on inbound deliveries. Returned **in full only on creation and rotation**; subsequent ``GET``/``LIST`` responses return a masked form (``...``). Verification recipe: compute ``HMAC-SHA256(secret, f"{timestamp}.{raw_body}")`` where ``timestamp`` is the ``t=`` portion of the header, then ``hmac.compare_digest`` against the ``v1=`` portion. Reject if the timestamp is older than 5 minutes (replay protection). During a 24-hour rotation grace period the header carries an additional ``v1old=`` signature using the prior secret — accept either. title: Signing Secret type: string event_types: description: >- Event types this endpoint subscribes to, drawn from the catalog at ``GET /webhooks/event-types/``. Two forms are accepted: a full wire value (``recall.opened``) or a **domain prefix** (``recall``), which subscribes to every event in that domain including ones added after you subscribe — the recommended form for safety-critical domains. Values outside the catalog are rejected with 422 rather than silently accepted, so a typo cannot leave you subscribed to nothing. An **empty list means every event type** (fail-open); use ``is_active=false`` to pause delivery instead. items: type: string title: Event Types type: array is_active: description: >- Whether this endpoint should receive deliveries. ``false`` pauses delivery without deleting historical records or losing the signing secret — useful while debugging a customer-side outage. New events are not enqueued for inactive endpoints. title: Is Active type: boolean api_version: $ref: '#/components/schemas/EnvelopeVersionEnum' description: >- Envelope version this endpoint receives. Pinned when the endpoint is created and never moved by Closient — shipping a new envelope version does not change what an existing endpoint gets, so an integration can keep running untouched indefinitely. PATCH this field when your parser is ready for a newer shape. ``v1`` is the pre-catalog envelope (``event_type`` / ``version`` / ``event_id`` / ``timestamp`` / ``data``); ``2026-07-01`` is the current CloudEvents-shaped envelope (``type`` / ``specversion`` / ``id`` / ``time`` / ``source`` / ``data``) and additionally carries the ``cursor`` used for replay-on-reconnect. state: $ref: '#/components/schemas/EndpointStateEnum' description: >- Derived lifecycle state. ``active`` mirrors ``is_active=true``; ``paused`` is a self-serve, resumable pause (``POST .../pause/`` / ``.../resume/``); ``disabled`` covers both a deletion and an automatic disable after a sustained 100% delivery failure rate — neither is resumable through the resume action. Read-only: set indirectly via ``is_active`` or the pause/resume actions, never written directly. gtins: description: >- Deliver only events that reference at least one of these GTINs. Accepts GTIN-8/12/13/14 in any digit-count and normalizes to GTIN-14 (``apps.core.types.gtin.GTIN``). Backed by an indexed lookup table, so this scales to very large lists (100,000+ GTINs) without a per-event table scan. Empty list = no restriction (all GTINs). items: type: string title: Gtins type: array company_prefixes: description: >- Deliver only events whose product GTIN's company-prefix segment is one of these GS1 Company Prefixes (4-12 digits). Empty list = no restriction (all prefixes). Note: matched against the GS1-13/14 numbering alignment; a GTIN whose native form is UPC-A (GTIN-12) may not match its equivalent U.P.C. Company Prefix here — use the ``gtins`` filter for exact control in that case. items: type: string title: Company Prefixes type: array jurisdictions: description: >- Deliver only events tagged with one of these ISO 3166-1 alpha-2 jurisdiction codes (e.g. ``US``, ``CA``). Empty list = no restriction (all jurisdictions). items: type: string title: Jurisdictions type: array gpc_codes: description: >- Deliver only events for products in one of these 8-digit GS1 Global Product Classification brick codes. Empty list = no restriction (all categories). items: type: string title: Gpc Codes type: array lifecycle_statuses: description: >- Deliver only recall events whose recall is currently in one of these lifecycle statuses. Empty list = no restriction (all statuses). items: $ref: '#/components/schemas/LifecycleStatusEnum' title: Lifecycle Statuses type: array created_at: description: >- Server-side ISO 8601 timestamp (UTC) of when the resource was first persisted. format: date-time title: Created At type: string updated_at: description: >- Server-side ISO 8601 timestamp (UTC) of the resource's last modification. format: date-time title: Updated At type: string required: - id - url - signing_secret - is_active - api_version - state - created_at - updated_at title: EndpointResponseSchema type: object ErrorOut: title: ErrorOut type: object description: RFC 9457 Problem Details error body. properties: type: type: string format: uri title: type: string status: type: integer detail: type: string error_code: type: string retryable: type: boolean timestamp: format: date-time type: string required: - type - title - status - detail examples: - type: https://closient.com/docs/errors/not_found title: Not Found status: 404 detail: The requested resource was not found. error_code: not_found retryable: false timestamp: '2026-03-31T12:00:00+00:00' EnvelopeVersionEnum: description: |- Payload-envelope versions an endpoint can be pinned to (C-4296). Mirrors :class:`apps.integrations.webhooks.catalog.EnvelopeVersion`. ``v1`` is the pre-catalog envelope, retained permanently because every endpoint created before C-4296 is pinned to it. ``2026-07-01`` is the current shape; versions are dated from here on. enum: - v1 - '2026-07-01' title: EnvelopeVersionEnum type: string EndpointStateEnum: description: >- Derived lifecycle state of a :class:`~apps.integrations.models.WebhookEndpoint` (C-4812). Mirrors :class:`apps.integrations.models.EndpointState`. Read-only — always a strict function of ``is_active``; set it indirectly via ``is_active`` on ``PATCH``, or the dedicated pause/resume actions, never by writing this field directly. enum: - active - paused - disabled title: EndpointStateEnum type: string LifecycleStatusEnum: description: >- A recall's lifecycle status, for the ``lifecycle_statuses`` filter dimension (C-4812). Mirrors :class:`apps.compliance.models.RecallEvent.LifecycleStatus`. enum: - PUBLISHED - AMENDED - CLOSED - RETRACTED title: LifecycleStatusEnum type: string securitySchemes: APIKeyHeaderAuth: type: apiKey in: header name: X-API-Key OAuthTokenAuth: type: http scheme: bearer CookieGatedSessionAuth: type: apiKey in: cookie name: sessionid ````