Events

Deliver an event again

POST https://api.xipid.org/events/{id}/redeliver

Delivers an event again, at once: its delivery starts over, pending, its attempts counted from none, on the schedule a first delivery follows.

Scope: any live key of the brand.

Limits: 1,000 requests a minute per key and 2,000 requests a minute per source address; every answer says what is left in X-RateLimit-Remaining, and a refusal when to come back in Retry-After.

Idempotency: takes an Idempotency-Key, which it requires: a retry under the same key is answered what the first request was, for 24 hours, and the key sent with another request is refused.

Changes: 2026-09-26: added.

Parameters

• id in the path, required, ULID

  XipID's id for the event.

• Idempotency-Key a header, required, string, at most 512 characters

  The operation's key, 1 to 255 characters, best a UUID, in double quotes as a structured field string: a retry of the operation sends it again, and is answered what the first request was, for 24 hours.

• Xip-Version a header, optional, string, one of the values below

  The version to answer in; when absent, the version the brand's org is pinned to.

  • 2026-09-26: The first version: challenges, subjects and events, and the signed outcome.

Answers

202 Accepted

The delivery as it now stands. Location names its challenge's deliveries, which show it as it goes.

Its headers: X-Request-Id, Xip-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Location.

• id ULID

• challenge_id ULID

• event string, one of the values below

  How the challenge closed.

  • challenge.verified: The person approved and every check passed.
  • challenge.check_failed: A check the policy asks for did not pass.
  • challenge.declined: The person declined.
  • challenge.expired: No decision came before the challenge expired.
  • challenge.canceled: The brand canceled the challenge, or its text could not be sent.

• status string, one of the values below

  Where the delivery stands.

  • pending: An attempt is due or running.
  • delivered: The receiver answered 2xx.
  • failed: Its attempts are spent, or the receiver answered a status that ends them.

• attempts integer, at least 0

• last_attempt object, optional

  • attempted_at instant, RFC 3339

  • duration_ms integer, at least 0

  • status_code integer, optional

  • response_headers map, each value string, optional

  • response_body string, optional

  • failure string, one of the values below, optional

    Why the attempt got no answer, by its class alone.

    • timeout: The attempt ran out of its 15 seconds.
    • dns_failure: The callback URL's host did not resolve.
    • connection_refused: The receiver refused the connection.
    • connection_reset: The receiver reset the connection.
    • tls_error: TLS failed.
    • url_refused: The callback URL was refused before anything was sent: not https on port 443, or not public.

• next_attempt_at instant, RFC 3339, optional

• delivered_at instant, RFC 3339, optional

• created_at instant, RFC 3339

{
  "id": "01JD2RB7C9E1G3J5K7M9N1P3R5",
  "challenge_id": "01JD2R5W8Y3K6M9P2S5V8X1Z4B",
  "event": "challenge.verified",
  "status": "pending",
  "attempts": 0,
  "next_attempt_at": "2026-11-20T09:15:02.448Z",
  "created_at": "2026-11-19T18:06:41.090Z"
}

Errors

• json_invalid, 400: The request body is not valid JSON.
• parameter_invalid, 400: The request contains invalid parameters.
• parameter_unknown, 400: The request contains a parameter this route does not take.
• idempotency_key_missing, 400: This route requires an Idempotency-Key header.
• version_invalid, 400: Xip-Version names no released version of this API.
• authentication_required, 401: Authentication is required.
• authentication_failed, 401: The credential is invalid, expired or revoked.
• insufficient_scope, 403: The credential does not allow this operation.
• resource_not_found, 404: No such resource.
• idempotency_key_in_use, 409: The first request with this Idempotency-Key is still running.
• content_too_large, 413: The request body is larger than this route accepts.
• media_type_unsupported, 415: This route does not accept that Content-Type.
• idempotency_key_reused, 422: This Idempotency-Key was used for a different request.
• rate_limit_exceeded, 429: Too many requests; try again later.
• internal_error, 500: Something went wrong on our side.
• service_unavailable, 503: The service is temporarily unavailable.