API reference

Get your webhook endpoint

Your app’s webhook endpoint, its events and the last 20 deliveries (with status codes and errors) — the first place to look when an event seems missing.

View as MarkdownUpdated Oct 17, 2026

GET/api/external/webhooksNew

Your app’s webhook endpoint, its events and the last 20 deliveries (with status codes and errors) — the first place to look when an event seems missing.

Authentication

Send the creator's API key as a bearer token: Authorization: Bearer dpfn_…. See Authentication & API keys.

Responses

200The configuration.

Name Type Description

url

string | null

Your https endpoint, or null when none is set.

Format: uri

events string[] Events delivered to the endpoint.

hasSecret boolean Whether a signing secret exists.

availableEvents string[] Every event you can subscribe to.

recentDeliveries

object[]

The last 20 deliveries, newest first.

Show child attributes

`id`	string	Event id (also the DropFans-Event-Id header).
`event`	string	Event type.
`status`	string	PENDING = retrying. One of: `PENDING`, `DELIVERED`, `FAILED`
`attempts`	integer	Attempts so far.
`lastStatusCode`	integer \| null	Your endpoint’s last HTTP status.
`lastError`	string \| null	Last failure reason.
`createdAt`	string	When the event was created. Format: date-time
`deliveredAt`	string \| null	When your endpoint accepted it. Format: date-time
`nextAttemptAt`	string \| null	Next retry, while PENDING. Format: date-time

Example response

{
  "url": "https://crm.example.com/hooks/dropfans",
  "events": [
    "drop.paid",
    "drop.refunded",
    "account.kyc_updated"
  ],
  "hasSecret": true,
  "availableEvents": [
    "drop.paid",
    "drop.refunded",
    "account.kyc_updated"
  ],
  "recentDeliveries": [
    {
      "id": "evt_2b7c…",
      "event": "drop.paid",
      "status": "DELIVERED",
      "attempts": 1,
      "lastStatusCode": 200,
      "lastError": null,
      "createdAt": "2026-10-17T16:20:01.000Z",
      "deliveredAt": "2026-10-17T16:20:01.000Z",
      "nextAttemptAt": null
    }
  ]
}

Errors

Status	Body	When
401	`{"error":"Unauthorized","code":"unauthorized"}`	Missing or invalid API key.
403	`{"error":"This endpoint needs a key bound to an approved app.","code":"app_key_required"}`	A Personal key was used.
403	`{"error":"Use the app owner's key for this endpoint.","code":"owner_key_required"}`	The key was minted by a creator for themselves. App-level calls need a key held by your app owner: their own, or one their agency minted for its personas or managed creators.

Rate limiting

Every response carries the X-RateLimit-Tier header and, on limited tiers, the per-minute and per-day trios — read X-RateLimit-Remaining and X-RateLimit-Reset instead of hardcoding limits. Details in Rate limits.

Code samples

curl "https://www.dropfans.io/api/external/webhooks" \
  -H "Authorization: Bearer $DROPFANS_API_KEY"

const res = await fetch(`https://www.dropfans.io/api/external/webhooks`, {
  headers: {
    Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,
  },
});
console.log(await res.json());

import os
import requests

res = requests.get(
    "https://www.dropfans.io/api/external/webhooks",
    headers={"Authorization": f"Bearer {os.environ['DROPFANS_API_KEY']}"},
)
print(res.json())

← Previous

Get a fresh ID-check link

Set your webhook endpoint

Questions? [email protected]