List Instance Webhook Events
GET/api/integrations/17track/instances/:instance/webhooks
Paginated audit log of every 17TRACK webhook received for this integration instance — one row per inbound webhook, stored before it is processed. Each row records the event type, tracking number, result, the status transition (status_from → status_to), processing time and any error message, plus a precomputed summary string like "In Transit → Delivered".
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Filters (filter[...]):
search— contains match on tracking number, event type, or the from/to statusevent_type,result,tracking_number,status_from,status_to— text filters; the bare key is an exact match (comma-separated values match any of them), andfilter[<field>.<operator>]takes any ofcontains,does_not_contain,is,is_not,is_one_of,is_not_one_of,starts_with,does_not_start_with,ends_with,does_not_end_with,is_empty,is_not_emptyid— numeric filterreceived_at,created_at— date filters,filter[<field>.<operator>]withis,is_not,before,after,on_or_before,on_or_after,between,is_empty,is_not_empty,today,yesterday,past_week,past_month,past_year,past_days,days_ago, .... Dates areY-m-din the account timezone;betweentakes two comma-separated dates.
filter_groups accepts a base64-encoded JSON filter tree for AND/OR combinations: {"conjunction": "and", "children": [{"type": "condition", "condition": {"column": "<field>.<operator>", "operator": "<operator>", "value": "..."}}, {"type": "group", "group": {"conjunction": "or", "children": [...]}}]}. When it is present it takes precedence over the flat filter[...] parameters.
Unknown filter names are rejected with 400 Bad Request.
Allowed sorts: id, received_at, created_at, event_type, result (default: -received_at).
Responses:
200 OK— paginated webhook event rows400 Bad Request— a filter name that is not allowed404 Not Found— instance id does not exist
Authentication: Bearer token (Personal Access Token).
Request
Responses
- 200
- 401
- 403
- 404
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.