---
title: "Replay failed callback deliveries"
canonical: "https://bird.com/docs/api/reference/create-webhook-callback-replay"
---

# Replay failed callback deliveries

`POST /v1/webhook-callbacks/replay`

Queues redelivery of SMS callbacks that failed. The window runs from `since`
(default: the last 24 hours) to `until`, and events whose callback was already received
successfully within that window are skipped. An event can still arrive more than once: a
failure inside the window followed by a success outside it is replayed, and a live
delivery can overlap a replay. Your receiver must deduplicate on the `webhook-id` header.
Each event goes to the callback URL its original attempts used.

Only failed attempts are replayed, and the window selects on attempt time rather than
on when the event occurred. Replay reads the delivery-attempt log, which retains three
days, so that is the oldest history it reaches: an earlier `since` widens the window
without recovering anything older.

The `202` response means the replay is queued. Each redelivery then takes a single
attempt rather than the retry schedule a live delivery follows, so a replay into a
callback URL that is still failing costs one request per event; fix the receiver and
replay again. No count or task ID is returned, so track results with
the callback delivery attempts list.

One replay redelivers at most the oldest 10,000 events in the window. Callback replays
count toward the same limit of 20 replays per organization per UTC day as
[Replay failed deliveries](/docs/api/reference/create-webhook-replay); beyond that the
request returns a `429` `WebhookReplayQuotaExceeded`.

## Servers

- `https://{region}.platform.bird.com`: Regional API endpoint. Use the host for the region your organization is hosted in. Official Bird SDKs and the CLI select it automatically from your API key, so you rarely need to set it by hand.
  - `region`: `us1`, `eu1`. Default: `us1`. The region your organization's data is hosted in.
- `https://platform.bird.com`: Region-independent endpoint for authentication and account administration.
- `http://localhost:8080`: Local development.

## Authentication

Use one authentication option:

- `BearerAuth`: HTTP bearer authentication. Pass the API key as a bearer token in the `Authorization` header. Workspace
keys use `bk_{region}_*`; organization master keys use `bm_{region}_*`.
The prefix identifies the region and selects the
API endpoint. Official Bird SDKs and the CLI derive the region from the key.

- `CookieAuth`: Send `bird_session` in cookie. Session cookie set after signing in to the Bird dashboard. The cookie
value is an opaque session token; no session data is stored in the cookie
itself.

## Code samples

**CLI**

```sh
bird webhooks callbacks replay \
  --since 2026-05-07T00:00:00Z \
  --until 2026-05-07T23:59:59Z
```

Examples: [CLI](/docs/api/reference/create-webhook-callback-replay.cli.md) · [MCP](/docs/api/reference/create-webhook-callback-replay.mcp.md) · [cURL](/docs/api/reference/create-webhook-callback-replay.curl.md)

## Header parameters

- `Idempotency-Key` (string, optional)

  Client-supplied key. On operations supporting request deduplication, a retained
  response is replayed for duplicate requests with the same key within the
  idempotency window (3 hours by default). This protection requires a workspace,
  organization, or staff-account scope. User-only and unscoped unauthenticated operations,
  streams, and operations with a separate replay contract do not use this
  response replay.

  On a supported operation, if idempotency protection is unavailable before execution, the API returns
  `503 IdempotencyUnavailable` (E01033) without executing this attempt. Retry with
  backoff using the same key and request. An operation that takes effect before
  its response is retained can still execute again on retry.

  Two distinct 409 errors signal misuse:

  - `request_in_progress` (E01004): The same key is currently being
    processed by a concurrent request. Wait briefly and retry. The lock expires within 30 seconds.
  - `idempotency_key_reuse` (E01005): The same key has already completed
    against a different request body or method. Generate a new key.

  Recommended key format is `<event-type>/<entity-id>` (for example `welcome-user/usr_abc123`).
- `X-Workspace-Id` (string, optional): Workspace context for the request. Required for dashboard authentication and master keys. Workspace keys and access tokens already identify their workspace; send that workspace or omit the header. A different one is rejected.
- `X-Organization-Id` (string, optional): Organization context for the request. Required for dashboard authentication. An API key or access token carries its own organization, so send either that organization or no header at all; a different one is rejected.

## Request body

- `since` (string): Replay events whose delivery attempt failed at or after this timestamp. The bound is inclusive and applies to attempt time, not to when the event occurred, so a retry that trailed its event by a day falls in the window by the hour it was attempted. Defaults to 24 hours before the request when omitted. Attempts are retained for three days, so that is the oldest history a replay reaches: an earlier `since` widens the window without recovering anything older.
- `until` (string): Replay events whose delivery attempt failed at or before this timestamp, on the same attempt-time bound as `since`. Omitted, it resolves to the time of the request.

## Related resources

- [Should I use a Bird SDK or call the API directly?](/explained/platform/should-i-use-an-sdk-or-call-the-api-directly) (answer)
- [Build your first integration](/learn/paths/integration) (course)
- [Send your first email](/docs/get-started/send-your-first-email) (docs)

[Get an implementation brief](/learn/workspace?topic=api-basics)