Current retry policy
Effective 18 October 2026: a webhook has at most five attempts in total, including the initial delivery. The four retry delays are 1 minute, 5 minutes, 30 minutes and 2 hours after the preceding failure. After the fifth failure the delivery is Failed and needs an explicit replay.
Exceptions and duplicate safety
401 and 403 pause delivery until authorization is repaired. 429 respects Retry-After before another attempt. Verify the signature and event identifier, store processed event IDs and return success for an already processed event. Delivery is at least once; your consumer must tolerate duplicates.
Replay a request safely
Keep the same Idempotency-Key when retrying the same request body after an uncertain response. Reusing a key with a different body returns 409. This policy supersedes legacy-webhook-retries: that archived document's unlimited 30-second retries must not be used.