POST /replay/:webhookId/:itemId — replay events

POST /replay/:webhookId/:itemId re-sends a previously captured webhook event to a destination URL you specify. The server validates the target against SSRF rules, strips masked and transport headers, injects replay-specific headers, and returns the target’s response code and body. Authentication: Required when authKey is configured.

Path parameters

string

required

The webhook ID that owns the captured event.

string

required

The log entry ID to replay. If this does not resolve to a log ID but parses as a timestamp, the handler attempts a fallback lookup by timestamp within the specified webhook.

Query parameters

string

required

Destination URL to replay the event to. Subject to SSRF and DNS safety checks. Private networks, loopback addresses, and cloud metadata endpoints are blocked. See Error responses for the full blocked-range list.

Example request

curl -X POST \
  "https://<run-id>.runs.apify.net/replay/wh_abc123/evt_8m2L5p9xR?url=https%3A%2F%2Ftarget.example%2Fwebhook"

Added headers

The server injects the following headers into every outbound replay request:

Header	Value
`X-Apify-Replay`	`true`
`X-Original-Webhook-Id`	The original webhook ID
`Idempotency-Key`	A unique key for this replay attempt

Stripped headers

Masked headers (e.g. Authorization, Cookie) and transport-managed headers (e.g. host, content-length) are removed before forwarding. The response body lists any headers that were stripped.

Success response

{
  "status": "replayed",
  "targetUrl": "https://target.example/webhook",
  "targetResponseCode": 200,
  "targetResponseBody": "OK"
}

When headers were stripped, the response also includes:

{
  "status": "replayed",
  "targetUrl": "https://target.example/webhook",
  "targetResponseCode": 200,
  "targetResponseBody": "OK",
  "strippedHeaders": ["host", "content-length"]
}

Error responses

Missing destination URL:

{
  "error": "Missing 'url' parameter"
}

SSRF or DNS validation failure:

{
  "error": "URL resolves to internal/reserved IP range"
}

{
  "error": "Unable to resolve hostname"
}

Timeout after all retry attempts (504):

{
  "error": "Replay Failed",
  "message": "Target destination timed out after 3 attempts (10s timeout per attempt)",
  "code": "ECONNABORTED"
}

Retry and timeout settings

You can tune replay behavior in Actor input:

Setting	Description
`replayMaxRetries`	Number of delivery attempts before marking the replay as failed
`replayTimeoutMs`	Per-attempt timeout in milliseconds. A dead downstream does not hang the actor beyond this value.

When all retry attempts time out, the server returns 504 Gateway Timeout with a machine-readable code field when one is available.

Overview

Endpoints

POST /replay/:webhookId/:itemId — replay events

Path parameters

Query parameters

Example request

Added headers

Stripped headers

Success response

Error responses

Retry and timeout settings

​Path parameters

​Query parameters

​Example request

​Added headers

​Stripped headers

​Success response

​Error responses

​Retry and timeout settings

Path parameters

Query parameters

Example request

Added headers

Stripped headers

Success response

Error responses

Retry and timeout settings