
CesarS.08281 (Customer) asked a question.
Hi,
When an Okta webhook event fails to be delivered, I see that Okta adds the tag event_hook.delivery.
I use the API filter eventType eq 'event_hook.delivery' to fetch failed events. Is this the correct way to retrieve their full details, or should I first get their IDs and make a second request to fetch their complete data?
Thanks for your help!

Hello @CesarS.08281 (Customer) , thank you for contacting Okta Support.
I've brought your question to the attention of our extended team.
When you make a GET request on
{{url}}/API/v1/logs?filter=eventType eq "event_hook.delivery"
you receive a list with all the logs that meet that criteria and all the information on each event. You don't need to get each request ID and send a second request. By default, the first 100 System Log events are returned. You may need to use the next link in the response to scroll to the next page of results.
You can read more about System Logs in this article from our Developer library:
System Log
Regards.
--
The new Okta Help Center YouTube channel is your go-to resource for tips, troubleshooting, and best practice videos. Subscribe today
Thank you for the detailed explanation! This confirms that I have been following the correct approach.
I have already implemented the process where I retrieve the failed events using the API with:
{{url}}/API/v1/logs?filter=eventType eq "event_hook.delivery"
Additionally, I am handling pagination by following the
next
link in the response to ensure that I capture all relevant events.
I appreciate the clarification—it’s great to have confirmation that this is the right way to retrieve and process failed webhook deliveries. Thanks again for the help!
Best regards,
César Santana
Hi,
I have a question regarding the eventType field.
In a regular event that has not gone through the API retrieval process using the "event_hook.delivery" filter, the eventType field carries the original value of the event, such as "user.lifecycle.suspend".
However, for events retrieved via the API using the "event_hook.delivery" filter, do all of them have eventType set to "event_hook.delivery"? If so, is there a way to retrieve the original eventType value for these events?
Thanks in advance for the clarification!
Hello @CesarS.08281 (Customer) , the event types should be the same regardless of whether they are retrieved via API or the System Log in the Admin Portal. You can read more about event types in this article from our Developer colleagues:
Event Types
Regards.
--
The new Okta Help Center YouTube channel is your go-to resource for tips, troubleshooting, and best practice videos. Subscribe today