Anthropic session.status_idled webhook payload example

Anthropic · event: session.status_idled · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

Headers

content-type: application/json
user-agent: Anthropic-Webhooks/1.0
webhook-id: whe_9d5c1f7e2b4a4c8f9e1d3a6b7c0f2e58
webhook-timestamp: 1788511282
webhook-signature: v1,KnQAF2CatbPjq3KO9hBt9E6e7fMDTsgPDENMm3Tc8rE=

Body

{
  "type": "event",
  "id": "whe_9d5c1f7e2b4a4c8f9e1d3a6b7c0f2e58",
  "created_at": "2026-08-30T08:41:22Z",
  "data": {
    "type": "session.status_idled",
    "id": "sesn_01Kw3XvT9pQrN5mBdZcYh7Ae",
    "organization_id": "8a3d2f1e-6c4b-4d9a-b7e0-1f5c8a2d9e3b",
    "workspace_id": "c7b0e4d9-2a1f-4b8c-9d6e-3f0a5b8c1d4e"
  }
}

Things that bite people

• This example's signature actually verifies: paste the body, the three webhook-* header values, and the secret whsec_SG9va2RlbkFudGhyb3BpY1NhbXBsZUtleSEhIQ== into the signature debugger (Svix / Standard Webhooks scheme). Anthropic uses the same wire format as OpenAI and Svix — base64 HMAC-SHA256 over id.timestamp.rawBody, key = the base64-decoded part after whsec_, headers webhook-id / webhook-timestamp / webhook-signature. A capture bin verifies these live: pick the Svix scheme — it accepts both header sets. The SDK's unwrap() helper does the same check plus a 5-minute freshness window.
• The payload is a thin pointer, not the object. data carries only the event type and resource ID — you fetch the session with a GET call. Anthropic's docs are explicit about why: retries never deliver stale state, and payloads stay small.
• Webhooks are not a durable log. Delivery rules (verified vs platform.claude.com/docs/en/managed-agents/webhooks, 2026-08-30): up to 3 attempts per event with jittered exponential backoff between 5 and 120 seconds — then the event is dropped, with no signal that it was lost and no backfill. If you must observe every transition, reconcile by listing the resource through the API.
• A 3xx disables your endpoint immediately — on the first attempt, with reason auto-disabled: endpoint URL returned a redirect (3xx). Redirects are never followed (GitHub just fails the delivery; Anthropic switches the endpoint off). Same instant-disable if the URL resolves to a non-public IP. Sustained failures also disable — but that trigger is time-based, not count-based, and a single 2xx resets the window.
• Retries pass the freshness check on purpose: webhook-timestamp is re-stamped when each delivery attempt is signed, so a retry is never rejected as stale. It's the clock of the attempt; the event's own time is the body's created_at. Dedupe on the top-level id (same value as the webhook-id header, stable across retries).
• Ordering is not guaranteed, and an event emitted while no endpoint is subscribed to its type is never delivered — subscribing later does not backfill. The signing secret (32-byte, whsec_-prefixed) is shown once at endpoint creation. URL must be HTTPS on port 443.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'user-agent: Anthropic-Webhooks/1.0' \
  -H 'webhook-id: whe_9d5c1f7e2b4a4c8f9e1d3a6b7c0f2e58' \
  -H 'webhook-timestamp: 1788511282' \
  -H 'webhook-signature: v1,KnQAF2CatbPjq3KO9hBt9E6e7fMDTsgPDENMm3Tc8rE=' \
 -d '{
  "type": "event",
  "id": "whe_9d5c1f7e2b4a4c8f9e1d3a6b7c0f2e58",
  "created_at": "2026-08-30T08:41:22Z",
  "data": {
    "type": "session.status_idled",
    "id": "sesn_01Kw3XvT9pQrN5mBdZcYh7Ae",
    "organization_id": "8a3d2f1e-6c4b-4d9a-b7e0-1f5c8a2d9e3b",
    "workspace_id": "c7b0e4d9-2a1f-4b8c-9d6e-3f0a5b8c1d4e"
  }
}'

← All payload examples · Signature debugger · Docs