OpenAI response.completed webhook payload example

OpenAI · event: response.completed · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into OpenAI's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
user-agent: OpenAI/1.0 (+https://platform.openai.com/docs/webhooks)
webhook-id: wh_68b2a91c52b081909a4df1b6c2e8d3f7
webhook-timestamp: 1788500001
webhook-signature: v1,hUVJ8dIAT9HxSecDBlAOrPa2hGe0R3MqGSagFVYgYsI=

Body

{
  "object": "event",
  "id": "evt_68b2a91c4f0e8190a3d5c7b9e1f2a4d6",
  "type": "response.completed",
  "created_at": 1788500000,
  "data": {
    "id": "resp_68b2a8f7d2c48190b1e6a9c3f5d7e9b2"
  }
}

Things that bite people

This example's signature actually verifies: paste the body, the three webhook-* header values, and the secret whsec_SG9va2Rlbk9wZW5BSVNhbXBsZUtleSE= into the signature debugger (Svix / Standard Webhooks scheme). OpenAI uses the Standard Webhooks spec — the exact crypto Svix uses (base64 HMAC-SHA256 over id.timestamp.rawBody, key = the base64-decoded part after whsec_) but under webhook-* header names instead of svix-*. A capture bin verifies these live: pick the Svix scheme — it accepts both header sets.
The payload is a thin pointer, not the result. data contains only the response ID — you must call GET /v1/responses/{id} (with your API key) to fetch the actual output. Webhooks pair with background mode: kick off the long job, get pinged when it's done.
Retry rules (verified vs platform.openai.com/docs/guides/webhooks, 2026-08-30): success = 2xx within "a few seconds"; anything else retries with exponential backoff for up to 72 hours. 3xx redirects are not followed — they count as failures (same rule as GitHub). Duplicates are possible; dedupe on the webhook-id header, not the body's id.
Watch the spelling divergence across event types: it's eval.run.canceled (one l) but batch.cancelled and fine_tuning.job.cancelled (two l's) — an exact-match router that assumes one spelling silently drops the other family.
The signing secret is shown once at endpoint creation (per-project, in the dashboard's webhook settings); lose it and you rotate, there is no reveal.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'user-agent: OpenAI/1.0 (+https://platform.openai.com/docs/webhooks)' \
  -H 'webhook-id: wh_68b2a91c52b081909a4df1b6c2e8d3f7' \
  -H 'webhook-timestamp: 1788500001' \
  -H 'webhook-signature: v1,hUVJ8dIAT9HxSecDBlAOrPa2hGe0R3MqGSagFVYgYsI=' \
 -d '{
  "object": "event",
  "id": "evt_68b2a91c4f0e8190a3d5c7b9e1f2a4d6",
  "type": "response.completed",
  "created_at": 1788500000,
  "data": {
    "id": "resp_68b2a8f7d2c48190b1e6a9c3f5d7e9b2"
  }
}'

← All payload examples · Related guide · Signature debugger · Docs