Delivery headers

Every delivery carries these headers, in all authentication modes and on every automatic retry:

Header	Sent	Value
`Content-Type`	Always	`application/json`
`x-thrive-event-type`	Always	The `eventType` field of the body, for example `content.completed`
`x-thrive-tenant-id`	Always	The `tenantId` field of the body
`x-thrive-message-id`	Always	The id of the source message. An automatic retry of a failed delivery repeats the same id
`x-hmac-signature`	When a secret is configured	`sha256=<hex>`, an HMAC-SHA256 of the raw JSON body
`Authorization`	When OAuth 2.0 is configured	`Bearer <access_token>`

Use the x-thrive-* headers to route or discard an event before you parse the body, and x-thrive-message-id to detect a retried delivery. The HMAC signature covers the body only; the headers are not signed.

Recovering missed deliveries

Stored outbound webhook events can be retrieved with Query stored outbound webhook events GET /rest/v2/webhook-events). Each result's messageId is the same value as the x-thrive-message-id header on the delivered request, so you can match stored events to the requests your endpoint received or missed.