Replay and recover - Securitize Developers

Every webhook Securitize sent to your account’s endpoint stays readable for 90 days, exactly as it was sent, and the deliveries that failed can be resent on request. That covers every API your account uses: corporate action events, KYC events and any family added later. Together with each API’s state queries, that is everything you need after an outage, for an audit, or to backfill a new consumer.

GET  https://partners-api.sandbox.securitize.io/webhooks/v1/events               the webhooks sent to you, newest first, paged
GET  https://partners-api.sandbox.securitize.io/webhooks/v1/events/{eventId}     one webhook, as it was sent
POST https://partners-api.sandbox.securitize.io/webhooks/v1/events/recover       resend the deliveries that failed in a window

These three live at their own base URL, https://partners-api.sandbox.securitize.io/webhooks/v1, apart from any one API’s, because they cover every webhook Securitize sends to your endpoint. The list carries the events of every API your account uses (ca.* from the Corporate Actions API, investor.kyc.updated from the SecId API), and eventTypes is how you keep only one of them. They take the same bearer token as the API you integrate, obtained with your client credentials (SecId API, Corporate Actions API). The examples use $EVENTS for the base URL.

List the events

curl "$EVENTS/events?limit=50&since=2026-10-19T22:00:00.000Z&eventTypes=ca.action.created,ca.action.completed" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

{
  "data": [
    {
      "eventId": "evt_01K7Q3ZVC1J3K5M7P9R1T3V5X7",
      "eventType": "ca.action.created",
      "timestamp": "2026-10-20T13:50:24.880Z",
      "payload": { "schemaVersion": "1.0", "sourceEventId": "evt_01K7Q3ZVC1J3K5M7P9R1T3V5X7", "eventType": "ca.action.created", "...": "the envelope, as delivered" }
    }
  ],
  "iterator": "msg_3KvZFnAAFjJN9N2HX80yKjeYFgk",
  "done": false
}

Newest first. The first page is the most recent events; iterator leads to older ones. Pass it back as iterator until done is true.
eventId is the sourceEventId of the envelope, the key you deduplicate on. It is not the svix-id header of the delivery, which is the message id.
payload is the body your endpoint received, byte for byte the same object. Feed it to the same handler.
since keeps events sent after that instant. eventTypes keeps some types, repeated or comma-separated, of any family; a request naming only types Securitize does not publish answers 400 EVENT_TYPES_NOT_ALLOWED, with the valid names in message.
Every API, unless you filter. Without eventTypes the list carries everything your endpoint receives. To read only corporate actions, pass the eleven ca.* types; to read only KYC, pass investor.kyc.updated; to read only suitability, pass investor.suitability.updated and investor.dlt_test.updated.
No tokenId filter. Filter on payload.stream.id on your side.
The list is newest first and nothing more: apply what you read with the same rules as the webhooks, by payload.stream.id and payload.sequence for corporate actions, by occurredAt per investor for KYC, and per investor and event type for suitability.

Fetch one event

curl "$EVENTS/events/evt_01K7Q3ZVC1J3K5M7P9R1T3V5X7" -H "Authorization: Bearer $ACCESS_TOKEN"

The same item as in the list, whatever family the event belongs to. 404 WEBHOOK_EVENT_NOT_FOUND when the id is unknown, belongs to another account or is older than 90 days.

Resend failed deliveries

curl -X POST "$EVENTS/events/recover" \
  -H "Authorization: Bearer $ACCESS_TOKEN" -H "content-type: application/json" \
  -d '{ "since": "2026-10-19T22:00:00.000Z", "until": "2026-10-20T06:30:00.000Z" }'

{ "taskId": "qtask_3KvZIWNVT1RLlYWOegtyIBJkLKM", "status": "running" }

Only deliveries that failed are resent, of every family your endpoint receives, each with its original body and svix-id, so your deduplication on sourceEventId applies. A window in which everything was delivered resends nothing, and the 202 is still the answer.
since is at most 90 days ago and not in the future; until is optional and must follow since. Outside that: 400 INVALID_RECOVER_WINDOW.
It is asynchronous: the resends arrive at your endpoint over the following minutes.
It is rate limited: a 429 means wait and call again.
404 WEBHOOK_ENDPOINT_NOT_FOUND means no endpoint is registered for your account yet.

After an outage

Resend: POST /events/recover with since at the start of the outage. Your endpoint receives what failed, with the original ids.
Or read: page GET /events?since=<start of the outage> and feed each payload to your handler. Use this when the endpoint was up but your consumer was not, since those deliveries succeeded and are not resent.
Then check state for anything you act on: for corporate actions, GET /tokens/{tokenId}/status for every token you list and GET /corporate-actions/{sourceCaId} for the ones in flight; for KYC, GET /investors/{externalInvestorId} of the SecId API. The state queries are the source of truth for the present; the events are the history.

Both paths are safe to run together and to run twice: deduplication on sourceEventId and applying by version make the result the same.

Older than 90 days, or a full rebuild

The event history is 90 days. For anything older, and to build a consumer from nothing, read the state. For the Corporate Actions API:

What	Call
Your tokens, with their assets	`GET /tokens`, `GET /assets`
Each token’s status and the restrictions in force	`GET /tokens/{tokenId}/status`
Every corporate action on a token, latest version	`GET /tokens/{tokenId}/corporate-actions`
Any past version of a corporate action	`GET /corporate-actions/{sourceCaId}/versions/{version}`

For the SecId API, GET /investors/{externalInvestorId} answers the current status of each investor. Then subscribe to webhooks, or start paging the event list from that moment.