Webhooks

Delivery event

{
  "type": "email.delivered",
  "created_at": "2026-07-31T18:42:11Z",
  "data": { "email_id": "msg_01", "domain": "example.com" }
}

Operate safely

• Choose events per endpoint.
• Verify the signing secret before processing.
• Return a 2xx response only after accepting the event.
• Inspect attempts and retry failures.
• Rotate secrets without replacing the Runtime.

Create an endpoint

Open Webhooks, add a public HTTPS endpoint and select only the events the consumer handles. Copy the signing secret once and store it in the receiver’s secrets. Use Test and confirm a 2xx response before relying on production events.

Verify the signature against the raw request bytes before JSON parsing, reject stale timestamps if your integration supports them, and make processing idempotent by delivery/event ID. Return 2xx only after the event is durably accepted; slow downstream work belongs in your own queue.

Failures, replay and rotation

The Runtime records delivery attempts, status and response diagnostics. Correct DNS/TLS, timeout or receiver errors, then replay the failed delivery rather than fabricating an event. Rotating creates a new secret; update the receiver before retiring the old credential. Delete an endpoint only after confirming no required event flow still targets it.