Skip to main content
Webhooks tell your application what happened after an email request was accepted. Use them for delivery state, bounce handling, complaint handling, suppression workflows, engagement signals, and operational reconciliation.

​
Delivery model

Signal sends an HTTPS POST to each enabled endpoint subscribed to the event. The request includes a JSON payload and HMAC signature headers. A 2xx response marks the attempt successful. Network failures and non-2xx responses enter the retry process.
Keep signature verification and durable acceptance in the synchronous request. Move database fan-out, customer notifications, and external calls behind a queue.

​
Security boundary

A parseable JSON body is not proof that Signal sent it. Verify X-Signal-Webhook-Signature over the exact raw bytes using the endpoint secret and use X-Signal-Webhook-Timestamp in the signed content.

​
Reliability boundary

Webhook delivery is at least once from the consumer’s perspective because retries and manual replays can repeat an event. Persist a stable event or delivery identifier and make each side effect idempotent.

Event types

Verify requests

Retries and replays

Manage endpoints