Managing webhooks

Webhooks are the durable, at-least-once path for delivery events: SendSignal POSTs a JSON payload to your endpoint for every subscribed event.

Create an endpoint

curl https://api.sendsignal.dev/webhooks \
  -H "Authorization: Bearer ss_..." -H "Content-Type: application/json" \
  -d '{
    "endpoint": "https://api.acme.com/hooks/sendsignal",
    "events": ["email.delivered", "email.bounced", "email.complained"]
  }'

endpoint must be an absolute http(s) URL; events is any subset of the event types. The response includes your signing secret (whsec_ + 48 hex characters); it is returned only on create, so store it immediately and use it to verify requests.

Operate

• GET /webhooks / GET /webhooks/{id}: list and inspect (the secret is never re-shown).
• PATCH /webhooks/{id}: change endpoint or events, or set enabled: false to pause deliveries without deleting.
• DELETE /webhooks/{id}: remove.

Receiving deliveries

Requests arrive with Content-Type: application/json and User-Agent: SendSignal-Webhooks/1.0. Respond with any 2xx quickly; do real work async. A non-2xx response or timeout counts as a failure and is retried.

Every payload is an envelope with the event type, timestamp, and event-specific data:

{
  "type": "email.delivered",
  "created_at": "2026-08-20T12:34:56Z",
  "data": { "email_id": "9b2d…", "...": "…" }
}