API reference
Webhooks
Register endpoints that receive delivery, bounce and complaint events, each signed so you can verify it came from us.
Updated
These endpoints need a full-access key
See the Webhooks guide for the payload shape and how to verify signatures.
Add an endpoint
POST /v1/webhooks
curl -X POST https://api.sendpository.com/v1/webhooks \
-H "Authorization: Bearer $SENDPOSITORY_ADMIN_KEY" \
-H "Content-Type: application/json" \
-d '{
"url": "https://api.yourapp.com/hooks/email",
"description": "Production order service",
"events": ["email.delivered", "email.bounced"]
}'| Field | Type | Required | Notes |
|---|---|---|---|
url | string | Yes | Must be https. |
description | string | No | Up to 200 characters. |
events | string[] | No | Omit or leave empty to receive everything. Event names are listed in the webhooks guide - including email.unsubscribed and email.received. |
{
"id": "b7f2c1a4-...",
"url": "https://api.yourapp.com/hooks/email",
"events": ["email.delivered", "email.bounced"],
"secret": "whsec_9f2a...",
"enabled": true,
"created_at": "2026-08-30T09:00:00.000Z"
}The secret is shown once
Store it - you need it to verify every incoming request.
List endpoints
GET /v1/webhooks
{
"data": [
{
"id": "b7f2c1a4-...",
"url": "https://api.yourapp.com/hooks/email",
"description": "Production order service",
"events": "all",
"enabled": true,
"last_delivery_at": "2026-08-30T09:04:00.000Z",
"last_status_code": 200,
"created_at": "2026-08-30T09:00:00.000Z"
}
],
"limit": 25,
"offset": 0
}events is the literal string "all" when the endpoint subscribes to
everything, otherwise an array.
Delete an endpoint
DELETE /v1/webhooks/{id}
Delivery stops immediately.
{ "id": "b7f2c1a4-...", "deleted": true }