Webhooks

Webhooks deliver real-time notifications to your server when delivery events occur. Sendbound sends an HTTP POST to your endpoint for each event.

Webhook object

{
  "id": "wh_01HV...",
  "url": "https://yourapp.com/hooks/sendbound",
  "events": ["email.delivered", "email.bounced"],
  "active": true,
  "createdAt": "2026-01-20T09:00:00Z"
}

Event types

Event	Trigger
`email.delivered`	Email accepted by recipient server
`email.opened`	Recipient opened the email
`email.clicked`	Recipient clicked a tracked link
`email.bounced`	Permanent delivery failure
`email.spam`	Recipient marked as spam
`contact.created`	New contact added
`contact.unsubscribed`	Contact unsubscribed

Webhook payload

{
  "event": "email.delivered",
  "timestamp": "2026-04-15T10:30:00Z",
  "data": {
    "emailId": "em_01HV3K...",
    "to": "jane@example.com",
    "subject": "Your order has shipped"
  }
}

Every request includes an X-Sendbound-Signature HMAC-SHA256 header. Verify it with your webhook secret before processing the event.

List webhooks

GET/webhooks

Bearer Token

Bearer

Base URL

curl -X GET 'https://api.sendbound.com/webhooks' \
  -H 'Authorization: Bearer <your-token>' \
  -H 'Content-Type: application/json'

Create a webhook

POST/webhooks

Bearer Token

Bearer

Base URL

Request Body

curl -X POST 'https://api.sendbound.com/webhooks' \
  -H 'Authorization: Bearer <your-token>' \
  -H 'Content-Type: application/json' \
  -d '{
"url": "https://yourapp.com/hooks/sendbound",
"events": ["email.delivered", "email.bounced", "email.opened"]
}'

Field	Type	Required	Description
`url`	string	Yes	Your HTTPS endpoint URL
`events`	string[]	Yes	Event types to subscribe to

Get a webhook

GET/webhooks/:id

Bearer Token

Bearer

Base URL

Path Parameters

:id

curl -X GET 'https://api.sendbound.com/webhooks/:id' \
  -H 'Authorization: Bearer <your-token>' \
  -H 'Content-Type: application/json'

Update a webhook

PUT/webhooks/:id

Bearer Token

Bearer

Base URL

Path Parameters

:id

Request Body

curl -X PUT 'https://api.sendbound.com/webhooks/:id' \
  -H 'Authorization: Bearer <your-token>' \
  -H 'Content-Type: application/json' \
  -d '{
"url": "https://yourapp.com/hooks/sendbound-v2",
"events": ["email.delivered", "email.bounced", "email.opened", "email.clicked"]
}'

Delete a webhook

DELETE/webhooks/:id

Bearer Token

Bearer

Base URL

Path Parameters

:id

curl -X DELETE 'https://api.sendbound.com/webhooks/:id' \
  -H 'Authorization: Bearer <your-token>' \
  -H 'Content-Type: application/json'

Returns 204 No Content.

Verifying signatures

import crypto from 'crypto';

function verifyWebhook(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  );
}

On this page