A valid request URL is required to generate request examples{
"error": {
"code": "invalid_signature",
"message": "signature verification failed"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "email_webhooks_unavailable",
"message": "email delivery webhooks are not available on this server"
}
}Receive a mail delivery event
Where the mail provider reports what happened to a message after it left: delivered, opened, clicked, bounced. You do not call this — the URL is configured once, in the mail provider’s own dashboard.
It is outside /v1 on purpose, the provider-webhook rule: the version prefix is a promise about endpoints you call from your own code, and this URL lives in a setting inside somebody else’s dashboard.
The signature is the only credential. Each delivery is signed (svix scheme) and a request that does not verify is refused with nothing stored. There is no mode in which an unverifiable body is accepted.
Retries are safe and out-of-order delivery is handled. Every event is recorded under the provider’s own delivery id, so a redelivery takes effect exactly once and still answers 202. Timestamps are first-wins — “when did they open it” means the first time — and a bounce outranks a delivery whatever the arrival order.
An event type this server does not model is acknowledged and stored nowhere: a non-2xx would teach the provider to redeliver something we will never want.
What it moves is the tracking on GET /v1/organization/contacts/{id}/messages and the delivery counts on a campaign’s metrics. Without this endpoint configured, those stay unmeasured and say so.
A valid request URL is required to generate request examples{
"error": {
"code": "invalid_signature",
"message": "signature verification failed"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "email_webhooks_unavailable",
"message": "email delivery webhooks are not available on this server"
}
}Corpo
The provider's delivery event, exactly as it was signed. It is read as bytes and never re-serialized — what is verified has to be what arrived.
A Resend delivery event. Its shape is the provider's, not ours.
Resposta
Accepted. A repeat of an event already recorded answers this too, as does an event type this server does not model.