Webhooks

Subscribe an HTTPS endpoint to email and contact lifecycle events. Payloads are signed with HMAC-SHA256.

Create a webhook

The `url` must be a public HTTPS address — private, loopback and internal hosts are rejected, and deliveries never follow redirects, so answer with a `2xx` directly. The signing `secret` is returned only in this response: store it and verify each delivery's `X-Sendkit-Signature` header (`t=<timestamp>,v1=<hex HMAC-SHA256 of "<timestamp>.<raw body>">`).

POST

/webhooks

Authorizations

Authorization

string

header

required

API key for your workspace, scoped to webhooks:manage. Pass it as a Bearer token in the Authorization header.

Body · application/json

url

string

events

string[]

Create a webhook

curl https://api.mailcraft.host/v1/webhooks \
  -X POST \
  -H 'Authorization: Bearer sk_live_...' \
  -H 'Content-Type: application/json' \
  -d '{
    "url": "https://yourapp.com/webhooks/mailcraft",
    "events": ["email.delivered", "email.bounced", "email.complained"]
  }'

{
  "data": {
    "id": 2,
    "url": "https://yourapp.com/webhooks/mailcraft",
    "description": null,
    "events": ["email.delivered", "email.bounced", "email.complained"],
    "is_active": true,
    "secret": "whsec_5f8c...a91",
    "created_at": "2026-09-22T14:26:00.000000Z"
  }
}

List webhooks

GET

/webhooks

Authorizations

Authorization

string

header

required

API key for your workspace, scoped to webhooks:manage. Pass it as a Bearer token in the Authorization header.

List webhooks

curl https://api.mailcraft.host/v1/webhooks \
  -H 'Authorization: Bearer sk_live_...'

{
  "data": [
    {
      "id": 2,
      "url": "https://yourapp.com/webhooks/mailcraft",
      "events": ["email.delivered", "email.bounced", "email.complained"],
      "is_active": true
    }
  ]
}

Delete a webhook

DELETE

/webhooks/{webhook}

Authorizations

Authorization

string

header

required

API key for your workspace, scoped to webhooks:manage. Pass it as a Bearer token in the Authorization header.

Delete a webhook

curl https://api.mailcraft.host/v1/webhooks/2 \
  -X DELETE \
  -H 'Authorization: Bearer sk_live_...'

(empty body)