WEBHOOK

Real-time event stream.

We POST to your own endpoint for every email event. Signature verification, smart retry, ordering guarantee.

Event types

  • message.sent Message queued.
  • message.delivered Message delivered to the recipient.
  • message.opened Recipient opened the message.
  • message.clicked Recipient clicked a link in the message.
  • message.bounced Message bounced (hard/soft bounce).
  • message.complained Recipient filed a spam complaint.
  • message.unsubscribed Recipient left the list.

Example payload

{
  "id": "evt_01h5z...",
  "type": "message.delivered",
  "created_at": "2026-05-13T14:30:00Z",
  "data": {
    "message_id": "msg_01h5z...",
    "to": "[email protected]",
    "from": "[email protected]",
    "subject": "Welcome"
  },
  "signature": "v1,abc123..."
}

Signature verification

Every POST carries an X-SendNomi-Signature header. HMAC-SHA256, signed with the body + timestamp. Verify the signature with a constant-time comparison (crypto.timingSafeEqual).

Retry strategy

Exponential backoff until a 2xx is received: 5s → 30s → 5m → 30m → 2h → 6h → 12h (8 attempts total · 25 hours). A 4xx is treated as a permanent error; no retry. 5xx and timeouts are subject to retry.