Webhooks: react to email events

A webhook is an HTTPS address in your app that CARIO Mail calls when something happens.

Events

email.accepted, email.delivered, email.bounced, email.complained, email.failed, email.opened, email.clicked, email.unsubscribed.

Verify every request

Each call carries webhook-id, webhook-timestamp and webhook-signature. Compute HMAC-SHA256 over id.timestamp.body with your signing secret and compare. Reject anything older than 5 minutes.

Reliability

• Reply with any 2xx within 10 seconds; do slow work in the background.
• Failed deliveries are retried with backoff. You can replay any delivery from the dashboard.
• Handle duplicates: use webhook-id to ignore repeats.