Deliveries, bounces, opens and clicks reach your endpoint seconds after they happen. Every request is signed, retried when you do not answer, and kept so you can send it again.
POSThttps://api.northwind.dev/webhooks/rasket
{
"type": "email.delivered",
"created_at": "2026-09-28T10:04:13.207Z",
"data": {
"email_id": "4ef9a417-02e9-4d39-…",
"from": "receipts@mail.northwind.dev",
"to": ["maya@example.com"],
"subject": "Your receipt for order #2041"
}
}Response200 - OK142 ms
What happened to a message you sent, from the moment it is accepted, and mail that arrived at one of your receiving addresses.
A sending domain added, changed or removed.
A contact created, changed or erased through the API. An import sends none of these.
An address added to your suppression list, or taken off it.
A run enrolled a contact, reached the end, or ended without finishing.
Webhook
https://api.northwind.dev/webhooks/rasket
Events
email.delivered
ReplayAttempts
timeout
Delay before each attempt
After the tenth attempt, about sixteen hours after the first, the event is marked Failed. The payload we signed and every attempt stay readable, on the dashboard and through the API, until you replay it.
Ten seconds to answer.
Anything that is not a 2xx within ten seconds is a failed attempt: a timeout, a refused connection, a DNS or TLS error, or a redirect, which we never follow.
Replay the exact bytes.
Fix your handler, then press Replay on the dashboard or call the API. A replay carries the identical payload under the same event id, so a handler that dedupes ignores it.
Switched off, not lost.
An endpoint with no successful delivery for five days is turned off and your admins are emailed. Its events are still recorded, ready to deliver when you enable it again.
$ npm install sviximport { Webhook } from "svix";
const wh = new Webhook(process.env.RASKET_WEBHOOK_SECRET);
export async function POST(request: Request) { const rawBody = await request.text(); // text(), never json()
try { const event = wh.verify( rawBody, Object.fromEntries(request.headers), ); await handle(event); return new Response(null, { status: 200 }); } catch { return new Response("invalid signature", { status: 400 }); }}No. The scheme is HMAC-SHA256 over the event id, the timestamp and the raw body, and it is compatible with the Svix libraries, so the official Python, Go, Ruby and PHP ones verify our deliveries as they are. That includes Node and TypeScript, where npm install svix gives you new Webhook(secret).verify(rawBody, headers) today; our own zero-dependency verifier follows when it is published.
No. A delivered event can arrive before the sent event that logically precedes it. Key your handler on the email id, the type and the event's own created_at rather than on the order things turn up in.
Yes, and a handler has to expect it. Dedupe on the svix-id header: it is stable for the life of an event and does not change when the event is retried or replayed.
Anything that is not a 2xx within ten seconds counts as a failure and is retried. Store the event, answer 2xx, and do the work afterwards. A redirect is a failure too, because we never follow one.
Yes. Every event keeps the exact payload we signed, along with every attempt we made, the status code that came back and the first 8 KB of your response. Both are readable on the dashboard and through the API.