Webhooks API

Cursor-paginated. The signing secret is never included — it is returned once, in the response to the POST that created the endpoint, and cannot be read back afterwards. Endpoints created from the newsletter interface are not listed here.

The response contains secret, and it is the only time it is ever returned. Store it before you do anything else: it is encrypted at rest and no endpoint on this API will return it again. Use it to verify the X-Mailneo-Signature header on every delivery.

The URL is validated at registration and must be publicly resolvable — an address inside a private range, a loopback address or a name that resolves to one is refused here rather than failing silently at delivery time. Subscribing to events that carry contact data (contact.*, event.tracked, suppression.added, unsubscribe.created) additionally requires contacts:read or suppressions:read on the key: a webhook delivers that data to an address you choose, so it may not grant a reach the key does not already have. Event names are validated against the catalog at GET /v2/webhooks/events; ["*"] subscribes to everything live today and is stored as that explicit list, so a later addition to the catalog does not silently change what you receive.

Every event this API can deliver, with the name to put in an endpoint's events array. Discover the list rather than hard-coding it: an event name outside this catalog is rejected at registration, and the catalog grows. The response is complete — has_more is always false and there is no cursor, because the catalog is a small fixed set.

The signing secret is not included and cannot be retrieved. If you have lost it, delete this endpoint and register a new one.

Merge-patch: omitted fields are left alone. events and headers are the exceptions — each REPLACES its stored value wholesale, because a subscription list you can only add to is one you can never leave. Send headers: {} to remove every custom header. A subscription to events that carry contact data — and repointing the url of an endpoint already subscribed to them — additionally requires contacts:read or suppressions:read, because a webhook delivers that data to an address you choose. A changed url is re-validated exactly as it was at registration. Setting active: true on an endpoint the platform switched off also clears its failure counter, so it is not disabled again by the next single failure. The signing secret is neither writable nor returned.

Permanent. Deliveries stop immediately and the endpoint's delivery log is removed with it. Re-registering gives you a NEW signing secret, so a consumer verifying signatures must be updated. Call with ?dry_run=true first if you are not certain. To stop deliveries reversibly, PATCH with active: false instead.

The delivery log for one endpoint, newest first, cursor-paginated. There is no updated_since: the log has no index supporting an incremental poll, and advertising a watermark that cannot be honoured would make a sync client silently miss rows forever. The event payload is not included — fetch the object from its own endpoint using event_id for correlation.

Queues the original payload for re-delivery as a NEW delivery row, so the log shows both attempts. The X-Mailneo-Event-Id header is unchanged, so a consumer that deduplicates on it — the documented contract — correctly treats the replay as the event it already saw. The timestamp and signature are freshly computed: re-sending the original signature would either fall outside the five-minute tolerance or prove that a captured signature stays valid forever. Idempotency-Key is required, because a retried replay that already ran must not deliver twice.