Source
Message logs, events & webhooks — found from sitemap — Elastic Email API
Checked for Elastic Email API on 1 Nov 2026
- Page
- http://help.elasticemail.com/en/articles/17578018-webhook-request-signing-and-json-delivery
- Checked
- 1 Nov 2026, 09:34 UTC
- How we may use it
- Public page, crawling permitted
Technical details
- type
- page
- http status
- 200
- content hash
- sha256:afe9695ad7b822e2f53f3fd1bc3e1a3fc5f18ab5ffea910ffd3ca1fcad916cb0
- permission
- robots_ok
- screenshot
- Screenshot on file (internal exhibit, not published)
Cited by
Facts read from this source
-
Webhook signing plan requirement Report an error
“Please note that this feature is available only on PRO plans.”
-
Webhook signing algorithm Report an error
“Request signing. Every request Elastic Email sends to your endpoint carries an HMAC-SHA256 signature.”
-
Webhook post json delivery Report an error
“POST and JSON delivery. Events are sent as a POST request with a JSON body, instead of a GET request with the event in the query string.”
-
Webhook settings immutable after creation Report an error
“Both options are set only when you create a webhook, and cannot be changed afterwards.”
-
Webhook signing secret shown once Report an error
“It is shown only once: in your dashboard right after the webhook is created, and in the API response that creates the webhook. Elastic Email never shows it again.”
-
Webhook signing secret prefix Report an error
“The secret starts with whsec_.”
-
Webhook secret rotation Report an error
“Through the API, call POST /v4/webhook/{id}/secret/rotate. For a webhook that was not created with signing, the call returns a 400 response.”
-
Webhook retry duration Report an error
“Requests your endpoint rejects with 401 while it still has the old secret are retried for up to 24 hours, and every retry is signed with the current secret.”
-
Webhook timestamp tolerance Report an error
“Reject the request if it is more than 5 minutes away from your server's clock, and keep that clock synchronized with NTP, because a clock that is off makes valid requests look stale. This also limits replays to a 5-minute window.”
-
Webhook URL https requirement Report an error
“Enter the webhook name, the URL of your endpoint, which should be an https:// URL, and the events you want to receive.”
-
Webhook no redirect following Report an error
“Signed webhooks and webhooks that use POST do not follow redirects, so the URL you enter has to be the final one. A 3xx answer counts as a failed delivery.”
-
Webhook API delivery method field Report an error
“DeliveryMethod is either Get, which is the default, or PostJson. Any other value is rejected with a 400 response.”
-
Webhook test request accepts 401 403 on creation Report an error
“When a signed webhook is created, 401 and 403 are accepted as well. Your endpoint cannot know the new secret yet, so an endpoint that verifies signatures correctly will reject this first request.”
-
Webhook API secret not returned after creation Report an error
“When you read the webhook later, SigningEnabled and DeliveryMethod are returned as set, and SigningSecret is always null.”
-
Webhook one per URL Report an error
“An account cannot have two webhooks with the same URL, and only one webhook per URL receives events.”
-
Availability Report an error
“If you need any further assistance, feel free to reach out to our Customer Support Team, available 24/7.”
1 fact read from this page is not shown because it could not be confirmed on the page as captured.
Scores citing this record
- The Agency Lead Message logs, events & webhooks
- The Data Protection Officer Message logs, events & webhooks
- The Shop Operator Message logs, events & webhooks
- The Platform Engineer Message logs, events & webhooks
- The SaaS Developer Message logs, events & webhooks
- The Skeptic Message logs, events & webhooks