Webhooks

Webhooks send in Test and Live mode, for every event type in the list.

The endpoint

• Save one HTTPS endpoint per mode in Dashboard → Developers. Reeds checks the URL when you save it and again on every send: it must use a host name (not an IP address, localhost or an internal name) that resolves only to public addresses, and each send goes to the address Reeds checked. Redirects are never followed.
• The signing secret (whsec_test_... or whsec_live_...) is shown in the dashboard. Rotating it keeps the old secret signing for 24 hours: each event then carries two v1 values in Reeds-Signature, so a receiver holding either secret verifies. Rotating again within the 24 hours drops the oldest secret.

Sending and retries

• Every event is a POST with Reeds-Event-Id, Reeds-Event-Type and Reeds-Signature, signed afresh on each attempt. Reply 2xx within 10 seconds.
• A failed attempt (an error status, a redirect, a timeout, a connection or TLS failure) is retried 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours and 24 hours after the previous attempt, each with up to 15 seconds of jitter. After the 8th attempt the event is failed.
• An endpoint that keeps failing for 3 days is disabled: waiting events are marked failed, and the account's Owners, Admins and Developers are emailed. Save its URL again to turn it back on.

The event log and test events

• The dashboard's event log shows every event, its attempts and your server's answers for 30 days. Resend makes one more attempt at once, without changing the retry schedule, even while the endpoint is disabled.
• POST /webhooks/test takes an optional type (any event type; delivery.status_changed by default) and answers { event_id, type, sent }. A test event is sent once and never retried. No endpoint for the mode, or an unknown type, is 422 INVALID_REQUEST.

Nothing is removed or renamed. Clients that ignore unknown fields and event types need no change.