Create Webhook Trigger

CreateWebhookTrigger creates a new webhook trigger POST /api/v1/webhook-triggers User-owned subscriptions. Secret returned only on create/rotate. Events: version,id,type,createdAt,data.messageUuid (+data.identityUuid where available). Verify X-Webhook-Signature t=<unix>,v1=<HMAC-SHA256(timestamp+'.'+rawBody)> with 5-minute timestamp tolerance; deduplicate id. 8 delivery attempts, then dead letter; replay keeps event id. Tests return real HTTP outcome. Key revocation does not delete subscriptions; disabled owners pause delivery. Public HTTPS only; redirects are blocked.

Authentication & compatibility

Use a scoped bearer API key with webhooks:manage. The key is bound to its user and organization.

Mailat application, account or shared resource API. Individual operations can require configured external services; this label is not a runtime-readiness guarantee.

Contract 2026-10-04. Your running instance's /api/v1/openapi.json is authoritative for its deployed release.

Request

Set MAILAT_BASE_URL to your instance origin (without /api/v1) and MAILAT_TOKEN to an appropriate credential. Replace path placeholders and example data before running. These examples do not execute in this page.

curl --request POST "$MAILAT_BASE_URL/api/v1/webhook-triggers" \
  --header "Authorization: Bearer $MAILAT_TOKEN" \
  --header 'Content-Type: application/json' \
  --data @request.json

Build the request from the schema below; request.json and upload paths are local placeholders.

Responses

HTTP statuses and body shapes below come from the pinned contract. Not every shared error applies to every request. Retain the original idempotency key when retrying a send.