Test Webhook

TestWebhook sends a test event to a webhook POST /api/v1/webhooks/:uuid/test User-owned subscriptions. Secret returned only on create/rotate. Events: version,id,type,createdAt,data.messageUuid (+data.identityUuid where available). Verify X-Webhook-Signature t=<unix>,v1=<HMAC-SHA256(timestamp+'.'+rawBody)> with 5-minute timestamp tolerance; deduplicate id. 8 delivery attempts, then dead letter; replay keeps event id. Tests return real HTTP outcome. Key revocation does not delete subscriptions; disabled owners pause delivery. Public HTTPS only; redirects are blocked.

Authentication & compatibility

Use a scoped bearer API key with webhooks:manage. The key is bound to its user and organization.

Mailat application, account or shared resource API. Individual operations can require configured external services; this label is not a runtime-readiness guarantee.

Contract 2026-10-04. Your running instance's /api/v1/openapi.json is authoritative for its deployed release.

Request

Set MAILAT_BASE_URL to your instance origin (without /api/v1) and MAILAT_TOKEN to an appropriate credential. Replace path placeholders and example data before running. These examples do not execute in this page.

curl --request POST "$MAILAT_BASE_URL/api/v1/webhooks/{uuid}/test" \
  --header "Authorization: Bearer $MAILAT_TOKEN"

Responses

HTTP statuses and body shapes below come from the pinned contract. Not every shared error applies to every request. Retain the original idempotency key when retrying a send.