# Create Webhook

> POST /webhooks — create a webhook to receive real-time notifications about email events.

`POST /webhooks`

Creates a webhook. MailBlastr POSTs an event payload to your `endpoint` URL whenever one of the subscribed `events` occurs. The response includes a `signing_secret` — store it and use it to verify the signature on every incoming request. See [Webhooks](https://www.mailblastr.com/docs/webhooks/overview).

**Body parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `endpoint` | string | Yes | The HTTPS URL where webhook events will be sent. |
| `events` | string[] | Yes | Array of event types to subscribe to. See the table below. |
| `secret` | string | No | Optional. Provide your own signing secret (e.g. to mirror a secret across providers). When omitted, MailBlastr mints a fresh `whsec_…` secret. Either way the plaintext is returned once in this response and never again. |

**Event types**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `email.sent` | enum | No | MailBlastr accepted the email and queued it for delivery. |
| `email.delivered` | enum | No | The receiving server accepted the message. |
| `email.delivery_delayed` | enum | No | Delivery was temporarily deferred and MailBlastr is retrying. |
| `email.bounced` | enum | No | The message could not be delivered (hard rejection). |
| `email.complained` | enum | No | The recipient marked the message as spam. |
| `email.opened` | enum | No | The recipient’s mail client loaded the tracking pixel (requires open tracking). |
| `email.clicked` | enum | No | The recipient clicked a tracked link (requires click tracking). |
| `email.failed` | enum | No | The email could not be sent (e.g. invalid recipient, quota reached). |
| `email.scheduled` | enum | No | The email was accepted for future delivery with a `scheduled_at` time. |
| `email.suppressed` | enum | No | The send was skipped because the recipient is on the account suppression list. |
| `email.received` | enum | No | An inbound email arrived at one of your verified receiving domains. |
| `email.replied` | enum | No | A reply to one of your sent emails was detected. |
| `email.unsubscribed` | enum | No | A recipient unsubscribed via an unsubscribe link or header. |
| `contact.created` | enum | No | A contact was created in one of your audiences. |
| `contact.updated` | enum | No | A contact was updated. |
| `contact.deleted` | enum | No | A contact was deleted. |
| `domain.created` | enum | No | A domain was added to your account. |
| `domain.updated` | enum | No | A domain’s settings or verification status changed. |
| `domain.deleted` | enum | No | A domain was removed from your account. |

**Node.js**

```js
import { MailBlastr } from 'mailblastr';

const mb = new MailBlastr('mb_xxxxxxxxx');

const { data, error } = await mb.webhooks.create({
  "endpoint": "https://example.com/handler",
  "events": ["email.sent", "email.delivered"]
});
console.log({ data, error });
```

**Ruby**

```ruby
require "mailblastr"

Mailblastr.api_key = "mb_xxxxxxxxx"

Mailblastr::Webhooks.create({
  "endpoint": "https://example.com/handler",
  "events": [
    "email.sent",
    "email.delivered"
  ]
})
```

**PHP**

```php
$mailblastr = Mailblastr::client('mb_xxxxxxxxx');

$mailblastr->webhooks->create([
  'endpoint' => "https://example.com/handler",
  'events' => [
    "email.sent",
    "email.delivered"
  ]
]);
```

**Python**

```python
import mailblastr

mailblastr.api_key = "mb_xxxxxxxxx"

mailblastr.Webhooks.create({
  "endpoint": "https://example.com/handler",
  "events": [
    "email.sent",
    "email.delivered"
  ]
})
```

**Go**

```go
package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, _ := http.NewRequest("POST", "https://api.mailblastr.com/webhooks", strings.NewReader(`{
  "endpoint": "https://example.com/handler",
  "events": ["email.sent", "email.delivered"]
}`))
    req.Header.Set("Authorization", "Bearer mb_xxxxxxxxx")
    req.Header.Set("Content-Type", "application/json")
    res, _ := http.DefaultClient.Do(req)
    defer res.Body.Close()
    out, _ := io.ReadAll(res.Body)
    fmt.Println(string(out))
}
```

**Rust**

```rust
use reqwest::Client;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let res = Client::new()
        .post("https://api.mailblastr.com/webhooks")
        .header("Authorization", "Bearer mb_xxxxxxxxx")
        .header("Content-Type", "application/json")
        .body(r#"{
  "endpoint": "https://example.com/handler",
  "events": ["email.sent", "email.delivered"]
}"#)
        .send()
        .await?;
    println!("{}", res.text().await?);
    Ok(())
}
```

**Java**

```java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

var client = HttpClient.newHttpClient();
var request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.mailblastr.com/webhooks"))
    .header("Authorization", "Bearer mb_xxxxxxxxx")
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("""
{
  "endpoint": "https://example.com/handler",
  "events": ["email.sent", "email.delivered"]
}
"""))
    .build();
var response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());
```

**.NET**

```csharp
using System.Net.Http;
using System.Text;

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "https://api.mailblastr.com/webhooks");
request.Headers.Add("Authorization", "Bearer mb_xxxxxxxxx");
request.Content = new StringContent(@"{
  ""endpoint"": ""https://example.com/handler"",
  ""events"": [""email.sent"", ""email.delivered""]
}", Encoding.UTF8, "application/json");
var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());
```

**cURL**

```bash
curl -X POST 'https://api.mailblastr.com/webhooks' \
  -H 'Authorization: Bearer mb_xxxxxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
  "endpoint": "https://example.com/handler",
  "events": ["email.sent", "email.delivered"]
}'
```

**CLI**

```bash
mailblastr webhooks create \
  --endpoint 'https://example.com/handler' \
  --events 'email.sent,email.delivered'
```

### Response

```json
{
  "object": "webhook",
  "id": "4dd369bc-aa82-4ff3-97de-514ae3000ee0",
  "signing_secret": "whsec_xxxxxxxxxx"
}
```

> **Warning:** The `signing_secret` is only returned here, at creation. Store it securely — it cannot be retrieved again later.