email.delivered,
contact.updated, or broadcast.sent.
Common envelope
Webhook deliveries use the canonical versioned event envelope:version is currently "1". object_type is fixed by the event type, and all
currently subscribable events require an object_id. The data object contains
the resource-specific event payload.
Treat unknown fields and future event types as forward-compatible additions. Do
not fail an entire endpoint because it receives data your application does not
use.
Subscribing to events
A webhook endpoint must subscribe to at least one supported event. Empty values and duplicate event names are removed during validation. An unsupported event name causes the endpoint create or update request to fail with400 Bad Request.
webhook.test is not a subscribable event. It is generated only when you test a
specific endpoint.
SMS events
Email events
Email event payloads may include recipient-level state and provider diagnostics.
Engagement and subscription events do not imply a delivery-state transition.
Contact events
Suppression events
Broadcast events
Test events
Sending a test from an endpoint creates awebhook.test event targeted only to
that endpoint. It uses the canonical envelope with object_type set to
webhook_endpoint, but it cannot be included in subscribed_events.
Delivery headers and signature
Each request includes:X-Dugble-Event: event typeX-Dugble-Event-Id: stable event UUIDX-Dugble-Delivery-Id: UUID for this endpoint deliveryX-Dugble-Signature: timestamped HMAC signature
t=<unix_timestamp>,v1=<hex_digest>. Compute the
expected digest with HMAC-SHA256, using the endpoint signing secret as the key
and <unix_timestamp>.<raw_request_body> as the signed bytes. Compare digests
with a constant-time function and reject timestamps outside your tolerance.
Signature verification
Follow the complete signing contract and verification examples.
Idempotent handling
Your endpoint should:- Verify the webhook signature against the raw request body.
- Store the event ID with a unique constraint.
- Acknowledge duplicate IDs without repeating side effects.
- Queue application work and respond quickly.
- Log unknown event types rather than returning an error.