Overview

Rewrite sends webhook deliveries as HTTPS POST requests with a JSON body. Current public event families are:

Registering a webhook

You can create webhooks in the dashboard or through POST /webhooks. Example create request:

curl -X POST "https://api.rewritetoday.com/v1/webhooks" \
  -H "Authorization: Bearer rw_..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Delivery events",
    "endpoint": "https://example.com/webhooks/rewrite",
    "events": ["message.sent", "message.failed", "sms.otp"],
    "delivery": {
      "timeout": 3000,
      "retries": 2
    }
  }'

Delivery request shape

Rewrite currently sends:

Content-Type: application/json
User-Agent: rewrite-webhooks/1.0
svix-id
svix-timestamp
svix-signature

Example payload:

{
  "id": "748395130237498900",
  "createdAt": "2026-03-19T18:42:11.000Z",
  "sandbox": false,
  "type": "message.sent",
  "data": {
    "id": "748395130237498500",
    "projectId": "748395130237498412",
    "sandbox": false,
    "contact": "Fernanda",
    "contactId": "748395130237498515",
    "to": "+5511999999999",
    "tags": {
      "use_case": "otp_login"
    },
    "type": "SMS",
    "status": "SENT",
    "content": "Rewrite: your verification code is 123456",
    "country": "br",
    "analysis": {
      "characters": 41,
      "encoding": "gsm7",
      "segments": {
        "concat": 153,
        "count": 1,
        "reason": "fits",
        "single": 160
      }
    },
    "error": null,
    "deliveredAt": null,
    "scheduledAt": null,
    "templateId": null
  }
}

data.contact and data.contactId are always present. They become null when the original send did not target a saved contact.
sandbox on the event envelope indicates the originating project mode.
data.sandbox repeats that signal inside message payloads.
Webhook resource reads return retries and timeout at the top level, while create/update requests accept them inside delivery.

Signature validation

Validate webhook signatures before trusting the body. Important implementation details:

Use the raw request body.
Read svix-id, svix-timestamp, and svix-signature from headers.
Verify against the webhook secret returned by POST /webhooks or GET /webhooks/{id}.

For the full verification flow, canonical signed string, and a Node example, see Signature.

Handler guidance

Return any 2xx response quickly.
Process heavy work asynchronously.
Deduplicate by webhook event id.
Persist the raw payload for debugging and replays.

Reference

Events

Introduction

Overview

Registering a webhook

Delivery request shape

Signature validation

Handler guidance

​Overview

​Registering a webhook

​Delivery request shape

​Signature validation

​Handler guidance

​Related pages

Overview

Registering a webhook

Delivery request shape

Signature validation

Handler guidance

Related pages