Skip to main content
Vibefollow can push events back to your backend over HTTPS — one delivery per email open, click, bounce, reply, and unsubscribe. You receive them at an endpoint you control, verify the signature, and react however you like (update your CRM, kick off a workflow, alert on negative replies).

​
Lifecycle of a delivery

1

A receivable event happens

Postmark reports an open back to Vibefollow, an inbound reply comes through, or a user clicks the one-click unsubscribe link.
2

Vibefollow signs the payload

Body bytes are HMAC-SHA256’d with your project’s webhook secret; the timestamp goes in the header.
3

POST to your endpoint

Content-Type: application/json, X-Vibefollow-Signature: t=…,v1=….
4

You verify and respond

Return 2xx within 10 seconds and the delivery is marked complete.
5

On non-2xx or timeout

Vibefollow retries with exponential backoff — up to 6 attempts over ~24 hours. After that the delivery is dead-lettered and visible in the dashboard.

​
Setting up an endpoint

1

Expose an HTTPS endpoint

Accept POST with JSON bodies. Make sure your framework can hand you the raw request body, not a parsed object.
2

Register the URL

In Settings → Developers → Webhooks, add the URL and generate a signing secret. Store the secret as VIBEFOLLOW_WEBHOOK_SECRET.
3

Verify every delivery

Use the SDK — see Signature verification.
4

Subscribe to event types

Switch on the event types you care about.

​
Retry policy

Failed deliveries (non-2xx, timeout, connection error) retry on a fixed back-off schedule. Total budget is 6 attempts: 1 initial dispatch plus 5 retries.
AttemptDelay since previous
1initial
21 minute
35 minutes
430 minutes
52 hours
612 hours
After 6 attempts the delivery is marked failed. You can manually re-queue it from the in-dashboard deliveries log.

​
Why the raw body

The signature is computed over the exact bytes the server sent. If you parse the body first and re-serialise — key ordering, whitespace, escaped slashes — verification will fail. Use your framework’s raw-body mechanism (express.raw(), Hono request.text(), etc.) before the SDK touches it.

​
What events you can receive

email.opened

Recipient opened a tracked email.

email.clicked

Recipient clicked a link in a tracked email.

email.bounced

Postmark reported a bounce or spam complaint.

email.replied

Inbound reply parsed and tone-classified.

email.unsubscribed

One-click unsubscribe, reply-request, or manual.

Event types reference

Full payload spec for each event type.