HookGet Open dashboard

Postmark → HookGet

Postmark calls HookGet; the request is verified at the door and becomes normalised events on the same pipeline as everything else you deliver.

In short

  • Delivery, bounce, spam complaint, open, click and subscription-change webhooks become email.* events.
  • Verified by a shared token — header, bearer or basic auth, whichever Postmark is configured to send.
  • Two opens of the same message are two events; a redelivery of the same one collapses.
  • Bounce type and code become attributes you can filter and alert on.

What it produces

Postmark sendsBecomesData
Deliveryemail.delivered—
Bounceemail.bouncedbounce_type, bounce_code, recipient_deactivated
SpamComplaintemail.complained—
Open / Clickemail.opened / email.clicked—
SubscriptionChangeemail.unsubscribed—

Set up

curl -X POST https://api.hookget.com/v1/sources \
  -H "authorization: Bearer $HOOKGET_KEY" \
  -d '{"provider":"postmark","name":"transactional"}'
# → in Postmark, set the webhook URL to the ingest path and add the returned
#   secret as basic-auth password or an x-hookget-token header
How an inbound webhook is verified before it enters A provider sends a signed request. HookGet verifies the signature or token and deduplicates on the provider's delivery id before the event exists. A request that fails verification is refused with a 401 and never enters the pipeline. A verified event flows into the same pipeline as any other: retries, timeline, replay. The provider GitHub, Stripe, 13 more Verified at the door signature or token · dedupe The same pipeline retries · timeline · replay Refused bad signature → 401, nothing enters
Verification happens before the event exists, so a forged request is refused at the door — it is never stored, never retried, never seen again. Redeliveries are deduplicated on the provider’s own delivery id.

Stated plainly

Postmark does not sign webhook payloads — basic auth or a custom header is the entire security model they offer. This page says "token-verified" because that is what exists; a signature we implied but could not verify would be worse than none.

Questions

How are duplicate opens handled?

Postmark sends no per-delivery id, so the dedup key is message id + record type + timestamp. A genuine second open is a second event; Postmark re-sending the same one collapses into the first.