{
"event": "email.bounced",
"data": {
"id": "3d9a7f2e-1c4b-4e8a-9f6d-2b5c8e1a7d40",
"status": "bounced",
"application_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"from": {
"name": "متجر أكمي",
"address": "orders@acme.sa"
},
"to": "c***@example.com",
"subject": "طلبك رقم 1042 قيد التجهيز",
"reference": "order-1042",
"price_halalas": 1,
"error": {
"code": "bounced",
"message": "smtp; 550 5.1.1 user unknown"
},
"bounce": {
"type": "Permanent",
"subtype": "General"
},
"occurred_at": "2026-10-09T09:00:03.512Z",
"created_at": "2026-10-09T09:00:01.087Z"
},
"sent_at": "1791536403601"
}Email bounced
email.bounced. The recipient’s mail server refused the message, permanently or for now; data.bounce carries the type and subtype, and the price is refunded. Sent to the application’s webhook. Verify tawked-signature against the raw body before trusting it, and make handling idempotent: a delivery can arrive more than once, and deliveries are not guaranteed to arrive in order.
{
"event": "email.bounced",
"data": {
"id": "3d9a7f2e-1c4b-4e8a-9f6d-2b5c8e1a7d40",
"status": "bounced",
"application_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"from": {
"name": "متجر أكمي",
"address": "orders@acme.sa"
},
"to": "c***@example.com",
"subject": "طلبك رقم 1042 قيد التجهيز",
"reference": "order-1042",
"price_halalas": 1,
"error": {
"code": "bounced",
"message": "smtp; 550 5.1.1 user unknown"
},
"bounce": {
"type": "Permanent",
"subtype": "General"
},
"occurred_at": "2026-10-09T09:00:03.512Z",
"created_at": "2026-10-09T09:00:01.087Z"
},
"sent_at": "1791536403601"
}Authorizations
Authorization: Bearer . An application key (tk_live_, tk_test_) has full access, which covers every product and any product added later, or custom access, chosen when the key is created: one or more of the scopes verify:check, verify:send (includes verify:check), notifications:read, notifications:send (includes notifications:read), email:read, email:send (includes email:read), notifications:templates (includes notifications:read). No key made on the API keys page holds notifications:templates, full access included: the three template writes answer such a key 403 insufficient_scope. A connected app's key holds it. A call outside the key's access answers 403 insufficient_scope and names the scope it needs in the WWW-Authenticate response header. A partner key (tk_partner_) always has full access. Whatever its access, a key is a server-side secret.
Headers
Milliseconds since the epoch, as a string; the same value as sent_at.
Hex HMAC-SHA256 of "{timestamp}.{raw body}" with your webhook secret.
The event name, the same as event in the body.
email.bounced Response
Any 2xx answer within 5 seconds acknowledges the delivery. Anything else, a redirect or no answer in time is retried: 5 attempts in all, the first at once and the next after 1 min, 5 min, 30 min, 2 h.