{
"event": "email.suppressed",
"data": {
"id": "0199f1c2-7a41-7c3e-9d2b-5e8f1a2b3c4d",
"status": "failed",
"application_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"from": {
"name": "متجر أكمي",
"address": "orders@acme.sa"
},
"to": "sara@example.com",
"recipient": {
"id": "0199f1c2-7a42-7b10-8c3d-2a3b4c5d6e7f",
"address": "sara@example.com",
"type": "to",
"status": "suppressed"
},
"tags": [
{
"name": "category",
"value": "order"
}
],
"mode": "live",
"template": {
"id": "0199f1f0-2d3e-7f4a-8b5c-6d7e8f9a0b12",
"alias": "order-shipped",
"version": 3
},
"subject": "طلبك 1042 في الطريق",
"reference": "order-1042",
"price_halalas": 0,
"error": null,
"bounce": null,
"occurred_at": "2026-10-23T09:00:03.512Z",
"created_at": "2026-10-23T09:00:01.087Z",
"suppressed": {
"reason": "bounce",
"by": "tawked"
}
},
"type": "email.suppressed",
"timestamp": "2026-10-09T09:00:03.512Z",
"sent_at": "1791536403601"
}Email suppressed
email.suppressed. A recipient was refused by the suppression list, at accept or at send; data.suppressed says why. It is sent beside email.failed with recipient_suppressed: handle one of them. Sent to the application’s webhook. A message of several recipients sends one per recipient, its data adding recipient and tags after to. Verify one scheme against the raw body before trusting it: on an endpoint with Standard signing on, Standard Webhooks’ webhook-signature with its whsec_ secret (recommended there); otherwise tawked-signature with the webhook secret, and make handling idempotent on tawked-webhook-id: a delivery can arrive more than once, and deliveries are not guaranteed to arrive in order.
{
"event": "email.suppressed",
"data": {
"id": "0199f1c2-7a41-7c3e-9d2b-5e8f1a2b3c4d",
"status": "failed",
"application_id": "c2a10f3e-8b7a-4d2e-9c1a-1a2b3c4d5e6f",
"from": {
"name": "متجر أكمي",
"address": "orders@acme.sa"
},
"to": "sara@example.com",
"recipient": {
"id": "0199f1c2-7a42-7b10-8c3d-2a3b4c5d6e7f",
"address": "sara@example.com",
"type": "to",
"status": "suppressed"
},
"tags": [
{
"name": "category",
"value": "order"
}
],
"mode": "live",
"template": {
"id": "0199f1f0-2d3e-7f4a-8b5c-6d7e8f9a0b12",
"alias": "order-shipped",
"version": 3
},
"subject": "طلبك 1042 في الطريق",
"reference": "order-1042",
"price_halalas": 0,
"error": null,
"bounce": null,
"occurred_at": "2026-10-23T09:00:03.512Z",
"created_at": "2026-10-23T09:00:01.087Z",
"suppressed": {
"reason": "bounce",
"by": "tawked"
}
},
"type": "email.suppressed",
"timestamp": "2026-10-09T09:00:03.512Z",
"sent_at": "1791536403601"
}Authorizations
Authorization: Bearer . An application key (tk_live_, tk_test_) has full access, which covers every product and any product added later, or custom access, chosen when the key is created: one or more of the scopes verify:check, verify:send (includes verify:check), notifications:read, notifications:send (includes notifications:read), email:read, email:send (includes email:read), email:manage (includes email:send), webhooks:manage, email:inbound, notifications:templates (includes notifications:read), chat:menus, chat:attendant. No key made on the API keys page holds notifications:templates, full access included: the three template writes answer such a key 403 insufficient_scope. A connected app's key holds it. Nor chat:menus: the five conversation menu operations answer such a key 403 insufficient_scope, and a connected app's key holds it once the client approved it. Nor chat:attendant: the five auto-attendant operations answer such a key 403 insufficient_scope too, and a connected app's key holds it once the client approved it. email:manage and webhooks:manage are held only by a key someone chose them for: a full-access key, old or new, never holds them. email:inbound, which reads, deletes and forwards received e-mail, is opt-in on every key, full access included: a key holds it only when it was turned on when the key was created. A call outside the key's access answers 403 insufficient_scope and names the scope it needs in the WWW-Authenticate response header. A partner key (tk_partner_) always has full access. Whatever its access, a key is a server-side secret.
Headers
Milliseconds since the epoch, as a string; the same value as sent_at.
Hex HMAC-SHA256 of "{timestamp}.{raw body}" with your webhook secret.
The event name, the same as event in the body.
email.suppressed The event's id, the same on every retry and on a delivery sent again from the console: dedupe on it.
Standard Webhooks, sent when the endpoint's Standard signing is on: the same as tawked-webhook-id.
Standard Webhooks, sent when the endpoint's Standard signing is on: the same instant as tawked-timestamp, in seconds.
Standard Webhooks, sent when the endpoint's Standard signing is on: v1,<base64> of HMAC-SHA256 of "{webhook-id}.{webhook-timestamp}.{raw body}" with the base64-decoded part of your whsec_ secret; during a rotation's grace a space and the previous secret's signature follow.
Body
Show child attributes
Show child attributes
On a test key's event only (simulated: nothing was sent or received). On email.received it is the only sign of a simulated e-mail.
test true on a console test event and on Tawked's test message to a new receiving address; never on a customer's event.
Response
Any 2xx answer within 5 seconds acknowledges the delivery. Anything else, a redirect or no answer in time is retried: 5 attempts in all, the first at once and the next after 1 min, 5 min, 30 min, 2 h.