Get notified with webhooks

API & integrationsUpdated October 8, 2026

Send contact, form and campaign events to your own server or another tool as they happen.

A webhook tells another tool the moment something changes in EmailFig: someone subscribes, a tag is added, a form is submitted. You give EmailFig a URL, pick the events you care about, and EmailFig sends them there.

Add an endpoint

Go to Settings → Webhooks and click Add endpoint.
Paste the Endpoint URL. It has to start with https://. Add a Description if you like.
Tick the events you want, or click Select all events, then click Add endpoint.
If asked to confirm it’s you, enter the code we email you (or your authenticator code if you use two-factor authentication).
On the endpoint’s page, click Send test event and check it arrives.

Endpoints created by integrations

Zapier, Make, n8n and other tools add their own endpoints through the API. They’re listed separately under Created by integrations, with the API key that made them. The tool manages them, but you can Delete one and the tool stops receiving events. Revoking the API key deletes its endpoints too.

Events

Event	Sent when
`contact.created`	a contact is added
`contact.updated`	a contact’s email address, name or custom fields change
`contact.deleted`	a contact is deleted
`contact.unsubscribed` / `contact.resubscribed`	a contact opts out (including by marking an email as spam), or back in
`contact.confirmed`	a contact confirms a double opt-in
`contact.cleaned`	an address bounces for good
`contact.list_subscribed` / `contact.list_unsubscribed`	a contact joins or leaves a list
`contact.tag_added` / `contact.tag_removed`	a tag is added or removed
`form.submitted`	someone signs up through a form (on a double opt-in list, before they confirm)
`campaign.sent`	a campaign finishes sending

Bulk actions send one event per contact, so tagging 500 contacts sends 500 events. Some changes send nothing: a CSV import, erasing a contact, deleting or renaming a list or tag, and a change to a contact’s source alone.

New events and fields may be added over time, so have your tool ignore anything it doesn’t recognise. Existing fields won’t be removed or renamed without notice.

What arrives

Each request is a JSON array of up to 100 events:

[
  {
    "id": "evt_...",
    "type": "contact.tag_added",
    "timestamp": "2026-09-25T12:00:00.000000Z",
    "origin": "ui",
    "data": { "contact": { "id": "con_...", "email_address": "ada@example.com" }, "tag": { "id": "tag_...", "name": "vip" } }
  }
]

id is unique to the event. An event can occasionally arrive twice, so skip any id you’ve already handled. Events can also arrive out of order, so use timestamp to order them.
data.contact is the contact as it was when the event was sent, a few seconds after the change.
origin says who made the change: ui (someone in EmailFig), api (an API key), recipient (the contact, through a form or an email link) or system (EmailFig itself). It doesn’t say which tool used the API.

If your tool writes back to EmailFig, writing back the values an event carried is safe: contact.updated is only sent when a value really changes. To ignore your tool’s own changes, mark them (for example with a custom field your tool sets). Don’t skip every api event, or you’ll also skip changes from other tools, such as signups from the WordPress plugin.

Check the signature

Every request is signed following the Standard Webhooks spec, so you can use one of its libraries to check it came from EmailFig.

To get the secret, open the endpoint and click Reveal secret under Signing secret, then confirm it’s you. If the secret leaks, click Make a new secret. The old one keeps working for 24 hours so you can switch over.

Answer quickly

Reply with any 2xx status within 5 seconds, then do the work. Anything else counts as a failure, including a redirect. Reply 410 and EmailFig turns the endpoint off. Reply 429 to have the events sent later, no sooner than your Retry-After header. A 429 doesn’t count towards turning the endpoint off.

Turn an endpoint off or on

Click Turn off on the endpoint’s page to pause it. Nothing is sent or saved for it while it’s off. Click Turn back on to start again.

If your endpoint is down

EmailFig retries a failed request 7 more times over 24 hours. If an endpoint keeps failing for a day, EmailFig turns it off and emails you.

Events from while it’s off aren’t kept. To catch up, the endpoint’s page shows an API request that fetches the contacts changed or deleted since events stopped arriving. Copy it before you click Turn back on.

Under Deliveries, the endpoint’s page lists every delivery from the last 7 days, newest first. Click a delivery’s time to see exactly what was sent and what came back. To resend a failed one, open its … menu and click Send again.

Where to go next

Using the EmailFig API
Connect EmailFig to other apps
The full API reference, which also covers managing endpoints from code

Stuck on something? Email contact@emailfig.com and a real person will help.

Read the API reference →