Mailgun delivered webhook payload example

Mailgun · event: delivered · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into Mailgun's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
user-agent: mailgun/treq-24.9.1

Body

{
  "signature": {
    "timestamp": "1787961600",
    "token": "1a2b3c4d5e6f7081920a1b2c3d4e5f60718293a4b5c6d7e8f9",
    "signature": "d2b02e69d6a5b0e0f2c4a8d7f3b1e9c5a4d8f6b2e0c7a9d5f3b1e8c6a4d2f0b9"
  },
  "event-data": {
    "event": "delivered",
    "timestamp": 1787961600.123456,
    "id": "CPgfbmQMTCKtHW6uIWtuVe",
    "recipient": "alice@example.com",
    "recipient-domain": "example.com",
    "message": {
      "headers": {
        "to": "alice@example.com",
        "message-id": "20260829000000.1.ABCDEF123456@mg.example.com",
        "from": "Bob <bob@mg.example.com>",
        "subject": "Welcome aboard!"
      },
      "size": 687
    },
    "delivery-status": {
      "code": 250,
      "message": "OK",
      "session-seconds": 0.42
    },
    "envelope": {
      "sender": "bob@mg.example.com",
      "transport": "smtp",
      "targets": "alice@example.com"
    },
    "flags": {
      "is-authenticated": true,
      "is-test-mode": false
    },
    "tags": [
      "welcome"
    ],
    "log-level": "info"
  }
}

Things that bite people

Mailgun's signature lives inside the body (the signature object): hex HMAC-SHA256 over timestamp + token keyed with your Webhook Signing Key. Header-only HMAC testers structurally can't verify it — full walkthrough.
Neither the body nor the URL is signed, so replayed/relayed deliveries keep verifying — but that also means you should check timestamp freshness and de-duplicate on token.
Respond 200 to acknowledge; 406 tells Mailgun to never retry; anything else retries over ~8 hours.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'user-agent: mailgun/treq-24.9.1' \
 -d '{"signature":{"timestamp":"1787961600","token":"1a2b3c4d5e6f7081920a1b2c3d4e5f60718293a4b5c6d7e8f9","signature":"d2b02e69d6a5b0e0f2c4a8d7f3b1e9c5a4d8f6b2e0c7a9d5f3b1e8c6a4d2f0b9"},"event-data":{"event":"delivered","timestamp":1787961600.123456,"id":"CPgfbmQMTCKtHW6uIWtuVe","recipient":"alice@example.com","recipient-domain":"example.com","message":{"headers":{"to":"alice@example.com","message-id":"20260829000000.1.ABCDEF123456@mg.example.com","from":"Bob <bob@mg.example.com>","subject":"Welcome aboard!"},"size":687},"delivery-status":{"code":250,"message":"OK","session-seconds":0.42},"envelope":{"sender":"bob@mg.example.com","transport":"smtp","targets":"alice@example.com"},"flags":{"is-authenticated":true,"is-test-mode":false},"tags":["welcome"],"log-level":"info"}}'

← All payload examples · Related guide · Signature debugger · Docs