Notification receipt webhook — configure, rotate, delete

`/notifications/webhook`

One optional, account-wide destination for notification receipts: when a notification you sent from MauKirim’s shared number is delivered to or read on the recipient’s phone, MauKirim posts a signed event to it. This is separate from a rented number’s device webhook.

Method	Effect	Scope
`GET`	Read the destination (never the secret)	`webhook`
`POST`	Create or edit the destination	`webhook`
`PUT`	Rotate the signing secret	`webhook`
`DELETE`	Remove the destination and its delivery log	`webhook`

`GET /notifications/webhook`

{
  "ok": true,
  "webhook": { "id": "nwh_…", "url": "https://example.com/maukirim", "active": true,
               "createdAt": "…", "updatedAt": "…" },
  "availableEvents": ["notification.delivered", "notification.read"]
}

webhook is null until one is configured.

`POST /notifications/webhook`

curl -X POST https://app.maukirim.com/api/v1/notifications/webhook \
  -H "Authorization: Bearer mk_live_…" -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/maukirim","active":true}'

Field	Type	Notes
`url`	string	`https`, a public host; no credentials, query, fragment, IP literal or localhost
`active`	boolean?	`false` pauses delivery. Defaults to `true` on creation and to the current value on edit

200 → { "ok": true, "webhook": …, "secret": "<64 hex>" }. secret is returned only when the destination is created; an edit keeps the existing secret and omits it.

`PUT /notifications/webhook`

Issues a new signing secret; the old one stops verifying immediately. 200 → { "ok": true, "webhook": …, "secret": "<64 hex>" }. With no destination configured: 404 webhook_not_configured.

`DELETE /notifications/webhook`

200 → { "ok": true, "removed": true }. With no destination configured: 404 webhook_not_configured.

The event

{
  "event": "notification.delivered",
  "delivery_id": "nwd_…",
  "batch_id": "gwb_…",
  "item_id": "gwi_…",
  "status": "delivered",
  "created_at": "2026-10-02T13:05:00.000Z"
}

Signed exactly like device webhooks — x-maukirim-signature: sha256=<hex> over the raw body, keyed by the secret. See Webhooks for verification, retries and deduplication.