---
title: "Resend Delivery Webhook"
method: POST
path: "/api/webhooks/resend"
tags: ["access-requests"]
---

# Resend Delivery Webhook

`POST /api/webhooks/resend`

## Request

- Base URL: `https://app.thinqos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://app.thinqos.com/api/webhooks/resend`
- Auth: none declared

Record what Resend did with an access email (TOS-4110).

`access_email_deliveries` has always logged what we handed the provider and
never what the provider did with it, so an invitation that hard-bounced was
indistinguishable from one that landed - and the person waiting for access
simply never heard from us.

The Svix signature is the ONLY authentication on this route, exactly as the
Stripe signature is on `_stripe_webhook`, so a body that fails verification
is rejected before it is parsed. An unset secret is a 503 rather than an
open door: a self-hosted install with no Resend account must not expose an
unauthenticated write path.

`async def` only for `await request.body()`; the signature is over the RAW
bytes, so the body cannot be read through a parsed model.

## Response `200`

Successful Response

- object

---

[API](https://skmtc.dev/thinqos/apis/thinqos-api.md) · [All operations](https://skmtc.dev/thinqos/apis/thinqos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinqos/apis/thinqos-api/revisions/5387b4ded614?raw)