Aweber Webhooks

generated: '2026-08-13'
method: searched
source: https://api.aweber.com/#tag/Webhooks
docs: https://api.aweber.com/#tag/Webhooks
spec_type: webhook-catalog
asyncapi_published: false
note: >-
  AWeber publishes no AsyncAPI document. It DOES publish a complete, well-specified webhook
  contract inside the API reference — three events, an HMAC-SHA256 signature scheme, a versioned
  vendor media type, documented batching, delivery-id tracing and a documented retry posture.
  This artifact captures that catalog verbatim from AWeber's own reference; no event, field or
  header here was invented. Event payload field lists are the provider's own tables.
transport: http-post-callback
delivery:
  callback_configuration: >-
    The integration registers a Callback URL Allow-list (one or more exact URL prefixes) and
    selects the events it wants; the AWeber customer then sets the actual Webhook URL in the
    AWeber control panel at https://www.aweber.com/users/apps, and it must match a registered
    prefix. Since Webhooks 1.3.0 (2022-06-21) this no longer requires a request to the API team —
    it can be enabled for any OAuth 2 application on labs.aweber.com.
  required_scopes: [subscriber.read, account.read]
  content_type: application/vnd.aweber.webhook+json; version=1.0
  batching: >-
    Events occurring in short succession are batched into one callback. The payload's data[] array
    carries multiple {event, payload} objects; batch size is not fixed.
  expected_response: 'Return a 2XX (documented as 200); the response body is ignored.'
  failure_behavior: >-
    A non-2XX response may cause AWeber to retry the message or to stop sending webhooks
    entirely. The retry schedule is not published.
security:
  scheme: hmac-sha256
  header: AWeber-Signature
  format: '<hash-type>=<hex digest>, e.g. sha256=99e0837d...  (RFC 2104 HMAC)'
  verification_docs: https://api.aweber.com/#tag/Webhooks
headers:
  - {name: AWeber-Delivery-ID, description: Unique identifier for this delivery; quote it when contacting support}
  - {name: AWeber-Signature, description: Hash type and message digest separated by '='; sha256 is the only defined type}
  - {name: Date, description: 'RFC 7231 date the message was generated'}
envelope:
  fields:
    - {name: account, type: string, description: Uniquely identifies the account the event fired for}
    - {name: client_id, type: string, description: OAuth 2 client ID of the application}
    - {name: callback, type: string, description: Unique identifier for the callback registration}
    - {name: data, type: array, description: 'Array of {event, payload} objects'}
events:
  - name: subscriber.added
    since: '2019-11-26'
    description: >-
      Triggered when a subscriber is added to a list, regardless of status — fired for BOTH
      verified and unverified subscribers.
    payload_fields:
      [account, ad_tracking, custom_fields, email, id, links, list, misc_notes, name, signup_ip,
       signup_location, status, subscribed_at, subscription_method, subscription_url, tags,
       unsubscribe_method, unsubscribed_at, verified_at]
    related_operations: [addSubscriber, getSubscriber]
  - name: subscriber.subscribed
    since: '2020-01-03'
    description: >-
      Triggered when a subscriber is subscribed to a list. Fires for subscribers on both
      confirmed-opt-in (COI) and single-opt-in (SOI) lists.
    payload_fields:
      [account, ad_tracking, custom_fields, email, id, links, list, misc_notes, name, signup_ip,
       signup_location, status, subscribed_at, subscription_method, subscription_url, tags,
       unsubscribe_method, unsubscribed_at, verified_at]
    related_operations: [getSubscriber]
  - name: subscriber.unsubscribed
    since: '2020-01-03'
    description: Triggered when a subscriber unsubscribes from a list.
    related_operations: [getSubscriber]
enumerations:
  status: [subscribed, unconfirmed, unsubscribed, deleted]
  subscription_method: [api, email, import, webform]
  unsubscribe_method: ['unsubscribe link', 'customer cp', undeliverable, 'api: unsubscribe', 'api: move']
links:
  note: >-
    Every event payload carries a links object with absolute REST URLs for the account, list and
    subscriber, so a consumer can hydrate straight into the REST API without constructing paths.
gaps:
  - No AsyncAPI (or CloudEvents) document — the contract is human-readable tables only.
  - No published retry schedule or backoff; "may retry or stop sending entirely".
  - No event types beyond the subscriber lifecycle; nothing for broadcasts, campaigns, purchases or forms.
  - No replay/redelivery endpoint and no delivery-log API.