Forward webhooks to Amazon EventBridge

Verify the signature in a Lambda function, then put each event on an EventBridge bus.

Point a delivery webhook at a Lambda function URL. The function checks the signature, calls PutEvents, and your EventBridge rules route each event by type.

Before you start

An AWS account where you can create a Lambda function, a function URL, and an EventBridge bus.
Access to Webhooks in the PostShiba dashboard, or a Full access API key.

1. Create the bus

Create an event bus in the same Region as the function. This guide names it postshiba.

2. Allow PutEvents

Add this statement to the function's execution role. Replace REGION, ACCOUNT, and the bus name.

policy.json

1{ 2 "Version": "2012-10-17", 3 "Statement": [ 4 { 5 "Effect": "Allow", 6 "Action": "events:PutEvents", 7 "Resource": "arn:aws:events:REGION:ACCOUNT:event-bus/postshiba" 8 } 9 ] 10}

3. Write the function

Use the Node.js 22 runtime. Mark the package as a module so index.js can use import, and install the EventBridge client in the function directory.

package.json

1{ 2 "type": "module" 3}

install.sh

1npm install @aws-sdk/client-eventbridge

Set two environment variables on the function. POSTSHIBA_WEBHOOK_SECRET is the endpoint's signing secret, which you copy in step 5. EVENT_BUS_NAME is the bus name.

index.js

1import { createHmac, timingSafeEqual } from "node:crypto" 2import { EventBridgeClient, PutEventsCommand } from "@aws-sdk/client-eventbridge" 3 4const client = new EventBridgeClient({}) 5const secret = process.env.POSTSHIBA_WEBHOOK_SECRET 6const busName = process.env.EVENT_BUS_NAME 7 8export const handler = async (event) => { 9 const raw = event.isBase64Encoded 10 ? Buffer.from(event.body || "", "base64").toString("utf8") 11 : event.body || "" 12 const headers = event.headers || {} 13 14 if (!verify(raw, headers["x-capsule-timestamp"], headers["x-capsule-signature"])) { 15 return { statusCode: 401, body: "invalid signature" } 16 } 17 18 let batch 19 try { 20 batch = JSON.parse(raw) 21 } catch { 22 return { statusCode: 400, body: "invalid json" } 23 } 24 if (!Array.isArray(batch)) { 25 return { statusCode: 400, body: "expected an array" } 26 } 27 28 for (let i = 0; i < batch.length; i += 10) { 29 const result = await client.send( 30 new PutEventsCommand({ 31 Entries: batch.slice(i, i + 10).map((item) => ({ 32 EventBusName: busName, 33 Source: "postshiba", 34 DetailType: String(item.event || "event"), 35 Detail: JSON.stringify(item), 36 })), 37 }), 38 ) 39 if (result.FailedEntryCount) { 40 return { statusCode: 500, body: "put events failed" } 41 } 42 } 43 44 return { statusCode: 204, body: "" } 45} 46 47function verify(raw, timestamp, signature) { 48 if (!secret || !timestamp || !signature) return false 49 const expected = createHmac("sha256", secret).update(`${timestamp}.${raw}`).digest("hex") 50 const given = String(signature).replace(/^sha256=/, "") 51 const a = Buffer.from(expected) 52 const b = Buffer.from(given) 53 if (a.length !== b.length) return false 54 return timingSafeEqual(a, b) 55}

What the function does:

Verifies the signature over {timestamp}.{raw body} before parsing. See Verify webhook requests.
Puts events in batches of 10, the PutEvents limit.
Returns 500 if any entry fails, so PostShiba retries. A retry sends the same event again, so use sg_event_id to drop duplicates downstream. See Retries and replays.

PostShiba waits 10 seconds for a response, so keep the function's work inside that.

4. Open a function URL

Create a function URL with auth type NONE, payload format version 2.0, and the buffered invoke mode. The signature check replaces IAM auth, and the function returns 401 when it fails. Copy the https:// URL.

5. Create the webhook

In the PostShiba dashboard, open Webhooks and click Add endpoint. Or use the API from Managing webhooks.
Paste the function URL and pick the event types. See Event types.
Copy the Signing secret into the function's POSTSHIBA_WEBHOOK_SECRET.

6. Add a rule

On the postshiba bus, create a rule that matches source postshiba. Filter on the detail type to pick event names, such as delivered or bounce.

rule-pattern.json

1{ 2 "source": ["postshiba"], 3 "detail-type": ["bounce", "spamreport"] 4}

detail is one event object. Its fields are listed on Event types.

Inbox webhooks use the same signature headers, keyed with the inbox's webhook_secret, so the same verify function works for received mail. Their body is different. See Receiving webhooks.