Sent to every enabled webhook endpoint when a message's status changes — on the interim sent transition and on the terminal status (delivered/not_delivered/error). The body is a JSON array of one or more events, so a single request may batch several status changes for your account; iterate it. Delivery is at-least-once: each event's id is stable across retries of the same event, so it can be used to discard a duplicate. A non-2xx response or a timeout is retried with backoff; a request is abandoned after 5 attempts.
Verify X-Sintalk-Signature before trusting the body. It is v1= followed by the hex HMAC-SHA256, keyed with the endpoint's signing secret, over X-Sintalk-Timestamp + . + the raw request body (the whole array). Compare with a constant-time equality check, and reject a timestamp too far from your clock to blunt replay.
Any 2xx acknowledges receipt. Anything else is retried.