Adds an action to a rule. The action's type says what it does, and its other fields configure it. To send events to your own endpoint, use postToWebhook:

• webhookUrl: your HTTPS endpoint. Addresses that resolve to a private network are refused.
• httpHeaders: optional extra headers, as [name, value] pairs.

Mixmax then sends a POST with the event as a JSON body each time the rule runs. Every new webhook action gets a signing secret. This response is the only time you see it, so store it now; listings show only signingSecretLastFour. Mixmax uses it to sign each delivery with the X-Mixmax-Webhook-Id, X-Mixmax-Timestamp and X-Mixmax-Signature headers. The call:recording-available webhook in this reference explains how to verify them, and how retries and pausing work. To replace the secret, PATCH the action with rotateSigningSecret: true.

You may send your own signingSecret, as whsec_ followed by 32 random bytes in base64. Anything else is silently replaced with a generated secret, so always keep the one in the response.

Other action types, such as posting to Slack or adding to a sequence, are easiest to set up in the Mixmax app. Read one back with GET /v1/rules/{id}/actions to see its fields.