replylayer 0.26.0__tar.gz → 0.27.0__tar.gz

replylayer-0.26.0/README.md → replylayer-0.27.0/PKG-INFO

@@ -1,3 +1,23 @@
+Metadata-Version: 2.5
+Name: replylayer
+Version: 0.27.0
+Summary: Official Python SDK for ReplyLayer — email for AI agents
+Project-URL: Homepage, https://replylayer.ai
+Project-URL: Repository, https://github.com/replylayer/rly
+Project-URL: Issues, https://github.com/replylayer/rly/issues
+License-Expression: MIT
+Keywords: agent,ai,email,mailbox,replylayer,sdk,webhook
+Requires-Python: >=3.10
+Requires-Dist: httpx>=0.27
+Requires-Dist: typing-extensions>=4.0
+Provides-Extra: cli
+Requires-Dist: rly>=0.6.3; extra == 'cli'
+Provides-Extra: dev
+Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: respx>=0.21; extra == 'dev'
+Description-Content-Type: text/markdown
+
 # replylayer
 
 Official Python SDK for [ReplyLayer](https://replylayer.ai) — secure email for AI agents.
@@ -256,6 +276,34 @@ result = rl.messages.send(
 
 A handle is **consumed once** at send and is single-mailbox-scoped (upload to the same mailbox you send from). Unconsumed handles expire after 24h; delete one early with `rl.attachments.delete_upload(handle["id"])`. Limits: 10 MB/file, 10 attachments and 15 MB total per message. Image attachments require a separate one-time image-risk disclaimer on the mailbox (`OUTBOUND_IMAGE_DISCLAIMER_REQUIRED`). Drafts hold handles and consume them at dispatch; `rl.drafts.update(draft_id, attachment_ids=None)` clears a draft's attachments. Attachment bytes are stored with provider-managed encryption-at-rest and transmitted over TLS — this is not end-to-end / zero-access encryption (the platform scans attachment content).
 
+## Webhook custom request headers
+
+For a receiver that authenticates by a fixed header rather than by ReplyLayer's HMAC, `webhooks.create` and `webhooks.update` accept `request_headers` — up to 8 static headers added to every delivery attempt for that webhook (first attempt, every retry, `test()`, and a manual `retry_delivery`).
+
+```python
+wh = rl.webhooks.create(
+    url="https://your-server.com/hooks/replylayer",
+    enabled_events=["message.received"],
+    request_headers={"Authorization": "Bearer your-receiver-token"},
+)
+
+wh["request_header_names"]  # ['authorization'] — names only, lower-cased + sorted
+```
+
+**Values are write-only.** They are encrypted at rest and returned by no read path: every webhook response carries `request_header_names` (`[]` when none) and never a value. Because of that, `update` is three-way and there is no per-header merge:
+
+```python
+rl.webhooks.update(wh["id"], request_headers={"Authorization": "Bearer rotated"})  # replaces the whole map
+rl.webhooks.update(wh["id"], request_headers=None)                                # clears every header
+rl.webhooks.update(wh["id"], enabled=False)                                       # leaves headers untouched
+```
+
+`None` means "clear" here, so omitting the argument entirely is the only way to leave the configured headers alone.
+
+Names match `^[A-Za-z0-9-]{1,64}$` and are compared case-insensitively; values are 1–1024 printable-ASCII characters. Reserved names — `content-type`, `content-length`, `host`, `user-agent`, `x-replylayer-signature`, `x-webhook-timestamp`, `x-webhook-signature-v2`, `transfer-encoding`, `connection`, `expect`, `te`, `upgrade`, `keep-alive`, `trailer`, and anything starting with `proxy-` — are rejected. The SDK does not pre-validate: rejections arrive as `ReplyLayerError` with `.code` set to `WEBHOOK_HEADER_RESERVED`, `WEBHOOK_HEADER_DUPLICATE`, `WEBHOOK_HEADER_INVALID`, or `VALIDATION_ERROR`.
+
+Deliveries for a webhook with custom headers store no response body (`response_preview` is always `None`), so a receiver that echoes the request cannot leak a configured credential back into the delivery history.
+
 ## Delivery history & manual retry
 
 `rl.webhooks.list_deliveries(id, limit=..., before_at=..., before_id=...)` returns the most recent delivery attempts for a webhook with tuple-cursor keyset pagination. `before_at` and `before_id` must be provided together — the SDK omits the cursor entirely if only one is given.

replylayer-0.26.0/PKG-INFO → replylayer-0.27.0/README.md

@@ -1,23 +1,3 @@
-Metadata-Version: 2.4
-Name: replylayer
-Version: 0.26.0
-Summary: Official Python SDK for ReplyLayer — email for AI agents
-Project-URL: Homepage, https://replylayer.ai
-Project-URL: Repository, https://github.com/replylayer/rly
-Project-URL: Issues, https://github.com/replylayer/rly/issues
-License-Expression: MIT
-Keywords: agent,ai,email,mailbox,replylayer,sdk,webhook
-Requires-Python: >=3.10
-Requires-Dist: httpx>=0.27
-Requires-Dist: typing-extensions>=4.0
-Provides-Extra: cli
-Requires-Dist: rly>=0.6.3; extra == 'cli'
-Provides-Extra: dev
-Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
-Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: respx>=0.21; extra == 'dev'
-Description-Content-Type: text/markdown
-
 # replylayer
 
 Official Python SDK for [ReplyLayer](https://replylayer.ai) — secure email for AI agents.
@@ -276,6 +256,34 @@ result = rl.messages.send(
 
 A handle is **consumed once** at send and is single-mailbox-scoped (upload to the same mailbox you send from). Unconsumed handles expire after 24h; delete one early with `rl.attachments.delete_upload(handle["id"])`. Limits: 10 MB/file, 10 attachments and 15 MB total per message. Image attachments require a separate one-time image-risk disclaimer on the mailbox (`OUTBOUND_IMAGE_DISCLAIMER_REQUIRED`). Drafts hold handles and consume them at dispatch; `rl.drafts.update(draft_id, attachment_ids=None)` clears a draft's attachments. Attachment bytes are stored with provider-managed encryption-at-rest and transmitted over TLS — this is not end-to-end / zero-access encryption (the platform scans attachment content).
 
+## Webhook custom request headers
+
+For a receiver that authenticates by a fixed header rather than by ReplyLayer's HMAC, `webhooks.create` and `webhooks.update` accept `request_headers` — up to 8 static headers added to every delivery attempt for that webhook (first attempt, every retry, `test()`, and a manual `retry_delivery`).
+
+```python
+wh = rl.webhooks.create(
+    url="https://your-server.com/hooks/replylayer",
+    enabled_events=["message.received"],
+    request_headers={"Authorization": "Bearer your-receiver-token"},
+)
+
+wh["request_header_names"]  # ['authorization'] — names only, lower-cased + sorted
+```
+
+**Values are write-only.** They are encrypted at rest and returned by no read path: every webhook response carries `request_header_names` (`[]` when none) and never a value. Because of that, `update` is three-way and there is no per-header merge:
+
+```python
+rl.webhooks.update(wh["id"], request_headers={"Authorization": "Bearer rotated"})  # replaces the whole map
+rl.webhooks.update(wh["id"], request_headers=None)                                # clears every header
+rl.webhooks.update(wh["id"], enabled=False)                                       # leaves headers untouched
+```
+
+`None` means "clear" here, so omitting the argument entirely is the only way to leave the configured headers alone.
+
+Names match `^[A-Za-z0-9-]{1,64}$` and are compared case-insensitively; values are 1–1024 printable-ASCII characters. Reserved names — `content-type`, `content-length`, `host`, `user-agent`, `x-replylayer-signature`, `x-webhook-timestamp`, `x-webhook-signature-v2`, `transfer-encoding`, `connection`, `expect`, `te`, `upgrade`, `keep-alive`, `trailer`, and anything starting with `proxy-` — are rejected. The SDK does not pre-validate: rejections arrive as `ReplyLayerError` with `.code` set to `WEBHOOK_HEADER_RESERVED`, `WEBHOOK_HEADER_DUPLICATE`, `WEBHOOK_HEADER_INVALID`, or `VALIDATION_ERROR`.
+
+Deliveries for a webhook with custom headers store no response body (`response_preview` is always `None`), so a receiver that echoes the request cannot leak a configured credential back into the delivery history.
+
 ## Delivery history & manual retry
 
 `rl.webhooks.list_deliveries(id, limit=..., before_at=..., before_id=...)` returns the most recent delivery attempts for a webhook with tuple-cursor keyset pagination. `before_at` and `before_id` must be provided together — the SDK omits the cursor entirely if only one is given.

{replylayer-0.26.0 → replylayer-0.27.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "replylayer"
-version = "0.26.0"
+version = "0.27.0"
 description = "Official Python SDK for ReplyLayer — email for AI agents"
 readme = "README.md"
 license = "MIT"

{replylayer-0.26.0 → replylayer-0.27.0}/replylayer/__init__.py

@@ -29,6 +29,8 @@ from .types import (
     # WS6-SDK — async optimistic-ack (0.16.0).
     AsyncSendAck,
     WebhookEventType,
+    # Migration 134 — per-webhook custom request headers (write-only values).
+    WebhookRequestHeaders,
     WebhookSummary,
     WebhookDeliverySummary,
     WebhookDeliveryStatus,
@@ -120,7 +122,7 @@ from .types import (
     PolicyPreviewResult,
 )
 
-__version__ = "0.26.0"
+__version__ = "0.27.0"
 
 __all__ = [
     # Message delete response (0.20.0).
@@ -155,6 +157,8 @@ __all__ = [
     "EmailEffect",
     "EffectStatus",
     "WebhookEventType",
+    # Migration 134 — per-webhook custom request headers (write-only values).
+    "WebhookRequestHeaders",
     "WebhookSummary",
     "WebhookDeliverySummary",
     "WebhookDeliveryStatus",

{replylayer-0.26.0 → replylayer-0.27.0}/replylayer/_http.py

@@ -9,7 +9,7 @@ import httpx
 
 from .errors import ReplyLayerError, error_from_response
 
-_VERSION = "0.26.0"
+_VERSION = "0.27.0"
 _USER_AGENT = f"replylayer-sdk-py/{_VERSION}"
 _PROTECTED_HEADER_KEYS = frozenset({"authorization", "content-type", "user-agent"})
 

{replylayer-0.26.0 → replylayer-0.27.0}/replylayer/resources/webhooks.py

@@ -9,6 +9,21 @@ from .._http import AsyncHttpClient, SyncHttpClient
 from ..errors import WebhookSignatureError
 
 
+class _Unset:
+    """Sentinel for "this key was not supplied at all"."""
+
+    def __repr__(self) -> str:  # pragma: no cover - debugging aid
+        return "<UNSET>"
+
+
+# Migration 134 — ``request_headers`` on update is THREE-way, exactly like
+# ``description``: a dict REPLACES the whole map, ``None`` CLEARS it, and
+# omitting the argument leaves the configured headers untouched. ``None`` is a
+# meaningful value here, so "absent" needs its own sentinel — the same pattern
+# ``drafts.update``'s ``send_at`` / ``attachment_ids`` already use.
+_UNSET: Any = _Unset()
+
+
 def verify_webhook_signature(
     payload: str | bytes,
     signature: str,
@@ -58,7 +73,15 @@ class SyncWebhooks:
     def __init__(self, http: SyncHttpClient) -> None:
         self._http = http
 
-    def create(self, *, url: str, enabled_events: list[str], description: str | None = None, enabled: bool = True) -> dict[str, Any]:
+    def create(
+        self,
+        *,
+        url: str,
+        enabled_events: list[str],
+        description: str | None = None,
+        enabled: bool = True,
+        request_headers: dict[str, str] | None = None,
+    ) -> dict[str, Any]:
         """Create a new webhook subscription.
 
         Raises ``ForbiddenError`` (HTTP 403) when the account is at its
@@ -67,10 +90,25 @@ class SyncWebhooks:
         "max_allowed": int}`` so callers can render actionable upgrade
         prompts. Cap matrix: Sandbox 1, Starter 3, Pro 25, Team 100,
         Scale 250, Enterprise unbounded.
+
+        ``request_headers`` (migration 134) is an optional map of at most 8
+        static headers added to every delivery attempt for this webhook — for
+        a receiver that authenticates by a fixed header rather than by our
+        HMAC. It is passed through VERBATIM: the SDK does not pre-validate,
+        because the server is the single validator (and re-validates again on
+        the delivery path). Rejections arrive as ``ReplyLayerError`` with
+        ``code`` ``WEBHOOK_HEADER_RESERVED`` / ``WEBHOOK_HEADER_DUPLICATE`` /
+        ``WEBHOOK_HEADER_INVALID`` / ``VALIDATION_ERROR``.
+
+        The configured VALUES are write-only — no read path returns one. The
+        response carries ``request_header_names`` (lower-cased and sorted)
+        instead.
         """
         payload: dict[str, Any] = {"url": url, "enabled_events": enabled_events, "enabled": enabled}
         if description is not None:
             payload["description"] = description
+        if request_headers is not None:
+            payload["request_headers"] = request_headers
         return self._http.request("POST", "/v1/webhooks", body=payload)
 
     def list(self) -> dict[str, Any]:
@@ -79,8 +117,21 @@ class SyncWebhooks:
     def get(self, id: str) -> dict[str, Any]:
         return self._http.request("GET", f"/v1/webhooks/{id}")
 
-    def update(self, id: str, **kwargs: Any) -> dict[str, Any]:
-        return self._http.request("PATCH", f"/v1/webhooks/{id}", body=kwargs)
+    def update(self, id: str, *, request_headers: Any = _UNSET, **kwargs: Any) -> dict[str, Any]:
+        """Partial update — only the supplied keys are changed.
+
+        ``request_headers`` is three-way (migration 134): a dict REPLACES the
+        whole map, ``None`` CLEARS every configured header, and omitting the
+        argument leaves them untouched. There is no per-header merge — the
+        values are write-only, so a caller cannot see what is already
+        configured and a partial update could not be expressed. A rejected map
+        fails the whole PATCH and the previously configured headers stay in
+        place.
+        """
+        body: dict[str, Any] = dict(kwargs)
+        if request_headers is not _UNSET:
+            body["request_headers"] = request_headers
+        return self._http.request("PATCH", f"/v1/webhooks/{id}", body=body)
 
     def delete(self, id: str) -> dict[str, Any]:
         return self._http.request("DELETE", f"/v1/webhooks/{id}")
@@ -124,11 +175,25 @@ class AsyncWebhooks:
     def __init__(self, http: AsyncHttpClient) -> None:
         self._http = http
 
-    async def create(self, *, url: str, enabled_events: list[str], description: str | None = None, enabled: bool = True) -> dict[str, Any]:
-        """Create a new webhook subscription. See SyncWebhooks.create for tier-cap details."""
+    async def create(
+        self,
+        *,
+        url: str,
+        enabled_events: list[str],
+        description: str | None = None,
+        enabled: bool = True,
+        request_headers: dict[str, str] | None = None,
+    ) -> dict[str, Any]:
+        """Create a new webhook subscription.
+
+        See ``SyncWebhooks.create`` for tier-cap details and the
+        ``request_headers`` contract (migration 134).
+        """
         payload: dict[str, Any] = {"url": url, "enabled_events": enabled_events, "enabled": enabled}
         if description is not None:
             payload["description"] = description
+        if request_headers is not None:
+            payload["request_headers"] = request_headers
         return await self._http.request("POST", "/v1/webhooks", body=payload)
 
     async def list(self) -> dict[str, Any]:
@@ -137,8 +202,14 @@ class AsyncWebhooks:
     async def get(self, id: str) -> dict[str, Any]:
         return await self._http.request("GET", f"/v1/webhooks/{id}")
 
-    async def update(self, id: str, **kwargs: Any) -> dict[str, Any]:
-        return await self._http.request("PATCH", f"/v1/webhooks/{id}", body=kwargs)
+    async def update(self, id: str, *, request_headers: Any = _UNSET, **kwargs: Any) -> dict[str, Any]:
+        """Partial update. See ``SyncWebhooks.update`` for the three-way
+        ``request_headers`` semantics (dict replaces / ``None`` clears /
+        absent leaves untouched)."""
+        body: dict[str, Any] = dict(kwargs)
+        if request_headers is not _UNSET:
+            body["request_headers"] = request_headers
+        return await self._http.request("PATCH", f"/v1/webhooks/{id}", body=body)
 
     async def delete(self, id: str) -> dict[str, Any]:
         return await self._http.request("DELETE", f"/v1/webhooks/{id}")

{replylayer-0.26.0 → replylayer-0.27.0}/replylayer/types.py

@@ -1653,6 +1653,23 @@ GetUploadAttachmentResponse = Union[UploadAttachmentResponse, ConsumedAttachment
 
 # === Webhooks ===
 
+# Migration 134 — static request headers added to every delivery for one
+# webhook, the shape accepted on create and update.
+#
+# At most 8 entries. Names match ``^[A-Za-z0-9-]{1,64}$`` and are compared
+# case-insensitively; values are 1-1024 printable-ASCII (0x20-0x7E)
+# characters. Reserved names (``content-type``, ``content-length``, ``host``,
+# ``user-agent``, ``x-replylayer-signature``, ``x-webhook-timestamp``,
+# ``x-webhook-signature-v2``, ``transfer-encoding``, ``connection``,
+# ``expect``, ``te``, ``upgrade``, ``keep-alive``, ``trailer``, and anything
+# starting with ``proxy-``) are rejected — they carry ReplyLayer's own
+# signature and framing, or address the connection rather than the receiver.
+#
+# The VALUES are write-only: no read path returns one. Responses carry
+# ``request_header_names`` instead.
+WebhookRequestHeaders = dict[str, str]
+
+
 class CreateWebhookResponse(TypedDict):
     id: str
     url: str
@@ -1660,6 +1677,10 @@ class CreateWebhookResponse(TypedDict):
     enabled: bool
     enabled_events: list[WebhookEventType]
     signing_secret: str
+    # Configured custom-header NAMES, lower-cased and sorted; ``[]`` when none.
+    # Never a value — those are write-only. Present on every webhook response
+    # (create, list, get, update).
+    request_header_names: list[str]
     created_at: str
 
 
@@ -1669,6 +1690,8 @@ class WebhookSummary(TypedDict):
     description: str | None
     enabled: bool
     enabled_events: list[WebhookEventType]
+    # See CreateWebhookResponse.request_header_names. Names only, [] when none.
+    request_header_names: list[str]
     created_at: str
     updated_at: str
     # D6: health fields surfaced by the delivery worker

{replylayer-0.26.0 → replylayer-0.27.0}/tests/test_webhooks.py

@@ -1,5 +1,6 @@
 import hashlib
 import hmac
+import json
 import time
 
 import httpx
@@ -45,6 +46,154 @@ def test_webhooks_rotate_secret():
     assert res["signing_secret"] == "whsec_new"
 
 
+# ── Migration 134: per-webhook custom request headers ──
+#
+# The SDK is a pass-through: no client-side validation of the map (the server
+# is the single validator and re-validates on the delivery path). What these
+# pin is the WIRE — that the map reaches the body verbatim, that ``None`` is
+# serialized as a clear rather than dropped, and that every response surfaces
+# names and never a value. Mirrors packages/sdk/src/__tests__/webhooks.test.ts.
+
+
+@respx.mock
+def test_webhooks_create_with_request_headers():
+    route = respx.post(f"{BASE}/v1/webhooks").mock(return_value=httpx.Response(201, json={
+        "id": "wh3", "url": "https://example.com/wh", "description": None,
+        "enabled": True, "enabled_events": ["message.received"],
+        "signing_secret": "whsec_h", "request_header_names": ["authorization"],
+        "created_at": "2026-09-12T00:00:00Z",
+    }))
+    res = sdk().webhooks.create(
+        url="https://example.com/wh",
+        enabled_events=["message.received"],
+        request_headers={"Authorization": "Bearer receiver-token"},
+    )
+    body = json.loads(route.calls.last.request.content)
+    assert body["request_headers"] == {"Authorization": "Bearer receiver-token"}
+    # Names come back lower-cased and sorted; the VALUE is never returned.
+    assert res["request_header_names"] == ["authorization"]
+    assert "receiver-token" not in json.dumps(res)
+
+
+@respx.mock
+def test_webhooks_create_without_request_headers_omits_the_key():
+    route = respx.post(f"{BASE}/v1/webhooks").mock(return_value=httpx.Response(201, json={
+        "id": "wh4", "url": "https://example.com/wh", "description": None,
+        "enabled": True, "enabled_events": ["message.received"],
+        "signing_secret": "whsec_n", "request_header_names": [],
+        "created_at": "2026-09-12T00:00:00Z",
+    }))
+    res = sdk().webhooks.create(url="https://example.com/wh", enabled_events=["message.received"])
+    body = json.loads(route.calls.last.request.content)
+    assert "request_headers" not in body
+    assert res["request_header_names"] == []
+
+
+def _summary(**overrides: object) -> dict:
+    row = {
+        "id": "wh3", "url": "https://example.com/wh", "description": None,
+        "enabled": True, "enabled_events": ["message.received"],
+        "request_header_names": [],
+        "created_at": "2026-09-12T00:00:00Z", "updated_at": "2026-09-12T00:00:00Z",
+        "consecutive_failures": 0, "last_success_at": None, "last_failure_at": None,
+        "last_error": None, "disabled_at": None, "disabled_reason": None,
+    }
+    row.update(overrides)
+    return row
+
+
+@respx.mock
+def test_webhooks_update_replaces_the_whole_map():
+    route = respx.patch(f"{BASE}/v1/webhooks/wh3").mock(
+        return_value=httpx.Response(200, json=_summary(request_header_names=["x-api-key"]))
+    )
+    res = sdk().webhooks.update("wh3", request_headers={"X-Api-Key": "rotated"})
+    body = json.loads(route.calls.last.request.content)
+    assert body == {"request_headers": {"X-Api-Key": "rotated"}}
+    assert res["request_header_names"] == ["x-api-key"]
+    assert "rotated" not in json.dumps(res)
+
+
+@respx.mock
+def test_webhooks_update_none_clears():
+    route = respx.patch(f"{BASE}/v1/webhooks/wh3").mock(
+        return_value=httpx.Response(200, json=_summary())
+    )
+    res = sdk().webhooks.update("wh3", request_headers=None)
+    body = json.loads(route.calls.last.request.content)
+    # None is a CLEAR, not "absent" — the key must survive serialization.
+    assert "request_headers" in body
+    assert body["request_headers"] is None
+    assert res["request_header_names"] == []
+
+
+@respx.mock
+def test_webhooks_update_absent_leaves_headers_untouched():
+    route = respx.patch(f"{BASE}/v1/webhooks/wh3").mock(
+        return_value=httpx.Response(200, json=_summary(enabled=False, request_header_names=["authorization"]))
+    )
+    res = sdk().webhooks.update("wh3", enabled=False)
+    body = json.loads(route.calls.last.request.content)
+    assert body == {"enabled": False}
+    assert "request_headers" not in body
+    assert res["request_header_names"] == ["authorization"]
+
+
+@respx.mock
+def test_webhooks_list_and_get_surface_names_only():
+    row = _summary(request_header_names=["authorization", "x-api-key"])
+    respx.get(f"{BASE}/v1/webhooks").mock(return_value=httpx.Response(200, json={"webhooks": [row]}))
+    respx.get(f"{BASE}/v1/webhooks/wh3").mock(return_value=httpx.Response(200, json=row))
+    rl = sdk()
+    assert rl.webhooks.list()["webhooks"][0]["request_header_names"] == ["authorization", "x-api-key"]
+    assert rl.webhooks.get("wh3")["request_header_names"] == ["authorization", "x-api-key"]
+
+
+@respx.mock
+def test_webhooks_reserved_header_surfaces_server_code():
+    respx.post(f"{BASE}/v1/webhooks").mock(return_value=httpx.Response(400, json={
+        "error": 'Header name "host" is reserved by ReplyLayer and cannot be set on a webhook.',
+        "code": "WEBHOOK_HEADER_RESERVED",
+    }))
+    with pytest.raises(ReplyLayerError) as exc_info:
+        sdk().webhooks.create(
+            url="https://example.com/wh",
+            enabled_events=["message.received"],
+            request_headers={"Host": "evil.example.com"},
+        )
+    assert exc_info.value.code == "WEBHOOK_HEADER_RESERVED"
+    assert exc_info.value.status_code == 400
+
+
+@respx.mock
+@pytest.mark.asyncio
+async def test_async_webhooks_create_and_clear_mirror_sync():
+    create_route = respx.post(f"{BASE}/v1/webhooks").mock(return_value=httpx.Response(201, json={
+        "id": "wh3", "url": "https://example.com/wh", "description": None,
+        "enabled": True, "enabled_events": ["message.received"],
+        "signing_secret": "whsec_h", "request_header_names": ["authorization"],
+        "created_at": "2026-09-12T00:00:00Z",
+    }))
+    patch_route = respx.patch(f"{BASE}/v1/webhooks/wh3").mock(
+        return_value=httpx.Response(200, json=_summary())
+    )
+    rl = async_sdk()
+    created = await rl.webhooks.create(
+        url="https://example.com/wh",
+        enabled_events=["message.received"],
+        request_headers={"Authorization": "Bearer receiver-token"},
+    )
+    assert json.loads(create_route.calls.last.request.content)["request_headers"] == {
+        "Authorization": "Bearer receiver-token"
+    }
+    assert created["request_header_names"] == ["authorization"]
+
+    cleared = await rl.webhooks.update("wh3", request_headers=None)
+    assert json.loads(patch_route.calls.last.request.content)["request_headers"] is None
+    assert cleared["request_header_names"] == []
+    await rl.aclose()
+
+
 def test_verify_signature_valid():
     payload = '{"event":"message.received"}'
     sig = make_signature(payload, SECRET)