The bulk.completed and bulk.api.completed events send {event, data, timestamp}, signed with HMAC-SHA256 in the X-Webhook-Signature header.
Three attempts: immediately, then after 1 and 4 seconds. Your server has 10 seconds to respond. Deliveries can be viewed in the webhook logs.