webhooks

Event delivered to your webhook URL

Verify Botmail-Signature before trusting the body: hex(HMAC-SHA256(secret, t + "." + raw_body)) == v1. Respond 2xx within 10 seconds; anything else is retried (5 s doubling, max 1 h). De-duplicate on Botmail-Event-Id.

postWebhookmailboxEvent

Headers

Botmail-Signaturestring required

Botmail-Event-Idstring required

Payload

idstring required

evt_<seq>; same as the Botmail-Event-Id header.

type'message.received' | 'message.sent' | 'message.status' | 'thread.updated' | 'mailbox.claimed' required

mailbox_idstring required

thread_idstring nullable

message_idstring nullable

created_atstring date-time required

dataobject required

Response

Accepted. Any 2xx marks the event delivered.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.