---
title: "email.message.received"
method: POST
path: "email.message.received"
---

# email.message.received

`POST email.message.received` (webhook)

Sent to every active endpoint subscribed to this event. Endpoints without a secret receive no signing header. When a secret is configured, verify `X-Custodo-Signature` before trusting the body: it is `t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>" keyed with the endpoint’s whsec_… secret>`; reject a `t` more than five minutes away. Answer any 2xx to acknowledge; anything else is retried with backoff.

## Headers

- `X-Custodo-Event` string, required
- `X-Custodo-Delivery` string, required
- `X-Custodo-Signature` string

## Payload

- object
  - `id` string, uuid, required: The delivery id.
  - `event` 'email.message.received', required
  - `tenant_id` string, uuid, required
  - `created_at` string, date-time, required
  - `data` object, required: The event’s own payload: ids and scalars, never content.
    - `accountId` string, required
    - `messageId` string, required
    - `recipientUserIds` string[], required
    - `receivedAt` string, required
    - `fromName` string, nullable, required
    - `subject` string, required
    - `from` string, required
    - `to` string[], required
    - `cc` string[], required
    - `hasAttachments` boolean, required
    - `pecType` 'none' | 'accettazione' | 'presa-in-carico' | 'avvenuta-consegna' | 'mancata-consegna' | 'rilevazione-virus' | 'busta-di-trasporto' | 'errore', required
    - `inReplyTo` string, nullable, required
    - `references` string, nullable, required
    - `rfcMessageId` string, nullable, required
    - `replyToContext` object, nullable, required
      - `type` string, required
      - `id` string, required
    - `attachments` object[], required
      - `attachmentId` string, required
      - `sha256` string, required
      - `filename` string, required
      - `contentType` string, required
      - `sizeBytes` number, required

## Acknowledgement `2XX`

Acknowledged; nothing is retried.

---

[API](https://skmtc.dev/custodo/apis/custodo-integrazioni.md) · [All operations](https://skmtc.dev/custodo/apis/custodo-integrazioni/llms.txt) · [OpenAPI document](https://skmtc.dev/custodo/apis/custodo-integrazioni/revisions/16d336d3ec2a?raw)