Inboxes

Set the inbox webhook: an HMAC-signed POST for every inbound message

Registers one https webhook per inbox. Each inbound message triggers a signed POST carrying metadata, the extracted verification code and links, and the injection-risk scan - never the message body (fetch content with the mailbox token). Verify X-MachineInbox-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<body>"> using the returned secret; reject timestamps older than five minutes. Failed deliveries retry with backoff; after 20 consecutive failures the webhook is disabled until the next PUT.

put/api/v1/inboxes/{inboxId}/webhook

Request

  • Base URL: https://machineinbox.com
  • URL: https://machineinbox.com/api/v1/inboxes/{inboxId}/webhook
  • Auth: none required

Path parameters

inboxIdstring uuid required

Request body

urlstring uri required

Public https URL. Private addresses, IP literals, and this service's own hosts are rejected.

Response

Webhook stored. The derived signing secret is returned on every PUT.

secretstring required

HMAC-SHA256 signing secret for X-MachineInbox-Signature. Returned on every PUT; never shown elsewhere.

secretNoticestring required

Changes

No recorded changes to this operation across all 1 revision of this API.