---
title: "A message we already delivered turned malicious (a link was listed AFTER delivery)"
method: POST
path: "inbound.retro_flagged"
---

# A message we already delivered turned malicious (a link was listed AFTER delivery)

`POST inbound.retro_flagged` (webhook)

## Headers

- `x-oveyon-event` string, required
- `x-oveyon-timestamp` integer, required
- `x-oveyon-signature` string, required

## Payload

- InboundRetroFlagged: Body of the `inbound.retro_flagged` webhook: a link we delivered as clean is now listed.
  - `event` 'inbound.retro_flagged'
  - `eventId` string, uuid: Unique per POST (it is the delivery uid, never reused) — dedupe on it. Distinct from the eventId of the original inbound.received.
  - `timestamp` string, date-time
  - `message` object
    - `id` string
    - `subject` string, nullable
    - `fromHeader` string, nullable
  - `recipient` object
    - `id` string
    - `to` string
  - `retro` object
    - `reason` 'link_listed_after_delivery'
    - `message` string
    - `links` object[]
      - `url` string
      - `threatTypes` string[], nullable

## Acknowledgement `200`

Answer 2xx fast. The message itself was NOT changed — it stays delivered; this is a warning, not a recall.

---

[API](https://skmtc.dev/oveyon/apis/oveyon-api.md) · [All operations](https://skmtc.dev/oveyon/apis/oveyon-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oveyon/apis/oveyon-api/revisions/abf64c09d297?raw)