Email received (per recipient; stable eventId for deduplication)

postWebhookinbound.received

Headers

x-oveyon-eventstring required

x-oveyon-timestampinteger required

Epoch seconds. Reject if |now − timestamp| > 300 s.

x-oveyon-signaturestring required

sha256= + HMAC-SHA256(secret, timestamp + "." + raw body).

Payload

event'inbound.received'

eventIdstring uuid

schemaVersioninteger

timestampstring date-time

textstring nullable

Full text body (modes full / full+attachments), capped per field.

htmlstring nullable

Third-party HTML — sanitize before rendering.

replyTextstring nullable

The NEW text of the message with quoted history, Outlook/forwarded headers and the RFC 3676 signature removed (pt/en). Feed this to a model, not text. Equals text when nothing was quoted.

replyStrippedboolean

True when something was removed to produce replyText.

replyMarkersstring[]

What was recognized and removed.

Response

Answer 2xx fast; do the heavy work afterwards.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.