---
title: "A message was received"
method: POST
path: "inbound"
tags: ["Received mail"]
---

# A message was received

`POST inbound` (webhook)

A message was received on an inbound stream: the reference, or the reference and the message itself, as the webhook asks.

## Headers

- `Sendora-Signature` string, required
- `Sendora-Event` string, required
- `Sendora-Delivery-Id` string, required
- `User-Agent` string, required

## Payload

- union: A message was received on an inbound stream: the reference, or the reference and the message itself, as the webhook asks.
  - object: The reference to the received message, for a webhook with `inboundContent` reference.
    - `id` string, required: The delivery's id. A delivery may arrive more than once, so key your handling on it.
    - `attempt` integer, required: The attempt number, from 1.
    - `event` 'inbound', required
    - `inboundMessageId` string, required: The received message; GET /v1/inbound/{id} reads it.
    - `serverId` string, required: The server whose stream received it.
    - `streamId` string, required: The inbound stream that received it.
    - `receivedAt` string, date-time, required: When the message was accepted from the sending server.
    - `envelopeRecipient` string, required: The address of yours the message was sent to.
    - `mailboxHash` string, nullable, required: The text after `+` in the local part of that address, when the sender used one.
    - `sizeBytes` integer, required: The size of the message as received, in bytes.
    - `attachmentCount` integer, required
    - `hasText` boolean, required
    - `hasHtml` boolean, required
    - `authentication` object, required: What Sendora found when it checked the message's authentication; `unchecked` until the checks have run.
      - `spf` 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror' | 'unchecked', required: SPF for the address in MAIL FROM.
      - `spfHelo` 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror' | 'unchecked', required: SPF for the name the sending server gave in HELO.
      - `dkim` 'pass' | 'fail' | 'none' | 'temperror' | 'permerror' | 'unchecked', required
      - `dmarc` 'pass' | 'fail' | 'none' | 'temperror' | 'permerror' | 'unchecked', required
      - `dmarcPolicy` 'none' | 'quarantine' | 'reject', nullable, required: What the sender's domain asks for; told only when DMARC failed.
      - `arc` 'none' | 'pass' | 'fail' | 'unchecked', required
      - `checkedAt` string, date-time, nullable, required: When the checks ran; null until they have.
    - `parseIssue` string, nullable, required: What the parser met; null when the message parsed clean. A hard issue empties the parsed parts, and the raw message stays: `no_headers`, `header_block_too_large`, `too_many_headers`, `too_many_parts`, `nesting_too_deep`, `missing_boundary`, `decoded_too_large`, `parse_timeout`, `parser_error`. A soft issue keeps them and says what was changed or dropped: `truncated_multipart`, `too_many_attachments`, `unknown_transfer_encoding`, `undecodable_container`, `filename_sanitised`, `control_chars_stripped`, `multiple_from`, `duplicate_header`, `malformed_header_dropped`, `address_list_truncated`, `header_value_truncated`. A message with several names the hard one, or the first soft one in this order.
  - object: The reference and the message itself, for a webhook with `inboundContent` full.
    - `id` string, required: The delivery's id. A delivery may arrive more than once, so key your handling on it.
    - `attempt` integer, required: The attempt number, from 1.
    - `event` 'inbound', required
    - `inboundMessageId` string, required: The received message; GET /v1/inbound/{id} reads it.
    - `serverId` string, required: The server whose stream received it.
    - `streamId` string, required: The inbound stream that received it.
    - `receivedAt` string, date-time, required: When the message was accepted from the sending server.
    - `envelopeRecipient` string, required: The address of yours the message was sent to.
    - `mailboxHash` string, nullable, required: The text after `+` in the local part of that address, when the sender used one.
    - `sizeBytes` integer, required: The size of the message as received, in bytes.
    - `attachmentCount` integer, required
    - `hasText` boolean, required
    - `hasHtml` boolean, required
    - `authentication` object, required: What Sendora found when it checked the message's authentication; `unchecked` until the checks have run.
      - `spf` 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror' | 'unchecked', required: SPF for the address in MAIL FROM.
      - `spfHelo` 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror' | 'unchecked', required: SPF for the name the sending server gave in HELO.
      - `dkim` 'pass' | 'fail' | 'none' | 'temperror' | 'permerror' | 'unchecked', required
      - `dmarc` 'pass' | 'fail' | 'none' | 'temperror' | 'permerror' | 'unchecked', required
      - `dmarcPolicy` 'none' | 'quarantine' | 'reject', nullable, required: What the sender's domain asks for; told only when DMARC failed.
      - `arc` 'none' | 'pass' | 'fail' | 'unchecked', required
      - `checkedAt` string, date-time, nullable, required: When the checks ran; null until they have.
    - `parseIssue` string, nullable, required: What the parser met; null when the message parsed clean. A hard issue empties the parsed parts, and the raw message stays: `no_headers`, `header_block_too_large`, `too_many_headers`, `too_many_parts`, `nesting_too_deep`, `missing_boundary`, `decoded_too_large`, `parse_timeout`, `parser_error`. A soft issue keeps them and says what was changed or dropped: `truncated_multipart`, `too_many_attachments`, `unknown_transfer_encoding`, `undecodable_container`, `filename_sanitised`, `control_chars_stripped`, `multiple_from`, `duplicate_header`, `malformed_header_dropped`, `address_list_truncated`, `header_value_truncated`. A message with several names the hard one, or the first soft one in this order.
    - `envelope` object, nullable, required: The envelope sender; null for a bounce.
      - `sender` string, nullable, required
    - `from` object, nullable, required
      - `address` string, required
      - `name` string, nullable, required
    - `replyTo` object[], required
      - `address` string, required
      - `name` string, nullable, required
    - `to` object[], required: Up to 100 entries; `toCount` is the whole number.
      - `address` string, required
      - `name` string, nullable, required
    - `toCount` integer, required
    - `cc` object[], required: Up to 100 entries; `ccCount` is the whole number.
      - `address` string, required
      - `name` string, nullable, required
    - `ccCount` integer, required
    - `subject` string, nullable, required
    - `date` string, date-time, nullable, required: The sender's Date header, when it was a real moment.
    - `messageIdHeader` string, nullable, required
    - `inReplyTo` string, nullable, required
    - `references` string[], required
    - `headers` object[], required
      - `name` string, required
      - `value` string, required
    - `text` string, nullable, required: The plain-text body; null when there is none, or over 1 MiB.
    - `html` string, nullable, required: The HTML body; null when there is none, or over 2 MiB.
    - `attachments` object[], required: Each attachment, without its bytes.
      - `position` integer, required: Its place among the message's attachments, from 0.
      - `name` string, required
      - `contentType` string, required
      - `contentId` string, nullable, required: The Content-ID an HTML body refers to with `cid:`, when it has one.
      - `size` integer, required
      - `inline` boolean, required: True for a part shown in the body rather than offered as a file.
    - `contentOmitted` 'too_large' | 'expired', nullable, required: `too_large` when text or HTML was left out for size; `expired` when the content window has passed and the reference is all that remains.

## Acknowledgement `2XX`

Acknowledges the delivery. Any other answer, or none within 10 seconds, is retried.

---

[API](https://skmtc.dev/sendora/apis/sendora-api.md) · [All operations](https://skmtc.dev/sendora/apis/sendora-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendora/apis/sendora-api/revisions/72efbbb34b64?raw)