---
title: "New mail arrived"
method: POST
path: "message.inbound"
---

# New mail arrived

`POST message.inbound` (webhook)

Sent to your endpoint for `message.inbound`. Respond with a 2xx within 10 seconds; timeouts and non-2xx responses are retried on a backoff (7 attempts in total over about 21 hours). Redirects are not followed.

## Headers

- `X-SuperMail-Event` 'message.inbound', required
- `X-SuperMail-Delivery` string, required
- `X-SuperMail-Timestamp` string, required
- `X-SuperMail-Signature` string, required

## Payload

- object: Every webhook POST body. Verify `X-SuperMail-Signature: t=<unix>,v1=<hex>` where hex = HMAC-SHA256(secret, `<t>.<raw body>`), and reject timestamps more than 5 minutes old.
  - `id` string, required: Delivery id (also `X-SuperMail-Delivery`).
  - `event` 'message.inbound', required
  - `createdAt` string, date-time, required
  - `data` object, required: `message.inbound` — metadata only; fetch the body with `GET /messages/{emailId}`.
    - `emailId` string: Internal message id — `GET /api/v1/messages/{emailId}`.
    - `threadId` string
    - `mailboxId` string
    - `mailbox` string, email
    - `messageId` string: RFC 5322 Message-ID.
    - `inReplyTo` string, nullable: RFC In-Reply-To, when present.
    - `from` EmailAddress
      - `email` string, email, required
      - `name` string
    - `to` EmailAddress[]
      - `email` string, email, required
      - `name` string
    - `cc` EmailAddress[]
      - `email` string, email, required
      - `name` string
    - `subject` string
    - `snippet` string
    - `hasAttachments` boolean
    - `attachmentCount` integer
    - `isSpam` boolean: Filed to Spam on arrival.
    - `receivedAt` string, date-time

## Acknowledgement `200`

Acknowledged.

---

[API](https://skmtc.dev/supermailos/apis/supermailos-api.md) · [All operations](https://skmtc.dev/supermailos/apis/supermailos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/supermailos/apis/supermailos-api/revisions/5bd0ce2ee269?raw)