Inbound email API

Inbound routes

Use GET /api/v1/inbound-routes to list routes and POST /api/v1/inbound-routes with a read_write token to create a webhook route on an eligible domain.

curl --fail-with-body "$API_BASE_URL/api/v1/inbound-routes"   --request POST   --header "Authorization: Bearer $EMAIA_API_TOKEN"   --header "Content-Type: application/json"   --data '{
    "domainId": "DOMAIN_ID",
    "localPart": "automation",
    "webhookUrl": "https://customer.example/webhooks/email",
    "enabled": true,
    "retentionDays": 30
  }'

The creation response may contain a signing secret that is shown only once. Store it immediately in a secret manager. Use the Console or the documented update, test, secret-regeneration, and delete operations to manage the route lifecycle.

List received messages

GET /api/v1/inbound-messages?routeId=ROUTE_ID&limit=50

A read or read_write token can list recent messages for a route in its organization. The limit defaults to 50 and cannot exceed 100. Use the returned message ID to request GET /api/v1/inbound-messages/{id}.

Retention and raw messages

GET /api/v1/inbound-messages/{id}/raw returns available RFC 822 content as message/rfc822. A 404 hides records outside the authenticated organization; 410 means the record remains but raw content has expired or been removed.

Retention is configured per route. Fetch and store any content your application must preserve; do not treat the service as your only archive.

Webhook delivery

The route-management API and the webhook delivery contract are complementary. Follow the Inbound email webhooks guide for signature verification, payloads, duplicate delivery, retry responses, secret rotation, and test events.

Operational safety

• Verify webhook signatures before parsing or acting on content.
• Expect duplicate deliveries and deduplicate on the stable webhook or message ID.
• Apply content-type, file-size, malware, and authorization controls before processing attachments or links.
• Keep route secrets and API tokens separate and rotate either credential after suspected exposure.