Webhook payload

Inbound email webhook — what you get

Every field explained, with what you can do with it. This is the data your endpoint receives for every incoming email.

Sender & recipient

Who sent the email and which alias received it. Use these fields to route, filter, or log by source. 

{
  "message": {
    "sender": {
      "name": "Alice Martin",
      "email": "alice@acme.com"
    },
    "recipient": {
      "name": null,
      "email": "invoices+acme@yourcompany.com",
      "tag": "acme"
    },
    "subject": "Invoice #1042 — February 2026"
  }
}

Practical use: Match sender.email against known contacts to auto-route. Use recipient.email to determine which alias — and therefore which workflow — should handle this email. Plus-addressed mail (invoices+acme@) hands you the tag pre-parsed in recipient.tag, so a single alias can carry an unlimited number of routing keys.

Content — three formats

Text and HTML arrive on every plan. Markdown is generated server-side on Maker and above, once you switch it on for the alias — it is off by default. Use whichever fits your pipeline. 

"content": {
  "text": "Hi, please find the invoice attached...",
  "html": "<p>Hi, please find the invoice...</p>",
  "markdown": "Hi, please find the invoice attached...",
  "links": [
    {
      "url": "https://acme.com/pay/1042",
      "domain": "acme.com",
      "anchorText": "Pay now",
      "source": "html"
    }
  ]
}
Plain text

Best for search indexing, keyword matching, and feeding to LLMs. Clean, no markup.

HTML

The original email markup. Use when you need to render the email exactly as it was sent.

Markdown

Structured but readable. Great for AI processing, ticket descriptions, and CRM notes.

Practical use: Feed content.markdown to your LLM for classification or summarisation. Use content.links to extract tracking URLs from shipping notifications or payment links from invoices. Every plan gets url and domain; anchorText and source are on Maker and up.

Attachments

Attachments are processed automatically. Small files are embedded inline; larger files are offloaded to EU-hosted S3 and reachable through a downloadUrl in the payload. Emails are accepted up to 10MB in total. 

"attachments": [
  {
    "filename": "invoice-1042.pdf",
    "contentType": "application/pdf",
    "size": 48210,
    "downloadUrl": "https://app.emailconnect.eu/attachments/9f8e7d6c5b4a3f2e/download",
    "status": "completed",
    "uploadType": "sync",
    "virusScan": {
      "status": "clean",
      "duration": 21
    }
  }
]
Inline (base64)Free plan

Small files come back base64-encoded in the payload itself. Free embeds up to 128KB; paid plans up to 2MB.

S3-offloadedMaker+

Bigger files — and anything we can't inline, like archives and media — are stored in Scaleway (France) S3 or your own S3-compatible storage, and you fetch them via downloadUrl. The 10MB email limit is the ceiling.

Practical use: Pipe downloadUrl to your document processing pipeline. Invoices to accounting, contracts to legal review, images to your media library. The URL points at EmailConnect and redirects to a short-lived signed link when you fetch it, so downloads stay counted, expirable, and in-region — it keeps working for as long as your retention window.

Spam scoring & authentication

Every email is scored for spam and verified against DKIM, SPF, and DMARC. You get the results — you decide the threshold. 

"spam": {
  "score": 0.2,
  "engine": "rspamd",
  "authentication": {
    "dkim": { "result": "pass" },
    "spf": { "result": "pass" },
    "dmarc": { "result": "pass" }
  }
}
DKIM

Verifies the email wasn't altered in transit. A "pass" means the content is exactly what the sender signed.

SPF

Confirms the sending server is authorised to send for that domain. Prevents spoofing.

DMARC

The domain owner's policy on what to do with emails that fail DKIM or SPF. Tells you the sender's intent.

Practical use: Reject or quarantine emails where authentication.dkim.result is "fail" before processing. Use spam.score as a threshold — only process emails below your acceptable risk level.

Virus scanning Business+

On Business+ plans every attachment is scanned with ClamAV before your webhook fires. Clean files are delivered normally; infected files are excluded from the payload and flagged with a reason. You get per-attachment results and a top-level security summary.

Clean attachment
{
  "filename": "invoice-1042.pdf",
  "contentType": "application/pdf",
  "size": 48210,
  "downloadUrl": "https://app.emailconnect.eu/attachments/9f8e7d6c5b4a3f2e/download",
  "virusScan": {
    "status": "clean",
    "duration": 21
  }
}
Infected attachment (rejected)
{
  "filename": "eicar_com.zip",
  "contentType": "application/x-zip-compressed",
  "size": 184,
  "excluded": true,
  "excludeReason": "virus-detected",
  "status": "rejected",
  "virusScan": {
    "status": "infected",
    "threat": "Eicar-Test-Signature",
    "duration": 17
  }
}
"security": {
  "virusScan": {
    "scanned": true,
    "engine": "clamav",
    "engineVersion": "1.5.1",
    "attachmentsScanned": 1,
    "threatsFound": 0
  }
}

Practical use: Check virusScan.status on each attachment before processing — skip or quarantine anything not marked "clean". Use security.virusScan.threatsFound for audit logging and compliance dashboards.

Webhook integrity

Every webhook POST is signed following the Standard Webhooks convention. The signature travels in the HTTP headers, not in the body — verify it to confirm the request came from EmailConnect, not a third party. Separately, the payload carries content hashes you can use to deduplicate deliveries or build an audit trail. 

// Standard Webhooks headers — this is where the signature lives
webhook-id: msg_2KWPBgLl...
webhook-timestamp: 1716300000
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQ...

// Payload field — hashes only, no signature
"integrity": {
  "contentHash": "a3f2b8c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1",
  "rawEmailHash": "9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e"
}

Practical use: Always verify the webhook-signature header before processing — that, and not anything in the body, is what stops someone spoofing calls to your endpoint. Use integrity.contentHash to skip a redelivery you've already handled. Hashes are Maker+. See code examples on the homepage integration section.

Live on Business+

Build your own payload

Pick exactly which fields you need per alias. Strip what you don't. Want just the sender, subject, and attachments? Configure it. Need the full payload with authentication details? Keep it all. Per-alias payload configuration for complete control over what your endpoint receives.

Start free — try the payload builder

Need anything? We're one email away.

What teams build with this data

The same payload powers very different workflows depending on which fields you use.

Shipping & order tracking

Extract tracking URLs from content.links in order confirmation emails. Auto-update your fulfilment dashboard.

Invoice processing

Pipe attachments[].downloadUrl to your accounting system. Match sender.email to known vendors.

AI classification

Feed content.markdown to your LLM to classify intent, extract entities, or summarise — with clean, structured input.

Security & compliance

Check spam.authentication results before processing. Reject unauthenticated senders to protect your pipeline from spoofed emails.

Try it yourself

Send an email and see the full payload in real time. No signup required for the live demo.

Start free Try live demo

Try it free

Send an email and see this payload in real time. No credit card needed.

Start freeLive demo

Related