Payload Structure
When an email is delivered to your webhook endpoint, the request body contains a JSON object with the full email data.{
"messageId": "CAOEWyCpfbcjqB-YFzTqZ7=h2g02qCq7WLWa4qZ35N7zvkxK2Mg@mail.gmail.com",
"uid": "9acc5494cd7d20629cec",
"date": "2026-04-23T19:49:41.015503484+00:00",
"subject": "Order Confirmation #1234",
"from": "customer@example.com",
"to": "support@yourdomain.com",
"cc": null,
"bcc": null,
"replyTo": null,
"textBody": "Hi, I'd like to check the status of my order...\r\n",
"htmlBody": "<div dir=\"ltr\">Hi, I'd like to check the status of my order...</div>\r\n",
"attachments": [
{
"filename": "receipt.pdf",
"content_type": "application/pdf",
"size": 24531,
"content": "JVBERi0xLjQK...",
"content_id": null,
"disposition": "attachment"
}
],
"domain": "yourdomain.com",
"messageSize": 4586,
"remoteIp": "2a00:1450:4864:20::532",
"remoteHost": "mail-ed1-x532.google.com",
"headers": {
"Received-SPF": "pass (smtp.jetsmtp.net: domain of customer@example.com designates sender 2a00:1450:4864:20::532)",
"MIME-Version": "1.0",
"Content-Type": "multipart/alternative; boundary=\"000000000000cdc479065025f2d8\"",
"ARC-Seal": "i=1; a=rsa-sha256; t=1776973778; cv=none; d=google.com; s=arc-20240605; b=...",
"DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=google; t=1776973778; ...",
"ARC-Authentication-Results": "i=1; mx.google.com; arc=none",
"ARC-Message-Signature": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; ...",
"Authentication-Results": "smtp.jetsmtp.net; dkim=pass header.i=@example.com header.s=google; spf=pass smtp.mailfrom=\"customer@example.com\"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=example.com; arc=pass (i=1); bimi=none",
"Received": "from mail-ed1-x532.google.com (2a00:1450:4864:20::532) by smtp.jetsmtp.net with ESMTP id 9acc5494cd7d20629cec; Thu, 23 Apr 2026 19:49:43 +0000",
"Message-ID": "CAOEWyCpfbcjqB-YFzTqZ7=h2g02qCq7WLWa4qZ35N7zvkxK2Mg@mail.gmail.com"
}
}
Field Descriptions
| Field | Type | Description |
|---|---|---|
messageId | string | Value of the email Message-ID header |
uid | string | Unique internal ID for this delivery |
date | string | null | Email send date (ISO 8601), from the Date header |
subject | string | null | Email subject line |
from | string | null | Sender address(es) |
to | string | Recipient address(es), comma-separated |
cc | string | null | CC address(es), comma-separated |
bcc | string | null | BCC address(es), comma-separated |
replyTo | string | null | Reply-To header value |
textBody | string | null | Plain text body |
htmlBody | string | null | HTML body |
attachments | array | null | List of attachments (see below) |
domain | string | The receiving domain (e.g. yourdomain.com) |
messageSize | integer | Total size of the raw email in bytes |
remoteIp | string | IP address of the sending mail server |
remoteHost | string | Resolved hostname of the sending mail server |
headers | object | Filtered set of important email headers (see below) |
Attachments
Each attachment in theattachments array contains:
| Field | Type | Description |
|---|---|---|
filename | string | Attachment filename |
content_type | string | MIME type (e.g. application/pdf, image/png) |
size | integer | Size in bytes |
content | string | Base64-encoded file contents |
content_id | string | null | Content-ID for inline attachments (e.g. embedded images) |
disposition | string | attachment or inline |
Attachments are Base64-encoded and included directly in the payload. Large attachments will increase the payload size significantly. Make sure your endpoint can handle the expected payload sizes within the configured timeout.
Headers
Only a filtered subset of email headers are included to keep payload size manageable:| Header | Description |
|---|---|
Message-ID | Unique message identifier |
Date | Original send date |
MIME-Version | MIME version |
Content-Type | Content type and encoding |
Content-Transfer-Encoding | Transfer encoding method |
User-Agent | Sending client user agent |
X-Mailer | Sending mail client |
Authentication-Results | SPF, DKIM, and DMARC results |
Received-SPF | SPF verification result |
DKIM-Signature | DKIM signature |
ARC-Authentication-Results | ARC authentication results |
ARC-Message-Signature | ARC message signature |
ARC-Seal | ARC seal |
Received | Received header chain |
The
Authentication-Results header is useful for checking whether the email passed SPF, DKIM, and DMARC checks at our servers.