{
"event": "email.received",
"data": {
"id": "0199f3a1-5c2e-7d40-9a1b-2c3d4e5f6a7b",
"address": {
"id": "0199f2b0-1a2b-7c3d-8e4f-5a6b7c8d9e0f",
"domain": "inbound.acme.sa",
"kind": "domain"
},
"to": [
"orders@inbound.acme.sa"
],
"from": {
"name": "سارة",
"address": "sara@example.com"
},
"subject": "استفسار عن الطلب 1042",
"spam": false,
"has_attachments": true,
"attachments_count": 1,
"size": 48211,
"status": "ready",
"thread": {
"email_id": "0199f1c2-7a41-7c3e-9d2b-5e8f1a2b3c4d",
"received_id": null
},
"received_at": "2026-10-26T09:12:03+00:00",
"envelope_from": "bounce-123@mail.example.com",
"message_id": "<CAF=abc@mail.example.com>",
"in_reply_to": "<0102019a1b2c3d4e-5f6a7b8c@mail.acme.sa>",
"authentication": {
"spf": "pass",
"dkim": "pass",
"dmarc": "pass",
"dmarc_policy": null
},
"parse": "ready",
"attachments": [
{
"id": "0199f3a2-0b1c-7d2e-8f3a-4b5c6d7e8f90",
"filename": "فاتورة.pdf",
"content_type": "application/pdf",
"size": 20311,
"inline": false,
"risky": false
}
]
},
"type": "email.received",
"timestamp": "2026-10-26T09:12:03.000Z",
"sent_at": "1792577523601"
}Email received
email.received. An e-mail reached one of the application’s receiving addresses and was read: metadata only (the sender, the subject, the attachments’ facts, the verdicts), never a body or a header; read the e-mail with GET /v1/email/received/{id}. Sent once per e-mail, after it was read or could not be (data.parse failed). Sent to the application’s webhook endpoints that chose it. Verify one scheme against the raw body before trusting it: on an endpoint with Standard signing on, Standard Webhooks’ webhook-signature with its whsec_ secret (recommended there); otherwise tawked-signature with the webhook secret, and make handling idempotent on tawked-webhook-id: a delivery can arrive more than once, and deliveries are not guaranteed to arrive in order.
{
"event": "email.received",
"data": {
"id": "0199f3a1-5c2e-7d40-9a1b-2c3d4e5f6a7b",
"address": {
"id": "0199f2b0-1a2b-7c3d-8e4f-5a6b7c8d9e0f",
"domain": "inbound.acme.sa",
"kind": "domain"
},
"to": [
"orders@inbound.acme.sa"
],
"from": {
"name": "سارة",
"address": "sara@example.com"
},
"subject": "استفسار عن الطلب 1042",
"spam": false,
"has_attachments": true,
"attachments_count": 1,
"size": 48211,
"status": "ready",
"thread": {
"email_id": "0199f1c2-7a41-7c3e-9d2b-5e8f1a2b3c4d",
"received_id": null
},
"received_at": "2026-10-26T09:12:03+00:00",
"envelope_from": "bounce-123@mail.example.com",
"message_id": "<CAF=abc@mail.example.com>",
"in_reply_to": "<0102019a1b2c3d4e-5f6a7b8c@mail.acme.sa>",
"authentication": {
"spf": "pass",
"dkim": "pass",
"dmarc": "pass",
"dmarc_policy": null
},
"parse": "ready",
"attachments": [
{
"id": "0199f3a2-0b1c-7d2e-8f3a-4b5c6d7e8f90",
"filename": "فاتورة.pdf",
"content_type": "application/pdf",
"size": 20311,
"inline": false,
"risky": false
}
]
},
"type": "email.received",
"timestamp": "2026-10-26T09:12:03.000Z",
"sent_at": "1792577523601"
}Authorizations
Authorization: Bearer . An application key (tk_live_, tk_test_) has full access, which covers every product and any product added later, or custom access, chosen when the key is created: one or more of the scopes verify:check, verify:send (includes verify:check), notifications:read, notifications:send (includes notifications:read), email:read, email:send (includes email:read), email:manage (includes email:send), webhooks:manage, email:inbound, notifications:templates (includes notifications:read), chat:menus, chat:attendant. No key made on the API keys page holds notifications:templates, full access included: the three template writes answer such a key 403 insufficient_scope. A connected app's key holds it. Nor chat:menus: the five conversation menu operations answer such a key 403 insufficient_scope, and a connected app's key holds it once the client approved it. Nor chat:attendant: the five auto-attendant operations answer such a key 403 insufficient_scope too, and a connected app's key holds it once the client approved it. email:manage and webhooks:manage are held only by a key someone chose them for: a full-access key, old or new, never holds them. email:inbound, which reads, deletes and forwards received e-mail, is opt-in on every key, full access included: a key holds it only when it was turned on when the key was created. A call outside the key's access answers 403 insufficient_scope and names the scope it needs in the WWW-Authenticate response header. A partner key (tk_partner_) always has full access. Whatever its access, a key is a server-side secret.
Headers
Milliseconds since the epoch, as a string; the same value as sent_at.
Hex HMAC-SHA256 of "{timestamp}.{raw body}" with your webhook secret.
The event name, the same as event in the body.
email.received The event's id, the same on every retry and on a delivery sent again from the console: dedupe on it.
Standard Webhooks, sent when the endpoint's Standard signing is on: the same as tawked-webhook-id.
Standard Webhooks, sent when the endpoint's Standard signing is on: the same instant as tawked-timestamp, in seconds.
Standard Webhooks, sent when the endpoint's Standard signing is on: v1,<base64> of HMAC-SHA256 of "{webhook-id}.{webhook-timestamp}.{raw body}" with the base64-decoded part of your whsec_ secret; during a rotation's grace a space and the previous secret's signature follow.
Body
Show child attributes
Show child attributes
On a test key's event only (simulated: nothing was sent or received). On email.received it is the only sign of a simulated e-mail.
test true on a console test event and on Tawked's test message to a new receiving address; never on a customer's event.
Response
Any 2xx answer within 5 seconds acknowledges the delivery. Anything else, a redirect or no answer in time is retried: 5 attempts in all, the first at once and the next after 1 min, 5 min, 30 min, 2 h.