Receive & reply

curl -X POST https://api.robotomail.com/v1/webhooks \
  -H "Authorization: Bearer $ROBOTOMAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhooks/email",
    "events": ["message.received"]
  }'

import crypto from "crypto";

app.post("/webhooks/email", (req, res) => {
  // The signature is computed over the raw request body string, not parsed JSON
  const rawBody = req.body; // use express.raw() or express.text() middleware
  const signature = req.headers["x-robotomail-signature"];
  const expected = crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(rawBody)
    .digest("hex");

  if (signature !== expected) return res.status(401).send("Invalid signature");

  const { event, timestamp, data } = JSON.parse(rawBody);

  if (data.over_limit) {
    // Account is over its monthly inbound cap. The payload omits body and
    // attachments — only identity fields are present. The message is safely
    // persisted; upgrading or the first-of-month reset unlocks it.
    console.log(`[over-limit] message_id=${data.message_id} mailbox=${data.mailbox_id}`);
    return res.status(200).send("OK");
  }

  console.log(`[${event}] from ${data.from}: ${data.subject} at ${timestamp}`);

  res.status(200).send("OK");
});

curl -X POST https://api.robotomail.com/v1/mailboxes/MAILBOX_ID/messages \
  -H "Authorization: Bearer $ROBOTOMAIL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": ["sender@example.com"],
    "subject": "Re: Their subject",
    "bodyText": "Thanks for your email! Here is my reply.",
    "inReplyTo": "<original-message-id@example.com>"
  }'

curl "https://api.robotomail.com/v1/mailboxes/MAILBOX_ID/messages?direction=INBOUND&since=2026-03-11T00:00:00Z" \
  -H "Authorization: Bearer $ROBOTOMAIL_API_KEY"