Outbound email delivery events

Managed delivery integration

Message.com configures its email provider’s delivery webhook. Customers do not need their own provider account or a webhook signing secret to send ticket replies. There is no customer “Outbound email” setting for rotating the platform’s provider secret.

The internal POST /api/v1/email/outbound-webhook route receives provider events. It is not the destination for your application’s customer webhooks; use the relevant product webhook configuration for that.

Authentication

The provider sends svix-id, svix-timestamp and svix-signature. Verification uses the platform-managed signing secret, exact raw body and an allowed clock difference of five minutes. A list of signatures in a delivery does not imply a customer-configurable 24-hour secret rotation window.

Delivery and suppression

Events are matched to stored provider message IDs. email.sent and email.delivered update delivery state. A delivered status means the receiving mail server accepted it, not that the customer read it.

Permanent bounces and complaints add a recipient suppression in the owning workspace. Soft-bounce counts are tracked on the matched message; this is not a 30-day recipient-wide counter. Other supported safeguards may block mail before the provider is called. See the suppression reference before removing a block.

Acknowledgements

A successful HTTP acknowledgement alone does not prove delivery. Invalid signatures return HTTP 401 invalid_signature. A malformed event returns HTTP 200 with ok:false and error:invalid_payload; events without a matching message may also be acknowledged without changing ticket state.

If replies stop arriving, inspect the message delivery state and suppression reason in Message.com. Do not repeatedly resend to a bounced or opted-out address.