An endpoint is a webhook destination — a URL Inboundr POSTs to whenever mail arrives for an address (or catch-all) routed to it. Endpoints own the delivery settings: the signing secret, custom headers, timeout, and retry budget.

​
Creating an endpoint

The response includes a secret (prefixed whsec_) shown only once — store it to verify signatures.

​
Settings

​
string
required
The HTTPS (or HTTP) URL to deliver to. Must resolve to a public host — private and internal addresses are rejected by an SSRF guard.
​
object
Up to 10 custom headers sent with every delivery (e.g. an Authorization header for your own auth). Reserved headers like Content-Type and the X-Inboundr-* set (and the legacy X-Inbound-* spellings) can’t be overridden.
​
number
default:"10"
Per-request timeout, 1–30 seconds. A slow response counts as a failed attempt.
​
number
default:"5"
Total delivery attempts (first + retries), 1–10, before a delivery is marked dead.

​
Slack and Discord

Besides a webhook, an endpoint can post a formatted notification straight to a Slack or Discord channel — pass "type": "slack" or "type": "discord" when creating it, with url set to that channel’s incoming-webhook URL (from Slack: workspace settings → Incoming Webhooks; from Discord: channel settings → Integrations → Webhooks). Delivery, retries, and timeoutSeconds/ maxAttempts work exactly like a webhook — the only difference is the body: a Slack/Discord message instead of raw JSON, and no signing (neither platform verifies one).

​
Delivery, signing, and retries

Every delivery is signed with the endpoint’s secret and carries these headers: The legacy X-Inbound-* spellings are sent alongside these with identical values, and will be withdrawn once no endpoint depends on them. Failed deliveries retry with exponential backoff (1m → 5m → 30m → 2h) until they succeed or exhaust maxAttempts, after which they’re marked dead and surfaced in the console. See Retries & delivery.
Redirects are not followed — a 3xx response is recorded as a failed attempt. Point the endpoint at the final URL.

Verify signatures

Validate the HMAC signature on every delivery.

Endpoints API

Create and list endpoints.