Give your agent a real email address. Out by API. In by webhook.

Most “email for agents” stops at sending. The interesting work starts when the answer comes back: a customer replies, a vendor sends the invoice, another agent asks a question. Oveyon closes the loop in the same account — your domain's MX points at us, a route decides which addresses exist, and each message reaches your endpoint as a signed event with the reply headers intact.

Because inReplyTo and messageIdHeader travel with the event, and because you can set your own In-Reply-To and References headers on POST /v1/send, the agent can hold a real conversation: threads stay threads in the recipient's mailbox, and your side keeps a stable id per delivery to deduplicate retries.

What the agent gets, concretely:

• An identity — agent@yourdomain.com, authenticated with SPF, DKIM and DMARC on your domain, not a shared pool address.
• A memory — every received message is stored and readable later by API (GET /v1/inbound/{uid}, /content, /raw, /attachments/{n}), not only at webhook time.
• Feedback — accepted, delivered, bounced, complained come back as signed events, so the agent knows what happened instead of assuming.
• A brake — suppressions, send policies and rate limits are enforced by the platform at send time, not by the prompt.

Point your domain's MX at Oveyon and create routes: named addresses (agent@, invoices@) or a catch-all. Attach a channel to each route. For an agent, the channel is a webhook, in one of three modes: summary (metadata only), full (text and HTML), or full+attachments (files inline, with size caps and a URL for anything larger).

A webhook URL is never saved blindly. Oveyon first POSTs a url_verification challenge — with the same three signature headers as real deliveries — and only keeps the URL if your endpoint echoes the challenge with a 2xx. Then every delivery carries x-oveyon-event, x-oveyon-timestamp and x-oveyon-signature. The timestamp is inside the signed material, so a captured POST cannot be replayed with a fresh stamp.

Verify

sha256=HMAC-SHA256(secret, timestamp + "." + rawBody); reject if |now − timestamp| > 300 s

Deduplicate

by eventId — retries and redeliveries repeat the same value

Read later

GET /v1/inbound, /v1/inbound/{uid}, /content, /raw, /attachments/{n}

Signals

authentication.spf/dkim/dmarc, spamScore (0–100), inReplyTo, messageIdHeader

# what your endpoint receives
POST https://agent.yourdomain.com/hook
x-oveyon-event: inbound.received
x-oveyon-timestamp: 1756041600
x-oveyon-signature: sha256=9c4f2b7e…
content-type: application/json

{
  "event": "inbound.received",
  "eventId": "6e5a1b90-3c77-4f02-b1ad-8e4409c2d611",
  "schemaVersion": 1,
  "message": {
    "id": "b71e0c34-5a2f-4d18-9c60-77ab31e2d905",
    "receivedAt": "2026-08-05T09:14:02.317Z",
    "from": "customer@example.com",
    "fromName": "Dana",
    "subject": "Re: your quote",
    "messageIdHeader": "<a1b2@example.com>",
    "inReplyTo": "<z9@yourdomain.com>",
    "authentication": { "spf": "pass", "dkim": "pass", "dmarc": "pass" },
    "spamScore": 2,
    "attachmentCount": 1,
    "url": "https://api.oveyon.com/v1/inbound/b71e0c34-…"
  },
  "recipient": { "id": "4d2f77a1-…", "to": "agent@yourdomain.com" }
}