Email agents trust.

Most “email for agents” stops at sending. The interesting work starts when the answer comes back: a customer replies, a vendor sends the invoice, another agent asks a question. Oveyon closes the loop in the same account — your domain’s MX points at us, a mailbox decides which addresses exist, and each message reaches your endpoint as a signed event with the reply headers intact, and with the verdict.

Because inReplyTo and messageIdHeader travel with the event, and because you can set your own In-Reply-To and References headers on POST /v1/send, the agent can hold a real conversation: threads stay threads in the recipient’s mailbox, and your side keeps a stable id per delivery to deduplicate retries.

Point your domain’s MX at Oveyon and create mailboxes: named addresses (agent@, invoices@) or a catch-all. Attach channels to each one. For an agent, the channel is a webhook, in one of three modes: summary (metadata only), full (text and HTML), or full+attachments (files inline, with size caps and a URL for anything larger).

A webhook URL is never saved blindly. Oveyon first POSTs a url_verification challenge — with the same three signature headers as real deliveries — and only keeps the URL if your endpoint echoes the challenge with a 2xx. Then every delivery carries x-oveyon-event, x-oveyon-timestamp and x-oveyon-signature. The timestamp is inside the signed material, so a captured POST cannot be replayed with a fresh stamp.

Verify

sha256=HMAC-SHA256(secret, timestamp + "." + rawBody); reject if |now − timestamp| > 300 s

Deduplicate

by eventId — retries and redeliveries repeat the same value

Read later

GET /v1/inbound, /v1/inbound/{uid}, /content, /raw, /attachments/{n}

Signals

agentSafety (verdict, score, signals, coverage), authentication.spf/dkim/dmarc, spamScore (0–100), policy, inReplyTo, messageIdHeader

# what your endpoint receives
POST https://agent.yourdomain.com/hook
x-oveyon-event: inbound.received
x-oveyon-timestamp: 1756041600
x-oveyon-signature: sha256=9c4f2b7e…
content-type: application/json

{
  "event": "inbound.received",
  "eventId": "6e5a1b90-3c77-4f02-b1ad-8e4409c2d611",
  "schemaVersion": 1,
  "message": {
    "id": "b71e0c34-5a2f-4d18-9c60-77ab31e2d905",
    "receivedAt": "2026-08-05T09:14:02.317Z",
    "from": "customer@example.com",
    "fromName": "Dana",
    "subject": "Re: your quote",
    "messageIdHeader": "<a1b2@example.com>",
    "inReplyTo": "<z9@yourdomain.com>",
    "authentication": { "spf": "pass", "dkim": "pass", "dmarc": "pass" },
    "spamScore": 2,
    "agentSafety": { "verdict": "clean", "score": 0, "signals": [] },
    "attachmentCount": 1,
    "url": "https://api.oveyon.com/v1/inbound/b71e0c34-…"
  },
  "recipient": { "id": "4d2f77a1-…", "to": "agent@yourdomain.com" }
}

What Oveyon is

Transactional email infrastructure (API + SMTP outbound, MX + webhook inbound) for developers and AI agents, with a safety verdict on every received message. Operated by Akamind Inc. (Delaware, USA) for oveyon.com; oveyon.com.br is the Portuguese-language service, contracted with an affiliated company in Brazil.

Procedure

oveyon.com/llms.txt — what an agent does, in order, to get email working; every page also has a Markdown twin (/agents.md, /pricing.md)

API base URL

https://api.oveyon.com/v1 — JSON, Authorization: Bearer <api key>

Send

POST /v1/send → 202 {id, status:"accepted"}; dry run with X-Oveyon-Sandbox: 1; dedupe with Idempotency-Key; human approval with "hold": true

Approve

GET /v1/holds; POST /v1/messages/{uuid}/approve or /reject (scope approve:holds)

Receive

MX → mailbox (exact or catch-all) → channel (webhook in summary/full/full+attachments, forwarding, Telegram, Slack; Discord announced, not yet available); event inbound.received; read later with GET /v1/inbound/{uid}

Inbound safety

agentSafety on every received message: verdict (clean/suspicious/dangerous), score 0–100, signals, coverage; null = not computed. A mailbox set to hold sends inbound.quarantined instead of delivering; release with POST /v1/inbound/{uid}/release (scope write:inbound)

Webhook security

url_verification challenge before a URL is saved; x-oveyon-signature = sha256=HMAC-SHA256(secret, timestamp + "." + rawBody); reject if older than 300 s; dedupe by eventId

Guardrails

Inbound policies per mailbox with simulator; suppressions (complaints permanent); send policies with simulator; disposable check; 429 + Retry-After; warmup caps; audit trail that never expires

MCP server

https://mcp.oveyon.com/v1 (Streamable HTTP, POST), with the API key in Authorization: Bearer; one tool per API route, listed according to the key’s scopes, plus whoami; the procedure in the resource oveyon://guide; configuration per client at /mcp.md

Plans (USD/month)

Free 1,000 emails, 1 domain, no card, never expires · Starter 50,000 — $15 · Plus 100,000 — $69 · Growth 250,000 — $199 · Business 500,000 — $359 · Scale 1,000,000 — $599 · Enterprise custom

Docs

api.oveyon.com · oveyon.com/llms.txt