Create a key to copy examples filled with your team.
Receiving webhooks
POST signed JSON or SendGrid Inbound Parse.
A webhook is optional. Leave webhook_url blank to store mail and poll it. When set, PostShiba POSTs each message after ingest.
Formats
webhook_format |
Description |
|---|---|
json |
Default. JSON object from the inbound payload, including attachment content_base64. |
sendgrid_parse |
SendGrid Inbound Parse form fields. Raw MIME is email. Attachments are attachment1, attachment2, plus attachment-info. |
Signing and URL rules
Every POST carries X-Capsule-Timestamp and X-Capsule-Signature: sha256=HMAC_SHA256(secret, "{timestamp}.{body}"). Production webhook_url must be https. Non-public URLs are blocked.
webhook_secret is returned on create and show only. The dashboard can change webhook_url and webhook_format. The API has no inbox update.
inbound.json
1
{
2
"id": 21,
3
"inbox_id": 3,
4
"to": "inbabc123@inbound.postshiba.com",
5
"from": "sender@example.com",
6
"subject": "Hello",
7
"text": "Hi",
8
"html": "<p>Hi</p>",
9
"thread_id": "thread",
10
"headers": {},
11
"envelope": {},
12
"attachments": [
13
{
14
"filename": "note.txt",
15
"content_type": "text/plain",
16
"size": 5,
17
"content_base64": "aGVsbG8="
18
}
19
],
20
"expires_at": "2026-08-30T00:00:00Z"
21
}