Create the inbound

Embed

<a href="https://forumulate.com/reference/forumulate-api-inboundemail-inbound"><img src="https://forumulate.com/reference/_api/public/orgs/046a9bc0-d530-43ae-9bae-af7945008cda/spaces/8042f004-e3d9-445f-b7a4-b6c1f86836e6/pages/26172bd7-207c-4594-8809-00289685a71a/social-card.svg?v=3e7ae33eec8b" alt="Create the inbound" width="600" height="315"></a>

POSThttps://forumulate.com/api/email/inbound

Your inbound mail provider posts parsed messages here (JSON or multipart, up to 20 attachments) with the platform X-Inbound-Secret header. The recipient address routes it: a reply, a new topic, a private-message reply, a group inbox or a status incident.

Parameters

forumulate-versionstringheader

API version negotiation. Send forumulate-version: 2026-12-01 on every request from a new integration; it is optional only so that integrations written before versioning keep working. Each version includes everything before it:

Idempotency-Keystringheader

Makes this write safe to retry. Optional — send any unique string (a UUID is ideal) and the first request runs while its response is remembered under that key for 24 hours; an identical retry replays that same status and body instead of acting twice, so a timeout or a 5xx from the edge can be retried without creating a second row. A retry sent while the first request is still in flight is refused with 409. The key is scoped to the method and path, so the same key on a different endpoint is a different request. Error responses of 5xx are never cached — those retries re-run. A key is bound to the BODY it was first used with: reusing it with a different body is a 409 idempotency.key_reused, not a replay, because replaying would tell you a write landed that never ran. Generate one key per request, never per process or per session.

Request body application/json

tostringrequired

fromstring

subjectstring

messageIdstring

textstring

autoSubmittedstring

precedencestring

autoResponseSuppressstring

returnPathstring

headersobject

attachmentsobject[]

Show child parameters

namestring

= attachment

contentTypestring

= application/octet-stream

contentstringrequired

{
  "to": "string",
  "from": "string",
  "subject": "string",
  "messageId": "string",
  "text": "",
  "autoSubmitted": "string",
  "precedence": "string",
  "autoResponseSuppress": "string",
  "returnPath": "string",
  "headers": {},
  "attachments": [
    {
      "name": "attachment",
      "contentType": "application/octet-stream",
      "content": "string"
    }
  ]
}

Code samples

cURL

curl -X POST "https://forumulate.com/api/email/inbound" \
  -H "forumulate-version: <value>" \
  -H "Idempotency-Key: <value>" \
  -H "Content-Type: application/json" \
  -d '{"to":"string","from":"string","subject":"string","messageId":"string","text":"","autoSubmitted":"string","precedence":"string","autoResponseSuppress":"string","returnPath":"string","headers":{},"attachments":[{"name":"attachment","contentType":"application/octet-stream","content":"string"}]}'

TypeScript

const res = await fetch('https://forumulate.com/api/email/inbound', {
  method: 'POST',
  headers: {
    'forumulate-version': '<value>',
    'Idempotency-Key': '<value>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({"to":"string","from":"string","subject":"string","messageId":"string","text":"","autoSubmitted":"string","precedence":"string","autoResponseSuppress":"string","returnPath":"string","headers":{},"attachments":[{"name":"attachment","contentType":"application/octet-stream","content":"string"}]}),
});
const data = await res.json();

Python

import requests

res = requests.request(
    "POST",
    "https://forumulate.com/api/email/inbound",
    headers={
    "forumulate-version": "<value>",
    "Idempotency-Key": "<value>",
    "Content-Type": "application/json",
    },
    json={"to": "string", "from": "string", "subject": "string", "messageId": "string", "text": "", "autoSubmitted": "string", "precedence": "string", "autoResponseSuppress": "string", "returnPath": "string", "headers": {}, "attachments": [{"name": "attachment", "contentType": "application/octet-stream", "content": "string"}]},
)
data = res.json()

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	req, _ := http.NewRequest("POST", "https://forumulate.com/api/email/inbound", strings.NewReader(`{"to":"string","from":"string","subject":"string","messageId":"string","text":"","autoSubmitted":"string","precedence":"string","autoResponseSuppress":"string","returnPath":"string","headers":{},"attachments":[{"name":"attachment","contentType":"application/octet-stream","content":"string"}]}`))
	req.Header.Set("forumulate-version", "<value>")
	req.Header.Set("Idempotency-Key", "<value>")
	req.Header.Set("Content-Type", "application/json")
	res, _ := http.DefaultClient.Do(req)
	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)
	fmt.Println(string(body))
}

PHP

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://forumulate.com/api/email/inbound');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['forumulate-version: <value>', 'Idempotency-Key: <value>', 'Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POSTFIELDS, '{"to":"string","from":"string","subject":"string","messageId":"string","text":"","autoSubmitted":"string","precedence":"string","autoResponseSuppress":"string","returnPath":"string","headers":{},"attachments":[{"name":"attachment","contentType":"application/octet-stream","content":"string"}]}');
$response = curl_exec($ch);
curl_close($ch);
echo $response;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://forumulate.com/api/email/inbound')
req = Net::HTTP::Post.new(uri)
req['forumulate-version'] = '<value>'
req['Idempotency-Key'] = '<value>'
req['Content-Type'] = 'application/json'
req.body = '{"to":"string","from":"string","subject":"string","messageId":"string","text":"","autoSubmitted":"string","precedence":"string","autoResponseSuppress":"string","returnPath":"string","headers":{},"attachments":[{"name":"attachment","contentType":"application/octet-stream","content":"string"}]}'
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(req)
end
puts res.body

Java

import java.net.URI;
import java.net.http.*;
import java.net.http.HttpRequest.BodyPublishers;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://forumulate.com/api/email/inbound"))
    .header("forumulate-version", "<value>")
    .header("Idempotency-Key", "<value>")
    .header("Content-Type", "application/json")
    .method("POST", BodyPublishers.ofString("{\"to\":\"string\",\"from\":\"string\",\"subject\":\"string\",\"messageId\":\"string\",\"text\":\"\",\"autoSubmitted\":\"string\",\"precedence\":\"string\",\"autoResponseSuppress\":\"string\",\"returnPath\":\"string\",\"headers\":{},\"attachments\":[{\"name\":\"attachment\",\"contentType\":\"application/octet-stream\",\"content\":\"string\"}]}"))
    .build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

Responses

200 Success.

Example

{
  "ok": true,
  "postId": "string",
  "warnings": [
    "tags: \"Launch Day\" is stored as \"launch-day\""
  ]
}

Schema

okbooleanrequired

postIdstringrequired

warningsstring[]

Values we ACCEPTED and then rewrote, one sentence each — a slugified tag, a normalised colour, a clamped range, a slug that was taken. Absent when nothing was rewritten, never []. The same sentences are on the X-Field-Warnings response header. If this is present, something you sent is not what is stored; read the resource back rather than assuming your own value.

400 The request could not be understood — a malformed header, path or query value (request.malformed). A value that was understood but is not acceptable is a 422 validation.failed.

Example

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {},
    "docs": "string",
    "reason": "string",
    "slugs": [
      "string"
    ],
    "conflict": {
      "etag": "string",
      "ops": [
        null
      ]
    }
  },
  "requestId": "string"
}

Schema

errorobjectrequired

Show child parameters

codestringrequired

Stable, machine-readable error code, e.g. rbac.forbidden.

messagestringrequired

Human-readable explanation.

detailsobject

Field-level validation problems, keyed by field path (422 only).

docsstring

Where the vocabulary or format this error is about is published — an absolute URL, or an API route such as GET /space-types/{type}/presets. Present on errors over a controlled list, so the answer to "what am I allowed to send?" is in the error itself.

reasonstring

Why a credential was refused, as one stable word, where one status has several causes — e.g. an external_jwt redeem answers iat_too_old, iat_in_future, bad_signature, bad_issuer, bad_audience, expired and more. Branch on this, not on message.

slugsstring[]

The exact slugs that collided, on a slug-conflict 409 — space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.

conflictobject

On a 409 from a content entry field write (PATCH …/entries/{entryId}/fields) whose If-Match was stale.

Show child parameters

etagstringrequired

The entry's current fields etag.

opsarrayrequired

The field operations since your If-Match that touch a path your own operations touch. Empty: none did — retry the batch unchanged under etag. null: the history no longer reaches your tag — re-read the entry first.

requestIdstring

The id of this request — the same value as the x-request-id and x-forumulate-request-id response headers. Quote it in a bug report: it is the only thing that finds your exact request in our logs. It is in the body because that is the part that survives — an SDK that throws the parsed body, a serverless log that keeps the body and drops the headers, a ticket with the JSON pasted in.

422 The body was understood and a value is unacceptable (validation.failed). error.details names the field paths.

Example

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {},
    "docs": "string",
    "reason": "string",
    "slugs": [
      "string"
    ],
    "conflict": {
      "etag": "string",
      "ops": [
        null
      ]
    }
  },
  "requestId": "string"
}

Schema

errorobjectrequired

Show child parameters

codestringrequired

Stable, machine-readable error code, e.g. rbac.forbidden.

messagestringrequired

Human-readable explanation.

detailsobject

Field-level validation problems, keyed by field path (422 only).

docsstring

reasonstring

slugsstring[]

The exact slugs that collided, on a slug-conflict 409 — space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.

conflictobject

On a 409 from a content entry field write (PATCH …/entries/{entryId}/fields) whose If-Match was stale.

Show child parameters

etagstringrequired

The entry's current fields etag.

opsarrayrequired

requestIdstring

429 Rate limited — see the RateLimit-* headers.

Example

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {},
    "docs": "string",
    "reason": "string",
    "slugs": [
      "string"
    ],
    "conflict": {
      "etag": "string",
      "ops": [
        null
      ]
    }
  },
  "requestId": "string"
}

Schema

errorobjectrequired

Show child parameters

codestringrequired

Stable, machine-readable error code, e.g. rbac.forbidden.

messagestringrequired

Human-readable explanation.

detailsobject

Field-level validation problems, keyed by field path (422 only).

docsstring

reasonstring

slugsstring[]

The exact slugs that collided, on a slug-conflict 409 — space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.

conflictobject

On a 409 from a content entry field write (PATCH …/entries/{entryId}/fields) whose If-Match was stale.

Show child parameters

etagstringrequired

The entry's current fields etag.

opsarrayrequired

requestIdstring

default Error — the stable { error: { code, message } } envelope.

Example

{
  "error": {
    "code": "string",
    "message": "string",
    "details": {},
    "docs": "string",
    "reason": "string",
    "slugs": [
      "string"
    ],
    "conflict": {
      "etag": "string",
      "ops": [
        null
      ]
    }
  },
  "requestId": "string"
}

Schema

errorobjectrequired

Show child parameters

codestringrequired

Stable, machine-readable error code, e.g. rbac.forbidden.

messagestringrequired

Human-readable explanation.

detailsobject

Field-level validation problems, keyed by field path (422 only).

docsstring

reasonstring

slugsstring[]

The exact slugs that collided, on a slug-conflict 409 — space.slug_taken, page.slug_taken, collection.slug_taken, site.slug_taken or badge.slug_taken.

conflictobject

On a 409 from a content entry field write (PATCH …/entries/{entryId}/fields) whose If-Match was stale.

Show child parameters

etagstringrequired

The entry's current fields etag.

opsarrayrequired

requestIdstring

The Forumulate teamUpdated Oct 17, 2026

Was this page helpful?