Set the mailbox’s Output to WEBHOOK or BOTH, then fill in the Webhook section of the mailbox editor. Every completed extraction is POSTed to your URL as JSON.
Requirements
- The URL must be public HTTPS — localhost and private addresses are rejected.
- Your endpoint must respond with a
2xx status within 10 seconds.
Payload
data is the extracted result — exactly what the EXTRACTED RESULT panel shows.attachments[].url is a signed download link valid for 7 days, or null if the file can’t be shared. Download eagerly; don’t store the link.
Every POST includes:
Verifying the signature
The signature is computed over the exact raw body — verify it before you parse the JSON. The signing secret is your workspace secret unless the mailbox sets its own.
Check X-BounceBox-Signature over the raw request body before parsing and acting on the payload, and reject mismatches with a non-2xx status. The signature proves the request is authentic and untampered, but it does not prevent replays — the payload carries no timestamp. Protect your endpoint by tracking payload IDs and ignoring duplicates, and only configure public HTTPS URLs.
Custom body template
Leave Body template empty to get the canonical payload above. To send a custom shape, write a template using placeholders:
{{mailbox}}, {{received_at}}, {{email_id}}, {{from}}, {{subject}} — email metadata{{attachments}} — the attachment list{{data}} — the extracted JSON
Missing fields render as empty strings.
Retries
- Up to 4 attempts per webhook delivery.
- A
2xx within 10 seconds is success. Anything else — a 5xx, a timeout, or a network error — is retried with a growing backoff: about 1s, 4s, 9s, 16s.
- A
4xx response fails delivery immediately without retry — a rejected request won’t get better by waiting.
Every attempt lands in the mailbox’s delivery log.