Webhooks
Your endpoint receives type and data. Signatures use HMAC SHA-256.
Compare sendfs-signature to the hex HMAC of the raw request body using the secret shown when you created the webhook. Reject the request when they differ.
Inbound mail can be posted to /webhooks/inbound/:INBOUND_WEBHOOK_TOKEN with from, to, subject, and text or html. The recipient domain must already be verified. Inbound messages count toward the quota.