Event types
Every event shares the same envelope; only the data field varies by event_type:
{
"event_id": "evt_abc123",
"event_type": "mail.message.received",
"org_id": "org_01j9x...",
"created_at": "2026-04-04T10:05:00Z",
"data": { /* type-specific, see below */ }
}
See Receiving events for verification and dispatch.
| Event type | Fires when | data fields |
|---|
mail.message.received | An inbound email arrives in one of your inboxes | message_id, inbox_email, from, subject |
mail.message.sent | An outbound message is accepted by the upstream provider | message_id, inbox_email, to[], subject |
mail.message.delivered | The recipient server confirmed receipt of an outbound message | message_id, inbox_email |
mail.message.bounced | An outbound message hard-bounced | message_id, inbox_email |
mail.message.complained | The recipient marked the message as spam | message_id, inbox_email |
mail.message.quarantined | An inbound message was held as suspicious | message_id, inbox_email, from, subject |
| Event type | Fires when | data fields |
|---|
phone.verification.cancelled | A verification was cancelled by user or upstream provider | verification_id, service, status, reason |
phone.verification.expired | A verification timed out before an OTP arrived | verification_id, service |
phone.otp.received | An OTP code arrived for a verification | verification_id, phone_number, service, received_at, extraction_failed |
phone.otp.extraction_failed | An SMS arrived but no code could be extracted | same as above, with extraction_failed: true |
Endpoints created with include_sensitive: true also receive code and raw_sms as top-level fields in data for OTP events.
| Event type | Fires when | data fields |
|---|
captcha.task.solved | A captcha task transitioned to solved — fetch the solution via tasks.get(task_id) | task_id, type, status, solve_time_ms |
| Event type | Fires when | data fields |
|---|
vault.credential.store | A credential was added to the vault. Plaintext is never in the payload. | credential_id, short_id |
vault.credential.delete | A credential was deleted | credential_id |
vault.master_key.initialized | The vault master key was set up for the org for the first time | initialized_at |
vault.master_key.rotated | The vault master key was rotated; the previous recovery code is invalidated | rotated_at |
Monetary amount fields are in micro-cents (1 USD = 1,000,000).
| Event type | Fires when | data fields |
|---|
billing.subscription.activated | A subscription started — initial sign-up or trial conversion | plan_slug, mail_daily_limit, mail_hourly_limit |
billing.subscription.canceled | A subscription was cancelled | plan_slug, mail_daily_limit, mail_hourly_limit |
billing.subscription.plan_changed | The plan was upgraded or downgraded | old_plan_slug, new_plan_slug, mail_daily_limit, mail_hourly_limit |
billing.subscription.trial_ending | The trial period is about to end | plan_slug |
billing.payment.succeeded | A charge was captured successfully | amount, currency |
billing.payment.failed | A charge was declined or otherwise failed | plan_slug |
billing.dispute.created | A customer opened a dispute (chargeback). data is empty; org/event identifiers are in the envelope. | — |
billing.dispute.lost | A dispute resolved against you — funds withdrawn | — |
