How to receive email with a webhook and parse inbound mail

$ dig +short MX acme.example
1 aspmx.l.google.com.
5 alt1.aspmx.l.google.com.

curl -X PATCH https://api.rasket.com/domains/$DOMAIN_ID \
  -H "Authorization: Bearer $RASKET_API_KEY" \
  -H "User-Agent: acme-support/1.0" \
  -H "Content-Type: application/json" \
  -d '{ "receiving_host": "inbound", "capabilities": { "receiving": "enabled" } }'

inbound.acme.example.   MX   10   (the host the domain page shows)

curl -X POST https://api.rasket.com/webhooks \
  -H "Authorization: Bearer $RASKET_API_KEY" \
  -H "User-Agent: acme-support/1.0" \
  -H "Content-Type: application/json" \
  -d '{ "endpoint": "https://support.acme.example/webhooks/rasket", "events": ["email.received"] }'

{
  "type": "email.received",
  "created_at": "2026-09-09T10:16:44.902Z",
  "data": {
    "email_id": "4ef9a417-02e9-4d39-ad75-9611e0fcc33c",
    "created_at": "2026-09-09T10:16:44.902Z",
    "from": "Ronald Williams <ronald.williams@example.com>",
    "to": [
      "support@inbound.acme.example"
    ],
    "subject": "Order #1042 arrived damaged",
    "message_id": "<CAF1042.damaged@mail.example.com>",
    "bcc": [],
    "cc": [
      "billing@example.com"
    ],
    "received_for": [
      "support@inbound.acme.example"
    ],
    "attachments": [
      {
        "id": "9a3e6d21-4b7c-4f05-8e1a-6c2d0b9f7e48",
        "filename": "photo.png",
        "content_type": "image/png",
        "content_disposition": "inline",
        "content_id": "photo-1042@example.com"
      },
      {
        "id": "660e8400-e29b-41d4-a716-446655440000",
        "filename": "damage-report.pdf",
        "content_type": "application/pdf",
        "content_disposition": "attachment"
      }
    ]
  }
}

{
  "object": "email",
  "id": "4ef9a417-02e9-4d39-ad75-9611e0fcc33c",
  "to": [
    "support@inbound.acme.example"
  ],
  "from": "Ronald Williams <ronald.williams@example.com>",
  "subject": "Order #1042 arrived damaged",
  "message_id": "<CAF1042.damaged@mail.example.com>",
  "bcc": [],
  "cc": [
    "billing@example.com"
  ],
  "reply_to": [],
  "received_for": [
    "support@inbound.acme.example"
  ],
  "html": "<p>The box was crushed on one side.</p>",
  "text": "The box was crushed on one side.",
  "headers": {
    "X-Mailer": "Apple Mail (2.3774)"
  },
  "dropped_reason": null,
  "created_at": "2026-09-09T10:16:44.902Z",
  "attachments": [
    {
      "id": "9a3e6d21-4b7c-4f05-8e1a-6c2d0b9f7e48",
      "filename": "photo.png",
      "content_type": "image/png",
      "content_id": "photo-1042@example.com",
      "content_disposition": "inline",
      "size": 48213
    },
    {
      "id": "660e8400-e29b-41d4-a716-446655440000",
      "filename": "damage-report.pdf",
      "content_type": "application/pdf",
      "content_disposition": "attachment",
      "size": 20481
    }
  ]
}

RASKET_API_KEY=rk_... RASKET_WEBHOOK_SECRET=whsec_... node receiver.mjs

// support.mjs: turns email.received into a ticket and one acknowledgement.
// receiver.mjs imports handle() from here, so this file loads first.
import { mkdir, writeFile } from "node:fs/promises";
import { basename } from "node:path";
import { DatabaseSync } from "node:sqlite";

const API = process.env.RASKET_API_URL ?? "https://api.rasket.com";
const KEY = process.env.RASKET_API_KEY ?? "";
const USER_AGENT = "acme-support/1.0"; // the API refuses a request without one (403)
// Refuse to start without both secrets: an empty signing key would accept forged deliveries.
if (!KEY || !process.env.RASKET_WEBHOOK_SECRET) {
  throw new Error("Set RASKET_API_KEY and RASKET_WEBHOOK_SECRET");
}
const ACKS_PER_SENDER_PER_DAY = 1;
const ACKS_PER_DAY = 200;
const CUSTOMERS = new Set(["ronald.williams@example.com"]); // your user table goes here

const db = new DatabaseSync(process.env.WEBHOOK_DB ?? "webhooks.db");
db.exec(`CREATE TABLE IF NOT EXISTS tickets (
  ticket_no INTEGER PRIMARY KEY, email_id TEXT NOT NULL UNIQUE, sender TEXT NOT NULL, subject TEXT NOT NULL
);
CREATE TABLE IF NOT EXISTS acks (email_id TEXT PRIMARY KEY, sent_to TEXT NOT NULL, day TEXT NOT NULL)`);
const openTicket = db.prepare(
  "INSERT INTO tickets (email_id, sender, subject) VALUES (?, ?, ?) ON CONFLICT (email_id) DO NOTHING",
);
const ticketFor = db.prepare("SELECT ticket_no FROM tickets WHERE email_id = ?");
const acksToday = db.prepare(
  "SELECT count(*) AS total, count(*) FILTER (WHERE sent_to = ?) AS mine FROM acks WHERE day = ?",
);
const recordAck = db.prepare(
  "INSERT INTO acks (email_id, sent_to, day) VALUES (?, ?, ?) ON CONFLICT (email_id) DO NOTHING",
);
const releaseAck = db.prepare("DELETE FROM acks WHERE email_id = ?");

export async function handle(id, type, event) {
  if (event.test || type !== "email.received") return;
  const data = event.data;
  // Route on the addresses the message was accepted for, never on the To header.
  if (!data.received_for.some((address) => address.toLowerCase().startsWith("support@"))) return;

  // The event has no bodies or headers; the message itself does.
  const message = await api(`/emails/receiving/${data.email_id}`);
  const header = (name) => {
    const found = Object.entries(message.headers ?? {}).find(([key]) => key.toLowerCase() === name);
    return Array.isArray(found?.[1]) ? found[1][0] : found?.[1];
  };
  // Automated mail (bounces, lists, auto-replies) gets no ticket and, per RFC 3834, no reply.
  if (automated(data.from, header)) return;

  // Keyed on email_id, so a retried or replayed event finds the ticket it opened before.
  const sender = addressOf(data.from);
  openTicket.run(data.email_id, sender, data.subject);
  const ticketId = `T-${ticketFor.get(data.email_id).ticket_no}`;
  await saveAttachments(data.email_id, ticketId);

  // RFC 3834: an automatic reply goes to the envelope sender, not to From, and never to an
  // empty one (<>).
  const to = header("return-path")?.replace(/[<>\s]/g, "").toLowerCase();
  if (!to) return;

  // Acknowledge only people you already know, and cap how many you send.
  if (!CUSTOMERS.has(to)) return;
  if (!claimAck(data.email_id, to, new Date().toISOString().slice(0, 10))) return;

  // Thread the reply: In-Reply-To names the original, References carries the chain (RFC 5322).
  const inReplyTo = header("in-reply-to")?.trim();
  const parent = header("references") ?? (inReplyTo && !/\s/.test(inReplyTo) ? inReplyTo : "");
  const reply = api("/emails", {
    method: "POST",
    headers: { "idempotency-key": `ack-${data.email_id}` }, // a second try sends nothing new
    body: JSON.stringify({
      from: "Acme Support <support@acme.example>",
      to: [to],
      reply_to: data.received_for[0],
      subject: /^re:/i.test(data.subject) ? data.subject : `Re: ${data.subject}`,
      text: `Thanks, we have opened ticket ${ticketId} and will reply here.`,
      headers: {
        "Auto-Submitted": "auto-replied",
        ...(data.message_id
          ? { "In-Reply-To": data.message_id, References: `${parent} ${data.message_id}`.trim() }
          : {}),
      },
    }),
  });
  // A failed send gives the claim back, so the worker's retry can try again.
  await reply.catch((error) => {
    releaseAck.run(data.email_id);
    throw error;
  });
}

// Check the caps and claim the acknowledgement in one transaction. A second worker, or a replay
// days after the idempotency key has expired, finds the claim and sends nothing.
function claimAck(emailId, to, day) {
  db.exec("BEGIN IMMEDIATE");
  try {
    const sent = acksToday.get(to, day);
    const claimed =
      sent.total < ACKS_PER_DAY &&
      sent.mine < ACKS_PER_SENDER_PER_DAY &&
      recordAck.run(emailId, to, day).changes === 1;
    db.exec("COMMIT");
    return claimed;
  } catch (error) {
    db.exec("ROLLBACK");
    throw error;
  }
}

// The photo of the crushed box: a download_url works for 15 minutes, so fetch it now.
async function saveAttachments(emailId, ticketId) {
  const { data: files } = await api(`/emails/receiving/${emailId}/attachments?limit=100`);
  await mkdir(`attachments/${ticketId}`, { recursive: true });
  for (const file of files) {
    if (!file.download_url) continue; // a part we did not store has no link
    const response = await fetch(file.download_url, { headers: { "user-agent": USER_AGENT } });
    if (!response.ok) throw new Error(`attachment ${file.id}: ${response.status}`);
    const name = `${file.id}-${basename(file.filename ?? "attachment")}`; // no ../ from a stranger
    await writeFile(`attachments/${ticketId}/${name}`, Buffer.from(await response.arrayBuffer()));
  }
}

function automated(from, header) {
  return (
    (header("auto-submitted") ?? "no").trim().split(/[\s;(]/)[0].toLowerCase() !== "no" ||
    /^(bulk|list|junk)$/i.test(header("precedence") ?? "") ||
    header("list-id") !== undefined ||
    /mailer-daemon|postmaster|no-?reply/i.test(from)
  );
}

function addressOf(from) {
  return (/<([^>]+)>/.exec(from)?.[1] ?? from).trim().toLowerCase();
}

async function api(path, init = {}) {
  const response = await fetch(`${API}${path}`, {
    ...init,
    headers: {
      authorization: `Bearer ${KEY}`,
      "user-agent": USER_AGENT,
      "content-type": "application/json",
      ...init.headers,
    },
  });
  if (!response.ok) throw new Error(`${path}: ${response.status} ${await response.text()}`);
  return response.json();
}