Email API and webhook rules

Technical invariants for tenant-safe sends, raw-body verification, event deduplication, and domain read-back.

Send rules

Every send is authorized against the workspace, domain, mailbox, recipient suppression state, and current entitlement. Callers provide a stable request key. Reusing it returns the existing message and must not create a new send or usage unit.

Webhook rules

Beam verifies the exact raw request body and signature before parsing. Provider event IDs are unique in Beam's ledger, so repeat delivery cannot apply the event twice. Events may arrive late or out of order; terminal state never regresses.

Domain verification

A domain update is a signal to perform a server-side read-back. Only that explicit read-back can move Beam's domain state to verified. The browser never receives provider credentials or raw provider IDs.

Retention and audit

Beam stores the normalized event facts required for delivery health and audit. It does not expose raw provider payloads to clients. Every draft, send, suppression, handoff, calendar action, and provider event remains attributable.