Inbound Email
Somebody mailed the assistant a meeting link (F23).
The most exposed surface in the feature: it books a paid bot from an unauthenticated request, so it is the one place where refusing by default matters most. With no secret configured the endpoint refuses everything — a fresh environment has no secret, and an inbound booking path must not be open because a deployment has not been finished.
Vetting is by sender DOMAIN, matched against the org’s own domains and then against the domains of its known contacts. Everything else — the classify, the live-call lookup, the booking — happens in the RPC, so a redelivery and two simultaneous senders resolve the same way.
Headers
Response
Successful Response
The response is of type Response Inbound Email Meetings Webhooks Inbound Email Post · object.