# Score inbound mail before your agent reads it

The other integrations here are about sending. This one is about what arrives: Superagent scores the mail and messages Bird receives, so an agent acting on them is not acting on whatever a stranger wrote.

## Bird delivers it, Superagent scores it

This is a webhook you host, not a connector you click. Bird posts each received message to your endpoint, you pass the content to Superagent, and the verdict decides whether your agent ever sees it.

**app.bird.com**

Developers → Webhooks → Create webhook

- URL: https://your-app.example.com/bird/inbound
- Events: email.received, sms.received, whatsapp.received
- Response: whsec_...

The secret is shown once. Store it as BIRD_WEBHOOK_SECRET before leaving the pane.

**what the endpoint owes Bird**

- Signature: Standard Webhooks, verified per delivery
- Timestamp: reject anything over 5 minutes old
- Response: within 5 seconds, so queue the work

A delivery that will not verify is a delivery you did not receive. Drop it rather than scanning it.

**what you send Superagent**

- Email: the raw RFC 5322 message, fetched from Bird
- SMS and WhatsApp: the text content
- Verdict: safe · caution · suspicious · dangerous

You need a Superagent organization API key from their Settings, and a Bird regional API key to fetch the raw email.

## What the guardrail covers. Text and the links in it, on the three channels Bird can receive on. Worth knowing where the cover stops before you rely on it.

- Three inbound channels. Email, SMS and WhatsApp each have a received event. Subscribe to the ones your workspace actually takes mail on.
- Four verdicts, three outcomes. Suspicious and dangerous are the ones to block. Caution is the one worth a human. Safe is the only one your agent should act on unattended.
- Text and links only. Images, audio, video, documents and attachments are not scanned. If your agent opens attachments, that path needs its own answer.

### Worth wiring up

- Hold a reply-to-support email until it comes back safe.
- Drop an inbound SMS that scores dangerous, and log why.
- Send anything marked caution to a human queue instead of the agent.
- Keep the verdict on the thread, so a later reply has the history.
- Alert on a spike in suspicious mail to one address.
- Refuse every delivery whose signature will not verify.