> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://docs.agentmail.to/llms.txt.

# Message Security Review

POST 

Reference: https://agentmail.to/docs/api-reference/webhooks/events/message-security-review

## Request

### Headers

- `svix-id` (string, required) — ID of webhook message.
- `svix-signature` (string, required) — Signature of webhook message.
- `svix-timestamp` (datetime, required) — Timestamp of webhook message.

### Payload

- `type` ("event", required)
- `event_type` ("message.security.review", required)
- `event_id` (string, required) — ID of event.
- `message` (MessageSecurity, required) — The message an Agent Armor result is for. Fetch the message for its content.

## Types

### MessageSecurity

The message an Agent Armor result is for. Fetch the message for its content.

- `organization_id` (string, required) — ID of organization.
- `inbox_id` (string, required) — The ID of the inbox.
- `message_id` (string, required) — ID of message.
- `agent_armor` (AgentArmorCompletedEventResult, required) — The result in a `message.security.completed` or `message.security.review` event, which is always `complete`.

### AgentArmorCompletedEventResult

The result in a `message.security.completed` or `message.security.review` event, which is always `complete`.

- `completed_at` (datetime, required) — When the scan finished.
- `model` (string, required) — Identifies the Agent Armor release that produced the verdict. Opaque; it changes when Agent Armor is updated.
- `reason` (string, required) — A short explanation of the verdict.
- `status` ("complete", required)
- `verdict` (enum, required) — What the scan concluded. `clear` means Agent Armor found no threat. It is advisory, not a guarantee that the message is safe. `review` means the message may try to manipulate an agent: inspect it before an agent acts on it.
  - Allowed values: `clear`, `review`
- `manual_override` (AgentArmorManualOverride, optional) — Present on a `review` held in hold mode that someone released.

### AgentArmorManualOverride

The record of a release of a message Agent Armor held for review.

- `override_id` (string, required) — ID of the release, and the `event_id` of its `message.security.override` event.
- `actor` (AgentArmorReleaseActor, required) — Who released the message.
- `reason` (string, required) — Why it was released, as given by whoever released it.
- `original_verdict` ("review", required) — The verdict that held the message.
- `released_at` (datetime, required) — When it was released.

### AgentArmorReleaseActor

Who released the message.

- `kind`: `api_key`
  - `api_key_id` (string, required) — The API key that released it.
- `kind`: `console`