Overview
The Inbound Email API lets you create unique email addresses (likeie_xyz@import.casparser.in) where your users can forward their CAS statements. When an email arrives, we validate the sender, upload attachments to cloud storage, and POST the details to your webhook.
Use Case: Lower-friction alternative to OAuth or manual file upload.
How It Works
Quick Start
1. Create an Inbound Email
2. Display to User
Show the email address in your UI:3. Handle Webhook
When the user forwards an email, we POST to yourcallback_url:
Sender Validation
We automatically verify that forwarded emails originated from trusted CAS authorities:- CDSL → eCAS@cdslstatement.com
- NSDL → NSDL-CAS@nsdl.co.in
- CAMS → donotreply@camsonline.com
- KFintech → samfS@kfintech.com
Managing Inbound Emails
List All
Get Details
Delete
Best Practices
1. Download Attachments Promptly
Presigned URLs expire in 48 hours. Download and store attachments in your own storage.2. Use HTTPS for Callbacks
Production callback URLs must use HTTPS (HTTP is allowed forlocalhost during development).
3. Use reference for Correlation
Store your user ID in reference to map inbound emails back to your users.
4. Filter by allowed_sources
If you only need CDSL statements, set "allowed_sources": ["cdsl"] to reject others automatically.
Billing
0.2 credits per successfully processed email (validated sender + webhook delivered).- Emails from unknown senders: Not billed
- Failed webhook delivery (after retries): Still billed (email was valid)
Error Handling
Common Issues
| Error | Cause | Solution |
|---|---|---|
callback_url must be HTTPS | Using HTTP in production | Use HTTPS or test with localhost |
Inbound email not found | Wrong ID or deleted | Check ID or recreate |
alias already taken | Another inbound email uses this alias | Choose a different alias |
Webhook Delivery Failures
If your webhook endpoint is down or returns an error, we retry automatically with exponential backoff.Security
Email Authentication
We validate:- Exact email whitelist: Only emails from official CAS authority addresses
- Header parsing: Extract original sender from forwarded emails
Webhook Security
- HTTPS required: Production callbacks must use HTTPS
- Automatic retries: Failed webhook deliveries are retried automatically
- Attachment URLs: Time-limited presigned URLs (48h expiry)
Data Retention
- Inbound email configs: Active indefinitely, marked inactive after 30 days without emails
Use Cases
- Onboarding Flow: “Forward your CAS to get started” — simpler than OAuth
- Recurring Updates: Users forward monthly statements → auto-sync portfolios
- Offline Users: Works for investors without OAuth access or app login
Next Steps
- Parse CAS PDFs — parse the downloaded files
- Gmail Inbox Import — alternative: pull CAS from user’s Gmail
- CDSL Fetch — alternative: fetch CAS directly via OTP

