kumomta/docs/reference/events/http_message_generated.md

http_message_generated

kumo.on('http_message_generated', function(message, auth_info) end)

Called by the HTTP injection API endpoint after generating a message, but prior to injecting it into the queue.

The event handler will be passed a Message object, as well as an AuthInfo {{since('2026.03.04-bb93ecb1', inline=True)}} that can be used to implement more granular access control policies.

The HTTP injector does not add a Received header, but it will pre-set the following meta values in the message:

• "http_auth" - will hold either the authenticated username or the peer IP address that satisfied the authentication check for the endpoint.

This event is the best place to carry out a number of important policy decisions:

• DKIM signing via message:dkim_sign.
• Assigning the "campaign", "tenant" and/or "queue" meta values via msg:set_meta

You may use kumo.reject to raise an error to prevent this message from being queued for delivery.

kumo.on('http_message_generated', function(msg, auth_info)
  local signer = kumo.dkim.rsa_sha256_signer {
    domain = msg:from_header().domain,
    selector = 'default',
    headers = { 'From', 'To', 'Subject' },
    key = 'example-private-dkim-key.pem',
  }
  msg:dkim_sign(signer)
end)