An agent inbox with no app registration, no admin consent, no subscription to renew.

// Needs an Entra app with admin-consented application Mail.Read,
// ideally RBAC-scoped to one mailbox. A notification is a pointer,
// not the message — you GET it with an app token.
await fetch("https://graph.microsoft.com/v1.0/subscriptions", {
  method: "POST",
  headers: { authorization: `Bearer ${appToken}`, "content-type": "application/json" },
  body: JSON.stringify({
    changeType: "created",
    notificationUrl: NOTIFY_URL,
    resource: `/users/${MAILBOX}/mailFolders('inbox')/messages`,
    expirationDateTime: new Date(Date.now() + 6 * 864e5).toISOString(), // lapses — re-PATCH it
  }),
});

// On your notify endpoint:
//  1. validation handshake — echo ?validationToken back, text/plain, 200, within 10s
//  2. a change notification arrives → GET the message with a fresh app token
const { value } = JSON.parse(body);
const msg = await fetch(`https://graph.microsoft.com/v1.0/${value[0].resource}`, {
  headers: { authorization: `Bearer ${await token()}` },
}).then((r) => r.json());
// msg.body.content is HTML; nothing here tells you if SPF/DKIM/DMARC passed.

POST /your-webhook   Content-Type: application/json
x-mailkite-signature: t=…,v1=…   (HMAC-SHA256 — verify locally)

{
  "id": "msg_2Hk9…",
  "type": "email.received",
  "from": { "address": "ada@example.com" },
  "to": [{ "address": "support@myapp.ai" }],
  "subject": "Re: invoice #1042",
  "text": "Looks good — approved!",
  "html": "<p>Looks good — approved!</p>",
  "threadId": "<a1b2c3@mail.example.com>",
  "auth": { "spf": "pass", "dkim": "pass", "dmarc": "pass", "spam": "ham" },
  "attachments": [
    { "filename": "po.pdf", "contentType": "application/pdf",
      "size": 18213, "url": "https://api.mailkite.dev/att/2Hk9…/0?sig=…" }
  ]
}