diff --git a/swh/web/add_forge_now/models.py b/swh/web/add_forge_now/models.py
index 1e714ada..61a77796 100644
--- a/swh/web/add_forge_now/models.py
+++ b/swh/web/add_forge_now/models.py
@@ -1,112 +1,120 @@
 # Copyright (C) 2022  The Software Heritage developers
 # See the AUTHORS file at the top-level directory of this distribution
 # License: GNU Affero General Public License version 3, or any later version
 # See top-level LICENSE file for more information
 
 from __future__ import annotations
 
 import enum
 from typing import List
 
 from django.db import models
 
+from ..config import get_config
+from ..inbound_email.utils import get_address_for_pk
 from .apps import APP_LABEL
 
 
 class RequestStatus(enum.Enum):
     """Request statuses.
 
     Values are used in the ui.
 
     """
 
     PENDING = "Pending"
     WAITING_FOR_FEEDBACK = "Waiting for feedback"
     FEEDBACK_TO_HANDLE = "Feedback to handle"
     ACCEPTED = "Accepted"
     SCHEDULED = "Scheduled"
     FIRST_LISTING_DONE = "First listing done"
     FIRST_ORIGIN_LOADED = "First origin loaded"
     REJECTED = "Rejected"
     SUSPENDED = "Suspended"
     DENIED = "Denied"
 
     @classmethod
     def choices(cls):
         return tuple((variant.name, variant.value) for variant in cls)
 
     def allowed_next_statuses(self) -> List[RequestStatus]:
         next_statuses = {
             self.PENDING: [self.WAITING_FOR_FEEDBACK, self.REJECTED, self.SUSPENDED],
             self.WAITING_FOR_FEEDBACK: [self.FEEDBACK_TO_HANDLE],
             self.FEEDBACK_TO_HANDLE: [
                 self.WAITING_FOR_FEEDBACK,
                 self.ACCEPTED,
                 self.REJECTED,
                 self.SUSPENDED,
             ],
             self.ACCEPTED: [self.SCHEDULED],
             self.SCHEDULED: [
                 self.FIRST_LISTING_DONE,
                 # in case of race condition between lister and loader:
                 self.FIRST_ORIGIN_LOADED,
             ],
             self.FIRST_LISTING_DONE: [self.FIRST_ORIGIN_LOADED],
             self.FIRST_ORIGIN_LOADED: [],
             self.REJECTED: [],
             self.SUSPENDED: [self.PENDING],
             self.DENIED: [],
         }
         return next_statuses[self]  # type: ignore
 
 
 class RequestActorRole(enum.Enum):
     MODERATOR = "moderator"
     SUBMITTER = "submitter"
     FORGE_ADMIN = "forge admin"
 
     @classmethod
     def choices(cls):
         return tuple((variant.name, variant.value) for variant in cls)
 
 
 class RequestHistory(models.Model):
     """Comment or status change. This is commented or changed by either submitter or
     moderator.
 
     """
 
     request = models.ForeignKey("Request", models.DO_NOTHING)
     text = models.TextField()
     actor = models.TextField()
     actor_role = models.TextField(choices=RequestActorRole.choices())
     date = models.DateTimeField(auto_now_add=True)
     new_status = models.TextField(choices=RequestStatus.choices(), null=True)
 
     class Meta:
         app_label = APP_LABEL
         db_table = "add_forge_request_history"
 
 
 class Request(models.Model):
     status = models.TextField(
         choices=RequestStatus.choices(),
         default=RequestStatus.PENDING.name,
     )
     submission_date = models.DateTimeField(auto_now_add=True)
     submitter_name = models.TextField()
     submitter_email = models.TextField()
     submitter_forward_username = models.BooleanField(default=False)
     # FIXME: shall we do create a user model inside the webapp instead?
     forge_type = models.TextField()
     forge_url = models.TextField()
     forge_contact_email = models.EmailField()
     forge_contact_name = models.TextField()
     forge_contact_comment = models.TextField(
         null=True,
         help_text="Where did you find this contact information (url, ...)",
     )
 
     class Meta:
         app_label = APP_LABEL
         db_table = "add_forge_request"
+
+    @property
+    def inbound_email_address(self) -> str:
+        """Generate an email address for correspondence related to this request."""
+        base_address = get_config()["add_forge_now"]["email_address"]
+        return get_address_for_pk(salt=APP_LABEL, base_address=base_address, pk=self.pk)
diff --git a/swh/web/api/views/add_forge_now.py b/swh/web/api/views/add_forge_now.py
index 10a5f8ff..3d2c95ed 100644
--- a/swh/web/api/views/add_forge_now.py
+++ b/swh/web/api/views/add_forge_now.py
@@ -1,396 +1,397 @@
 # Copyright (C) 2022  The Software Heritage developers
 # See the AUTHORS file at the top-level directory of this distribution
 # License: GNU Affero General Public License version 3, or any later version
 # See top-level LICENSE file for more information
 
 import json
 from typing import Any, Dict, Union
 
 from django.core.exceptions import ObjectDoesNotExist
 from django.core.paginator import Paginator
 from django.db import transaction
 from django.db.models.query import QuerySet
 from django.forms import CharField, ModelForm
 from django.http import HttpResponseBadRequest
 from django.http.request import HttpRequest
 from django.http.response import HttpResponse, HttpResponseForbidden
 from rest_framework import serializers
 from rest_framework.request import Request
 from rest_framework.response import Response
 
 from swh.web.add_forge_now.models import Request as AddForgeRequest
 from swh.web.add_forge_now.models import RequestActorRole as AddForgeNowRequestActorRole
 from swh.web.add_forge_now.models import RequestHistory as AddForgeNowRequestHistory
 from swh.web.add_forge_now.models import RequestStatus as AddForgeNowRequestStatus
 from swh.web.api.apidoc import api_doc, format_docstring
 from swh.web.api.apiurls import api_route
 from swh.web.auth.utils import ADD_FORGE_MODERATOR_PERMISSION
 from swh.web.common.exc import BadInputExc
 from swh.web.common.utils import has_add_forge_now_permission, reverse
 
 
 def _block_while_testing():
     """Replaced by tests to check concurrency behavior"""
     pass
 
 
 class AddForgeNowRequestForm(ModelForm):
     forge_contact_comment = CharField(
         required=False,
     )
 
     class Meta:
         model = AddForgeRequest
         fields = (
             "forge_type",
             "forge_url",
             "forge_contact_email",
             "forge_contact_name",
             "forge_contact_comment",
             "submitter_forward_username",
         )
 
 
 class AddForgeNowRequestHistoryForm(ModelForm):
     new_status = CharField(
         max_length=200,
         required=False,
     )
 
     class Meta:
         model = AddForgeNowRequestHistory
         fields = ("text", "new_status")
 
 
 class AddForgeNowRequestSerializer(serializers.ModelSerializer):
+    inbound_email_address = serializers.CharField()
 
     last_moderator = serializers.SerializerMethodField()
     last_modified_date = serializers.SerializerMethodField()
     history: Dict[int, QuerySet] = {}
 
     class Meta:
         model = AddForgeRequest
         fields = "__all__"
 
     def _gethistory(self, request):
         if request.id not in self.history:
             self.history[request.id] = AddForgeNowRequestHistory.objects.filter(
                 request=request
             ).order_by("id")
         return self.history[request.id]
 
     def get_last_moderator(self, request):
         last_history_with_moderator = (
             self._gethistory(request).filter(actor_role="MODERATOR").last()
         )
         return (
             last_history_with_moderator.actor if last_history_with_moderator else "None"
         )
 
     def get_last_modified_date(self, request):
         last_history = self._gethistory(request).last()
         return (
             last_history.date.isoformat().replace("+00:00", "Z")
             if last_history
             else None
         )
 
 
 class AddForgeNowRequestPublicSerializer(serializers.ModelSerializer):
     """Serializes AddForgeRequest without private fields."""
 
     class Meta:
         model = AddForgeRequest
         fields = ("id", "forge_url", "forge_type", "status", "submission_date")
 
 
 class AddForgeNowRequestHistorySerializer(serializers.ModelSerializer):
     class Meta:
         model = AddForgeNowRequestHistory
         exclude = ("request",)
 
 
 class AddForgeNowRequestHistoryPublicSerializer(serializers.ModelSerializer):
     class Meta:
         model = AddForgeNowRequestHistory
         fields = ("id", "date", "new_status", "actor_role")
 
 
 @api_route(
     r"/add-forge/request/create/",
     "api-1-add-forge-request-create",
     methods=["POST"],
 )
 @api_doc("/add-forge/request/create")
 @format_docstring()
 @transaction.atomic
 def api_add_forge_request_create(request: Union[HttpRequest, Request]) -> HttpResponse:
     """
     .. http:post:: /api/1/add-forge/request/create/
 
         Create a new request to add a forge to the list of those crawled regularly
         by Software Heritage.
 
         .. warning::
             That endpoint is not publicly available and requires authentication
             in order to be able to request it.
 
         {common_headers}
 
         :<json string forge_type: the type of forge
         :<json string forge_url: the base URL of the forge
         :<json string forge_contact_email: email of an administator of the forge to
             contact
         :<json string forge_contact_name: the name of the administrator
         :<json string forge_contact_comment: to explain how Software Heritage can
             verify forge administrator info are valid
 
         :statuscode 201: request successfully created
         :statuscode 400: missing or invalid field values
         :statuscode 403: user not authenticated
     """
     if not request.user.is_authenticated:
         return HttpResponseForbidden(
             "You must be authenticated to create a new add-forge request"
         )
 
     add_forge_request = AddForgeRequest()
 
     if isinstance(request, Request):
         # request submitted with request body in JSON (goes through DRF)
         form = AddForgeNowRequestForm(request.data, instance=add_forge_request)
     else:
         # request submitted with request body in form encoded format
         # (directly handled by Django)
         form = AddForgeNowRequestForm(request.POST, instance=add_forge_request)
 
     if form.errors:
         raise BadInputExc(json.dumps(form.errors))
 
     try:
         existing_request = AddForgeRequest.objects.get(
             forge_url=add_forge_request.forge_url
         )
     except ObjectDoesNotExist:
         pass
     else:
         return Response(
             f"Request for forge already exists (id {existing_request.id})",
             status=409,  # Conflict
         )
 
     add_forge_request.submitter_name = request.user.username
     add_forge_request.submitter_email = request.user.email
 
     form.save()
 
     request_history = AddForgeNowRequestHistory()
     request_history.request = add_forge_request
     request_history.new_status = AddForgeNowRequestStatus.PENDING.name
     request_history.actor = request.user.username
     request_history.actor_role = AddForgeNowRequestActorRole.SUBMITTER.name
     request_history.save()
 
     data = AddForgeNowRequestSerializer(add_forge_request).data
 
     return Response(data=data, status=201)
 
 
 @api_route(
     r"/add-forge/request/(?P<id>[0-9]+)/update/",
     "api-1-add-forge-request-update",
     methods=["POST"],
 )
 @api_doc("/add-forge/request/update", tags=["hidden"])
 @format_docstring()
 @transaction.atomic
 def api_add_forge_request_update(
     request: Union[HttpRequest, Request], id: int
 ) -> HttpResponse:
     """
     .. http:post:: /api/1/add-forge/request/update/
 
         Update a request to add a forge to the list of those crawled regularly
         by Software Heritage.
 
         .. warning::
             That endpoint is not publicly available and requires authentication
             in order to be able to request it.
 
         {common_headers}
 
         :<json string text: comment about new request status
         :<json string new_status: the new request status
 
         :statuscode 200: request successfully updated
         :statuscode 400: missing or invalid field values
         :statuscode 403: user is not a moderator
     """
     if not request.user.is_authenticated:
         return HttpResponseForbidden(
             "You must be authenticated to update a new add-forge request"
         )
 
     if not has_add_forge_now_permission(request.user):
         return HttpResponseForbidden("You are not a moderator")
 
     add_forge_request = (
         AddForgeRequest.objects.filter(id=id).select_for_update().first()
     )
 
     if add_forge_request is None:
         return HttpResponseBadRequest("Invalid request id")
 
     request_history = AddForgeNowRequestHistory()
     request_history.request = add_forge_request
 
     if isinstance(request, Request):
         # request submitted with request body in JSON (goes through DRF)
         form = AddForgeNowRequestHistoryForm(request.data, instance=request_history)
     else:
         # request submitted with request body in form encoded format
         # (directly handled by Django)
         form = AddForgeNowRequestHistoryForm(request.POST, instance=request_history)
 
     if form.errors:
         raise BadInputExc(json.dumps(form.errors))
 
     new_status_str = form["new_status"].value()
     if new_status_str is not None:
         new_status = AddForgeNowRequestStatus[new_status_str]
         current_status = AddForgeNowRequestStatus[add_forge_request.status]
         if new_status not in current_status.allowed_next_statuses():
             raise BadInputExc(
                 f"New request status {new_status} cannot be reached "
                 f"from current status {add_forge_request.status}"
             )
 
     _block_while_testing()
 
     request_history.actor = request.user.username
     request_history.actor_role = AddForgeNowRequestActorRole.MODERATOR.name
     form.save(commit=False)
 
     if request_history.new_status == "":
         request_history.new_status = None
 
     request_history.save()
 
     if request_history.new_status is not None:
         add_forge_request.status = request_history.new_status
         add_forge_request.save()
 
     data = AddForgeNowRequestSerializer(add_forge_request).data
     return Response(data=data, status=200)
 
 
 @api_route(
     r"/add-forge/request/list/",
     "api-1-add-forge-request-list",
     methods=["GET"],
 )
 @api_doc("/add-forge/request/list")
 @format_docstring()
 def api_add_forge_request_list(request: Request):
     """
     .. http:get:: /api/1/add-forge/request/list/
 
         List add forge requests submitted by users.
 
         {common_headers}
         {resheader_link}
 
         :query int page: optional page number
         :query int per_page: optional number of elements per page (bounded to 1000)
 
         :statuscode 200: always
     """
 
     add_forge_requests = AddForgeRequest.objects.order_by("-id")
 
     page_num = int(request.GET.get("page", 1))
     per_page = int(request.GET.get("per_page", 10))
     per_page = min(per_page, 1000)
 
     if (
         int(request.GET.get("user_requests_only", "0"))
         and request.user.is_authenticated
     ):
         add_forge_requests = add_forge_requests.filter(
             submitter_name=request.user.username
         )
 
     paginator = Paginator(add_forge_requests, per_page)
     page = paginator.page(page_num)
 
     if request.user.has_perm(ADD_FORGE_MODERATOR_PERMISSION):
         requests = AddForgeNowRequestSerializer(page.object_list, many=True).data
     else:
         requests = AddForgeNowRequestPublicSerializer(page.object_list, many=True).data
 
     results = [dict(request) for request in requests]
 
     response: Dict[str, Any] = {"results": results, "headers": {}}
 
     if page.has_previous():
         response["headers"]["link-prev"] = reverse(
             "api-1-add-forge-request-list",
             query_params={
                 "page": page.previous_page_number(),
                 "per_page": per_page,
             },
             request=request,
         )
 
     if page.has_next():
         response["headers"]["link-next"] = reverse(
             "api-1-add-forge-request-list",
             query_params={"page": page.next_page_number(), "per_page": per_page},
             request=request,
         )
 
     return response
 
 
 @api_route(
     r"/add-forge/request/(?P<id>[0-9]+)/get/",
     "api-1-add-forge-request-get",
     methods=["GET"],
 )
 @api_doc("/add-forge/request/get")
 @format_docstring()
 def api_add_forge_request_get(request: Request, id: int):
     """
     .. http:get:: /api/1/add-forge/request/get/
 
         Return all details about an add-forge request.
 
         {common_headers}
 
         :param int id: add-forge request identifier
 
         :statuscode 200: request details successfully returned
         :statuscode 400: request identifier does not exist
     """
 
     try:
         add_forge_request = AddForgeRequest.objects.get(id=id)
     except ObjectDoesNotExist:
         raise BadInputExc("Request id does not exist")
 
     request_history = AddForgeNowRequestHistory.objects.filter(
         request=add_forge_request
     ).order_by("id")
 
     if request.user.is_authenticated and request.user.has_perm(
         ADD_FORGE_MODERATOR_PERMISSION
     ):
         data = AddForgeNowRequestSerializer(add_forge_request).data
         history = AddForgeNowRequestHistorySerializer(request_history, many=True).data
     else:
         data = AddForgeNowRequestPublicSerializer(add_forge_request).data
         history = AddForgeNowRequestHistoryPublicSerializer(
             request_history, many=True
         ).data
 
     return {"request": data, "history": history}
diff --git a/swh/web/config.py b/swh/web/config.py
index 40b6c4aa..ecf4bff2 100644
--- a/swh/web/config.py
+++ b/swh/web/config.py
@@ -1,232 +1,233 @@
 # Copyright (C) 2017-2021  The Software Heritage developers
 # See the AUTHORS file at the top-level directory of this distribution
 # License: GNU Affero General Public License version 3, or any later version
 # See top-level LICENSE file for more information
 
 import os
 from typing import Any, Dict
 
 from swh.core import config
 from swh.counters import get_counters
 from swh.indexer.storage import get_indexer_storage
 from swh.scheduler import get_scheduler
 from swh.search import get_search
 from swh.storage import get_storage
 from swh.vault import get_vault
 from swh.web import settings
 
 SWH_WEB_SERVER_NAME = "archive.softwareheritage.org"
 SWH_WEB_INTERNAL_SERVER_NAME = "archive.internal.softwareheritage.org"
 
 SWH_WEB_STAGING_SERVER_NAMES = [
     "webapp.staging.swh.network",
     "webapp.internal.staging.swh.network",
 ]
 
 SETTINGS_DIR = os.path.dirname(settings.__file__)
 
 DEFAULT_CONFIG = {
     "allowed_hosts": ("list", []),
     "storage": (
         "dict",
         {
             "cls": "remote",
             "url": "http://127.0.0.1:5002/",
             "timeout": 10,
         },
     ),
     "indexer_storage": (
         "dict",
         {
             "cls": "remote",
             "url": "http://127.0.0.1:5007/",
             "timeout": 1,
         },
     ),
     "counters": (
         "dict",
         {
             "cls": "remote",
             "url": "http://127.0.0.1:5011/",
             "timeout": 1,
         },
     ),
     "search": (
         "dict",
         {
             "cls": "remote",
             "url": "http://127.0.0.1:5010/",
             "timeout": 10,
         },
     ),
     "search_config": (
         "dict",
         {
             "metadata_backend": "swh-indexer-storage",
         },  # or "swh-search"
     ),
     "log_dir": ("string", "/tmp/swh/log"),
     "debug": ("bool", False),
     "serve_assets": ("bool", False),
     "host": ("string", "127.0.0.1"),
     "port": ("int", 5004),
     "secret_key": ("string", "development key"),
     # do not display code highlighting for content > 1MB
     "content_display_max_size": ("int", 5 * 1024 * 1024),
     "snapshot_content_max_size": ("int", 1000),
     "throttling": (
         "dict",
         {
             "cache_uri": None,  # production: memcached as cache (127.0.0.1:11211)
             # development: in-memory cache so None
             "scopes": {
                 "swh_api": {
                     "limiter_rate": {"default": "120/h"},
                     "exempted_networks": ["127.0.0.0/8"],
                 },
                 "swh_api_origin_search": {
                     "limiter_rate": {"default": "10/m"},
                     "exempted_networks": ["127.0.0.0/8"],
                 },
                 "swh_vault_cooking": {
                     "limiter_rate": {"default": "120/h", "GET": "60/m"},
                     "exempted_networks": ["127.0.0.0/8"],
                 },
                 "swh_save_origin": {
                     "limiter_rate": {"default": "120/h", "POST": "10/h"},
                     "exempted_networks": ["127.0.0.0/8"],
                 },
                 "swh_api_origin_visit_latest": {
                     "limiter_rate": {"default": "700/m"},
                     "exempted_networks": ["127.0.0.0/8"],
                 },
             },
         },
     ),
     "vault": (
         "dict",
         {
             "cls": "remote",
             "args": {
                 "url": "http://127.0.0.1:5005/",
             },
         },
     ),
     "scheduler": ("dict", {"cls": "remote", "url": "http://127.0.0.1:5008/"}),
     "development_db": ("string", os.path.join(SETTINGS_DIR, "db.sqlite3")),
     "test_db": ("dict", {"name": "swh-web-test"}),
     "production_db": ("dict", {"name": "swh-web"}),
     "deposit": (
         "dict",
         {
             "private_api_url": "https://deposit.softwareheritage.org/1/private/",
             "private_api_user": "swhworker",
             "private_api_password": "some-password",
         },
     ),
     "e2e_tests_mode": ("bool", False),
     "es_workers_index_url": ("string", ""),
     "history_counters_url": (
         "string",
         (
             "http://counters1.internal.softwareheritage.org:5011"
             "/counters_history/history.json"
         ),
     ),
     "client_config": ("dict", {}),
     "keycloak": ("dict", {"server_url": "", "realm_name": ""}),
     "graph": (
         "dict",
         {
             "server_url": "http://graph.internal.softwareheritage.org:5009/graph/",
             "max_edges": {"staff": 0, "user": 100000, "anonymous": 1000},
         },
     ),
     "status": (
         "dict",
         {
             "server_url": "https://status.softwareheritage.org/",
             "json_path": "1.0/status/578e5eddcdc0cc7951000520",
         },
     ),
     "counters_backend": ("string", "swh-storage"),  # or "swh-counters"
     "staging_server_names": ("list", SWH_WEB_STAGING_SERVER_NAMES),
     "instance_name": ("str", "archive-test.softwareheritage.org"),
     "give": ("dict", {"public_key": "", "token": ""}),
     "features": ("dict", {"add_forge_now": True}),
+    "add_forge_now": ("dict", {"email_address": "add-forge-now@example.com"}),
 }
 
 swhweb_config: Dict[str, Any] = {}
 
 
 def get_config(config_file="web/web"):
     """Read the configuration file `config_file`.
 
     If an environment variable SWH_CONFIG_FILENAME is defined, this
     takes precedence over the config_file parameter.
 
     In any case, update the app with parameters (secret_key, conf)
     and return the parsed configuration as a dict.
 
     If no configuration file is provided, return a default
     configuration.
 
     """
 
     if not swhweb_config:
         config_filename = os.environ.get("SWH_CONFIG_FILENAME")
         if config_filename:
             config_file = config_filename
         cfg = config.load_named_config(config_file, DEFAULT_CONFIG)
         swhweb_config.update(cfg)
         config.prepare_folders(swhweb_config, "log_dir")
         if swhweb_config.get("search"):
             swhweb_config["search"] = get_search(**swhweb_config["search"])
         else:
             swhweb_config["search"] = None
         swhweb_config["storage"] = get_storage(**swhweb_config["storage"])
         swhweb_config["vault"] = get_vault(**swhweb_config["vault"])
         swhweb_config["indexer_storage"] = get_indexer_storage(
             **swhweb_config["indexer_storage"]
         )
         swhweb_config["scheduler"] = get_scheduler(**swhweb_config["scheduler"])
         swhweb_config["counters"] = get_counters(**swhweb_config["counters"])
     return swhweb_config
 
 
 def search():
     """Return the current application's search."""
     return get_config()["search"]
 
 
 def storage():
     """Return the current application's storage."""
     return get_config()["storage"]
 
 
 def vault():
     """Return the current application's vault."""
     return get_config()["vault"]
 
 
 def indexer_storage():
     """Return the current application's indexer storage."""
     return get_config()["indexer_storage"]
 
 
 def scheduler():
     """Return the current application's scheduler."""
     return get_config()["scheduler"]
 
 
 def counters():
     """Return the current application's counters."""
     return get_config()["counters"]
 
 
 def is_feature_enabled(feature_name: str) -> bool:
     """Determine whether a feature is enabled or not. If feature_name is not found at all,
     it's considered disabled.
 
     """
     return get_config()["features"].get(feature_name, False)
diff --git a/swh/web/tests/api/views/test_add_forge_now.py b/swh/web/tests/api/views/test_add_forge_now.py
index 58eeb752..538fa50f 100644
--- a/swh/web/tests/api/views/test_add_forge_now.py
+++ b/swh/web/tests/api/views/test_add_forge_now.py
@@ -1,548 +1,564 @@
 # Copyright (C) 2022  The Software Heritage developers
 # See the AUTHORS file at the top-level directory of this distribution
 # License: GNU Affero General Public License version 3, or any later version
 # See top-level LICENSE file for more information
 
 import datetime
 import threading
 import time
 from typing import Dict
 from urllib.parse import urlencode
 
 import iso8601
 import pytest
 
 from swh.web.add_forge_now.models import Request
 from swh.web.common.utils import reverse
+from swh.web.config import get_config
+from swh.web.inbound_email.utils import get_address_for_pk
 from swh.web.tests.utils import (
     check_api_get_responses,
     check_api_post_response,
     check_http_post_response,
 )
 
 
 @pytest.mark.django_db
 def test_add_forge_request_create_anonymous_user(api_client):
     url = reverse("api-1-add-forge-request-create")
     check_api_post_response(api_client, url, status_code=403)
 
 
 @pytest.mark.django_db
 def test_add_forge_request_create_empty(api_client, regular_user):
     api_client.force_login(regular_user)
     url = reverse("api-1-add-forge-request-create")
     resp = check_api_post_response(api_client, url, status_code=400)
     assert '"forge_type"' in resp.data["reason"]
 
 
 ADD_FORGE_DATA_FORGE1: Dict = {
     "forge_type": "gitlab",
     "forge_url": "https://gitlab.example.org",
     "forge_contact_email": "admin@gitlab.example.org",
     "forge_contact_name": "gitlab.example.org admin",
     "forge_contact_comment": "user marked as owner in forge members",
     "submitter_forward_username": True,
 }
 
 ADD_FORGE_DATA_FORGE2: Dict = {
     "forge_type": "gitea",
     "forge_url": "https://gitea.example.org",
     "forge_contact_email": "admin@gitea.example.org",
     "forge_contact_name": "gitea.example.org admin",
     "forge_contact_comment": "user marked as owner in forge members",
     "submitter_forward_username": True,
 }
 
 ADD_FORGE_DATA_FORGE3: Dict = {
     "forge_type": "heptapod",
     "forge_url": "https://heptapod.host/",
     "forge_contact_email": "admin@example.org",
     "forge_contact_name": "heptapod admin",
     "forge_contact_comment": "",  # authorized empty or null comment
     "submitter_forward_username": False,
 }
 
 ADD_FORGE_DATA_FORGE4: Dict = {
     **ADD_FORGE_DATA_FORGE3,
     "forge_url": "https://heptapod2.host/",
     "submitter_forward_username": "on",
 }
 
 ADD_FORGE_DATA_FORGE5: Dict = {
     **ADD_FORGE_DATA_FORGE3,
     "forge_url": "https://heptapod3.host/",
     "submitter_forward_username": "off",
 }
 
 
+def inbound_email_for_pk(pk: int) -> str:
+    """Check that the inbound email matches the one expected for the given pk"""
+
+    base_address = get_config()["add_forge_now"]["email_address"]
+    return get_address_for_pk(
+        salt="swh_web_add_forge_now", base_address=base_address, pk=pk
+    )
+
+
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 @pytest.mark.parametrize(
     "add_forge_data",
     [
         ADD_FORGE_DATA_FORGE1,
         ADD_FORGE_DATA_FORGE2,
         ADD_FORGE_DATA_FORGE3,
         ADD_FORGE_DATA_FORGE4,
     ],
 )
 def test_add_forge_request_create_success_post(
     api_client, regular_user, add_forge_data
 ):
     api_client.force_login(regular_user)
     url = reverse("api-1-add-forge-request-create")
 
     date_before = datetime.datetime.now(tz=datetime.timezone.utc)
 
     resp = check_api_post_response(
         api_client,
         url,
         data=add_forge_data,
         status_code=201,
     )
 
     date_after = datetime.datetime.now(tz=datetime.timezone.utc)
 
     consent = add_forge_data["submitter_forward_username"]
     # map the expected result with what's expectedly read from the db to ease comparison
     expected_consent_bool = consent == "on" if isinstance(consent, str) else consent
 
     assert resp.data == {
         **add_forge_data,
         "id": resp.data["id"],
         "status": "PENDING",
         "submission_date": resp.data["submission_date"],
         "submitter_name": regular_user.username,
         "submitter_email": regular_user.email,
         "submitter_forward_username": expected_consent_bool,
         "last_moderator": resp.data["last_moderator"],
         "last_modified_date": resp.data["last_modified_date"],
+        "inbound_email_address": inbound_email_for_pk(resp.data["id"]),
     }
 
     assert date_before < iso8601.parse_date(resp.data["submission_date"]) < date_after
 
     request = Request.objects.all().last()
 
     assert request.forge_url == add_forge_data["forge_url"]
     assert request.submitter_name == regular_user.username
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_create_success_form_encoded(client, regular_user):
     client.force_login(regular_user)
     url = reverse("api-1-add-forge-request-create")
 
     date_before = datetime.datetime.now(tz=datetime.timezone.utc)
 
     resp = check_http_post_response(
         client,
         url,
         request_content_type="application/x-www-form-urlencoded",
         data=urlencode(ADD_FORGE_DATA_FORGE1),
         status_code=201,
     )
 
     date_after = datetime.datetime.now(tz=datetime.timezone.utc)
 
     assert resp.data == {
         **ADD_FORGE_DATA_FORGE1,
         "id": resp.data["id"],
         "status": "PENDING",
         "submission_date": resp.data["submission_date"],
         "submitter_name": regular_user.username,
         "submitter_email": regular_user.email,
         "last_moderator": resp.data["last_moderator"],
         "last_modified_date": resp.data["last_modified_date"],
+        "inbound_email_address": inbound_email_for_pk(1),
     }
 
     assert date_before < iso8601.parse_date(resp.data["submission_date"]) < date_after
 
     request = Request.objects.all()[0]
 
     assert request.forge_url == ADD_FORGE_DATA_FORGE1["forge_url"]
     assert request.submitter_name == regular_user.username
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_create_duplicate(api_client, regular_user):
     api_client.force_login(regular_user)
     url = reverse("api-1-add-forge-request-create")
     check_api_post_response(
         api_client,
         url,
         data=ADD_FORGE_DATA_FORGE1,
         status_code=201,
     )
     check_api_post_response(
         api_client,
         url,
         data=ADD_FORGE_DATA_FORGE1,
         status_code=409,
     )
 
     requests = Request.objects.all()
     assert len(requests) == 1
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_update_anonymous_user(api_client):
     url = reverse("api-1-add-forge-request-update", url_args={"id": 1})
     check_api_post_response(api_client, url, status_code=403)
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_update_regular_user(api_client, regular_user):
     api_client.force_login(regular_user)
     url = reverse("api-1-add-forge-request-update", url_args={"id": 1})
     check_api_post_response(api_client, url, status_code=403)
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_update_non_existent(api_client, add_forge_moderator):
     api_client.force_login(add_forge_moderator)
     url = reverse("api-1-add-forge-request-update", url_args={"id": 1})
     check_api_post_response(api_client, url, status_code=400)
 
 
 def create_add_forge_request(api_client, regular_user, data=ADD_FORGE_DATA_FORGE1):
     api_client.force_login(regular_user)
     url = reverse("api-1-add-forge-request-create")
     return check_api_post_response(
         api_client,
         url,
         data=data,
         status_code=201,
     )
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_update_empty(api_client, regular_user, add_forge_moderator):
     create_add_forge_request(api_client, regular_user)
 
     api_client.force_login(add_forge_moderator)
     url = reverse("api-1-add-forge-request-update", url_args={"id": 1})
     check_api_post_response(api_client, url, status_code=400)
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_update_missing_field(
     api_client, regular_user, add_forge_moderator
 ):
     create_add_forge_request(api_client, regular_user)
 
     api_client.force_login(add_forge_moderator)
     url = reverse("api-1-add-forge-request-update", url_args={"id": 1})
     check_api_post_response(api_client, url, data={}, status_code=400)
     check_api_post_response(
         api_client, url, data={"new_status": "REJECTED"}, status_code=400
     )
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_update(api_client, regular_user, add_forge_moderator):
     create_add_forge_request(api_client, regular_user)
 
     api_client.force_login(add_forge_moderator)
     url = reverse("api-1-add-forge-request-update", url_args={"id": 1})
 
     check_api_post_response(
         api_client, url, data={"text": "updating request"}, status_code=200
     )
 
     check_api_post_response(
         api_client,
         url,
         data={"new_status": "REJECTED", "text": "request rejected"},
         status_code=200,
     )
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_update_invalid_new_status(
     api_client, regular_user, add_forge_moderator
 ):
     create_add_forge_request(api_client, regular_user)
 
     api_client.force_login(add_forge_moderator)
     url = reverse("api-1-add-forge-request-update", url_args={"id": 1})
     check_api_post_response(
         api_client,
         url,
         data={"new_status": "ACCEPTED", "text": "request accepted"},
         status_code=400,
     )
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_update_status_concurrent(
     api_client, regular_user, add_forge_moderator, mocker
 ):
 
     _block_while_testing = mocker.patch(
         "swh.web.api.views.add_forge_now._block_while_testing"
     )
     _block_while_testing.side_effect = lambda: time.sleep(1)
 
     create_add_forge_request(api_client, regular_user)
 
     api_client.force_login(add_forge_moderator)
     url = reverse("api-1-add-forge-request-update", url_args={"id": 1})
 
     worker_ended = False
 
     def worker():
         nonlocal worker_ended
         check_api_post_response(
             api_client,
             url,
             data={"new_status": "WAITING_FOR_FEEDBACK", "text": "waiting for message"},
             status_code=200,
         )
         worker_ended = True
 
     # this thread will first modify the request status to WAITING_FOR_FEEDBACK
     thread = threading.Thread(target=worker)
     thread.start()
 
     # the other thread (slower) will attempt to modify the request status to REJECTED
     # but it will not be allowed as the first faster thread already modified it
     # and REJECTED state can not be reached from WAITING_FOR_FEEDBACK one
     time.sleep(0.5)
     check_api_post_response(
         api_client,
         url,
         data={"new_status": "REJECTED", "text": "request accepted"},
         status_code=400,
     )
     thread.join()
     assert worker_ended
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_list_anonymous(api_client, regular_user):
     url = reverse("api-1-add-forge-request-list")
 
     resp = check_api_get_responses(api_client, url, status_code=200)
 
     assert resp.data == []
 
     create_add_forge_request(api_client, regular_user)
 
     resp = check_api_get_responses(api_client, url, status_code=200)
 
     add_forge_request = {
         "forge_url": ADD_FORGE_DATA_FORGE1["forge_url"],
         "forge_type": ADD_FORGE_DATA_FORGE1["forge_type"],
         "status": "PENDING",
         "submission_date": resp.data[0]["submission_date"],
         "id": resp.data[0]["id"],
     }
 
     assert resp.data == [add_forge_request]
 
     create_add_forge_request(api_client, regular_user, data=ADD_FORGE_DATA_FORGE2)
 
     resp = check_api_get_responses(api_client, url, status_code=200)
 
     other_forge_request = {
         "forge_url": ADD_FORGE_DATA_FORGE2["forge_url"],
         "forge_type": ADD_FORGE_DATA_FORGE2["forge_type"],
         "status": "PENDING",
         "submission_date": resp.data[0]["submission_date"],
         "id": resp.data[0]["id"],
     }
 
     assert resp.data == [other_forge_request, add_forge_request]
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_list_moderator(
     api_client, regular_user, add_forge_moderator
 ):
     url = reverse("api-1-add-forge-request-list")
 
     create_add_forge_request(api_client, regular_user)
     create_add_forge_request(api_client, regular_user, data=ADD_FORGE_DATA_FORGE2)
 
     api_client.force_login(add_forge_moderator)
     resp = check_api_get_responses(api_client, url, status_code=200)
 
     add_forge_request = {
         **ADD_FORGE_DATA_FORGE1,
         "status": "PENDING",
         "submission_date": resp.data[1]["submission_date"],
         "submitter_name": regular_user.username,
         "submitter_email": regular_user.email,
         "last_moderator": resp.data[1]["last_moderator"],
         "last_modified_date": resp.data[1]["last_modified_date"],
         "id": resp.data[1]["id"],
+        "inbound_email_address": inbound_email_for_pk(resp.data[1]["id"]),
     }
 
     other_forge_request = {
         **ADD_FORGE_DATA_FORGE2,
         "status": "PENDING",
         "submission_date": resp.data[0]["submission_date"],
         "submitter_name": regular_user.username,
         "submitter_email": regular_user.email,
         "last_moderator": resp.data[0]["last_moderator"],
         "last_modified_date": resp.data[0]["last_modified_date"],
         "id": resp.data[0]["id"],
+        "inbound_email_address": inbound_email_for_pk(resp.data[0]["id"]),
     }
 
     assert resp.data == [other_forge_request, add_forge_request]
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_list_pagination(
     api_client, regular_user, api_request_factory
 ):
     create_add_forge_request(api_client, regular_user)
     create_add_forge_request(api_client, regular_user, data=ADD_FORGE_DATA_FORGE2)
 
     url = reverse("api-1-add-forge-request-list", query_params={"per_page": 1})
 
     resp = check_api_get_responses(api_client, url, 200)
 
     assert len(resp.data) == 1
 
     request = api_request_factory.get(url)
 
     next_url = reverse(
         "api-1-add-forge-request-list",
         query_params={"page": 2, "per_page": 1},
         request=request,
     )
 
     assert resp["Link"] == f'<{next_url}>; rel="next"'
 
     resp = check_api_get_responses(api_client, next_url, 200)
 
     assert len(resp.data) == 1
 
     prev_url = reverse(
         "api-1-add-forge-request-list",
         query_params={"page": 1, "per_page": 1},
         request=request,
     )
 
     assert resp["Link"] == f'<{prev_url}>; rel="previous"'
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_list_submitter_filtering(
     api_client, regular_user, regular_user2
 ):
     create_add_forge_request(api_client, regular_user)
     create_add_forge_request(api_client, regular_user2, data=ADD_FORGE_DATA_FORGE2)
 
     api_client.force_login(regular_user)
     url = reverse(
         "api-1-add-forge-request-list", query_params={"user_requests_only": 1}
     )
     resp = check_api_get_responses(api_client, url, status_code=200)
 
     assert len(resp.data) == 1
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_get(api_client, regular_user, add_forge_moderator):
     resp = create_add_forge_request(api_client, regular_user)
 
     submission_date = resp.data["submission_date"]
 
     url = reverse("api-1-add-forge-request-update", url_args={"id": 1})
 
     api_client.force_login(add_forge_moderator)
     check_api_post_response(
         api_client,
         url,
         data={"new_status": "WAITING_FOR_FEEDBACK", "text": "waiting for message"},
         status_code=200,
     )
     api_client.logout()
 
     url = reverse("api-1-add-forge-request-get", url_args={"id": 1})
 
     resp = check_api_get_responses(api_client, url, status_code=200)
 
     assert resp.data == {
         "request": {
             "forge_url": ADD_FORGE_DATA_FORGE1["forge_url"],
             "forge_type": ADD_FORGE_DATA_FORGE1["forge_type"],
             "id": 1,
             "status": "WAITING_FOR_FEEDBACK",
             "submission_date": submission_date,
         },
         "history": [
             {
                 "id": 1,
                 "actor_role": "SUBMITTER",
                 "date": resp.data["history"][0]["date"],
                 "new_status": "PENDING",
             },
             {
                 "id": 2,
                 "actor_role": "MODERATOR",
                 "date": resp.data["history"][1]["date"],
                 "new_status": "WAITING_FOR_FEEDBACK",
             },
         ],
     }
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_get_moderator(api_client, regular_user, add_forge_moderator):
     resp = create_add_forge_request(api_client, regular_user)
 
     submission_date = resp.data["submission_date"]
 
     url = reverse("api-1-add-forge-request-update", url_args={"id": 1})
 
     api_client.force_login(add_forge_moderator)
     check_api_post_response(
         api_client,
         url,
         data={"new_status": "WAITING_FOR_FEEDBACK", "text": "waiting for message"},
         status_code=200,
     )
 
     url = reverse("api-1-add-forge-request-get", url_args={"id": 1})
 
     resp = check_api_get_responses(api_client, url, status_code=200)
     resp.data["history"] = [dict(history_item) for history_item in resp.data["history"]]
 
     assert resp.data == {
         "request": {
             **ADD_FORGE_DATA_FORGE1,
             "id": 1,
             "status": "WAITING_FOR_FEEDBACK",
             "submission_date": submission_date,
             "submitter_name": regular_user.username,
             "submitter_email": regular_user.email,
             "last_moderator": add_forge_moderator.username,
             "last_modified_date": resp.data["history"][1]["date"],
+            "inbound_email_address": inbound_email_for_pk(1),
         },
         "history": [
             {
                 "id": 1,
                 "text": "",
                 "actor": regular_user.username,
                 "actor_role": "SUBMITTER",
                 "date": resp.data["history"][0]["date"],
                 "new_status": "PENDING",
             },
             {
                 "id": 2,
                 "text": "waiting for message",
                 "actor": add_forge_moderator.username,
                 "actor_role": "MODERATOR",
                 "date": resp.data["history"][1]["date"],
                 "new_status": "WAITING_FOR_FEEDBACK",
             },
         ],
     }
 
 
 @pytest.mark.django_db(transaction=True, reset_sequences=True)
 def test_add_forge_request_get_invalid(api_client):
     url = reverse("api-1-add-forge-request-get", url_args={"id": 3})
     check_api_get_responses(api_client, url, status_code=400)