diff --git a/go/roothash/api/message/incoming_message.go b/go/roothash/api/message/incoming_message.go
index e9ac7d38992..8b9c72ff6ac 100644
--- a/go/roothash/api/message/incoming_message.go
+++ b/go/roothash/api/message/incoming_message.go
@@ -1,6 +1,9 @@
 package message
 
 import (
+	"fmt"
+
+	"github.com/oasisprotocol/oasis-core/go/common/cbor"
 	"github.com/oasisprotocol/oasis-core/go/common/crypto/hash"
 	"github.com/oasisprotocol/oasis-core/go/common/quantity"
 	staking "github.com/oasisprotocol/oasis-core/go/staking/api"
@@ -26,10 +29,29 @@ type IncomingMessage struct {
 	// transferred before the message is processed by the runtime.
 	Tokens quantity.Quantity `json:"tokens,omitempty"`
 
-	// Data is arbitrary runtime-dependent data.
+	// Data is a serialized IncomingMessageData.
 	Data []byte `json:"data,omitempty"`
 }
 
+const LatestIncomingMessageDataVersion = 1
+
+type IncomingMessageData struct {
+	cbor.Versioned
+
+	// Transaction is an embedded transaction.
+	Transaction *[]byte `json:"tx,omitempty"`
+}
+
+func (d *IncomingMessageData) ValidateBasic() error {
+	if d.V != LatestIncomingMessageDataVersion {
+		return fmt.Errorf("invalid incoming message data version (expected: %d got: %d)",
+			LatestIncomingMessageDataVersion,
+			d.V,
+		)
+	}
+	return nil
+}
+
 // InMessagesHash returns a hash of provided incoming runtime messages.
 func InMessagesHash(msgs []*IncomingMessage) (h hash.Hash) {
 	if len(msgs) == 0 {