Start for free
Accounts

List an account's verified recipients

GET
/api/v1/accounts/{accountId}/verified-recipients

Every outside address this account has asked to send to, pending or verified, oldest first. Addresses on the account's own domains are always verified recipients and are never listed. Unpaginated: an account holds at most 100. Reachable by the account's own key or a system key.

Authorization

bearerAuth
headerAuthorizationBearer <token>

Two credential kinds share this scheme; GET /api/v1/auth/whoami answers which one you hold and what it reaches.

oek_… API key (minted by POST /api/v1/api-keys; shown once at mint). role: account reaches the full account surface: the directory (domains, routes, patterns, api-keys, accounts, address lists) plus every mailbox the account owns. role: system additionally reaches the operator surface, which is documented separately.

oemp_… mailbox app password (minted by POST /api/v1/identities/{identityId}/credentials). Reaches ONE mailbox: its messages, labels, threads, search, sync, send, filters and PIM collections. Directory routes refuse it with 403 insufficient_scope.

Refusal vocabulary: a missing, malformed, expired, or revoked credential answers 401 unauthorized with a WWW-Authenticate: Bearer challenge; a VALID credential outside its scope answers 403 (insufficient_scope for an app password on a directory route, system_credentials_required where only the operator may call). The public routes (health, branding, token-in-path capabilities) declare security: [].

Path Parameters

accountId*string

Account ULID identifier

Response Body

The list

application/json
  1. response
recipients*array<>
Example Request
curl -X GET 'https://api.open.email/api/v1/accounts/string/verified-recipients'
Example Response
{
  "recipients": [
    {
      "address": "string",
      "createdAt": 0,
      "id": "string",
      "lastSentAt": 0,
      "state": "pending",
      "verifiedAt": 0
    }
  ]
}

Add a verified recipient POST

Names an outside address and mails it a link to a page whose Confirm button makes it a verified recipient of this account; the link works for seven days, and…

Remove a verified recipient DELETE

Removes the address from the account's list, pending or verified; every link mailed for it stops working. Adding it again starts over with a new link…