Start for free
Accounts

Add a verified recipient

POST
/api/v1/accounts/{accountId}/verified-recipients

Names an outside address and mails it a link to a page whose Confirm button makes it a verified recipient of this account; the link works for seven days, and opening it changes nothing on its own. Posting a pending address again mails a fresh link, at most once a minute. Posting a verified address answers 200 with sent: false and mails nothing. A refusal of the mail that concerns the address itself (its server refused it, or it is suppressed) is answered exactly as a sent link is. Reachable by the account's own key or a system key.

Authorization

bearerAuth
headerAuthorizationBearer <token>

Two credential kinds share this scheme; GET /api/v1/auth/whoami answers which one you hold and what it reaches.

oek_… API key (minted by POST /api/v1/api-keys; shown once at mint). role: account reaches the full account surface: the directory (domains, routes, patterns, api-keys, accounts, address lists) plus every mailbox the account owns. role: system additionally reaches the operator surface, which is documented separately.

oemp_… mailbox app password (minted by POST /api/v1/identities/{identityId}/credentials). Reaches ONE mailbox: its messages, labels, threads, search, sync, send, filters and PIM collections. Directory routes refuse it with 403 insufficient_scope.

Refusal vocabulary: a missing, malformed, expired, or revoked credential answers 401 unauthorized with a WWW-Authenticate: Bearer challenge; a VALID credential outside its scope answers 403 (insufficient_scope for an app password on a directory route, system_credentials_required where only the operator may call). The public routes (health, branding, token-in-path capabilities) declare security: [].

Path Parameters

accountId*string

Account ULID identifier

Request Body

application/json
  1. body
address*string

The outside address to verify

Length3 <= length <= 320

Response Body

The address's row as it now stands, and whether a link was mailed

application/json
  1. response
recipient*

The address's row as it now stands

sent*boolean

True when a confirmation link was mailed by this request; false when the address was already verified and nothing was sent

Example Request
curl -X POST 'https://api.open.email/api/v1/accounts/string/verified-recipients' \
  -H 'Content-Type: application/json' \
  -d '{
  "address": "string"
}'
Example Response
{
  "recipient": {
    "address": "string",
    "createdAt": 0,
    "id": "string",
    "lastSentAt": 0,
    "state": "pending",
    "verifiedAt": 0
  },
  "sent": true
}

Get an account's limits and enforcement state GET

Returns every plan limit of the account with its resolved threshold (the account's own number, or the platform default it follows), enforcement state, stored…

List an account's verified recipients GET

Every outside address this account has asked to send to, pending or verified, oldest first. Addresses on the account's own domains are always verified…