Start for free
Mailboxes

List the addresses a mailbox may send as

GET
/api/v1/mailboxes/{mailboxId}/send-as

Returns the addresses this mailbox may use as From, primary first: its routed addresses on domains that may send, then *@domain wherever a catch-all on a sending domain lands in it (RFC 8621 §6's wildcard, any address on that domain). The same list JMAP Identity/get reports. subaddressing says whether an address's +tag forms are sendable too. A domain-scoped key sees only its own domains. Suggestions for a From picker, not an authorization list: an address a narrower catch-all pattern routes here is sendable without being listed, and the list stops at 100 addresses, so submission decides.

Authorization

bearerAuth
headerAuthorizationBearer <token>

Two credential kinds share this scheme; GET /api/v1/auth/whoami answers which one you hold and what it reaches.

oek_… API key (minted by POST /api/v1/api-keys; shown once at mint). role: account reaches the full account surface: the directory (domains, routes, patterns, api-keys, accounts, address lists) plus every mailbox the account owns. role: system additionally reaches the operator surface, which is documented separately.

oemp_… mailbox app password (minted by POST /api/v1/identities/{identityId}/credentials). Reaches ONE mailbox: its messages, labels, threads, search, sync, send, filters and PIM collections. Directory routes refuse it with 403 insufficient_scope.

Refusal vocabulary: a missing, malformed, expired, or revoked credential answers 401 unauthorized with a WWW-Authenticate: Bearer challenge; a VALID credential outside its scope answers 403 (insufficient_scope for an app password on a directory route, system_credentials_required where only the operator may call). The public routes (health, branding, token-in-path capabilities) declare security: [].

Path Parameters

mailboxId*string

Mailbox ULID identifier

Response Body

The addresses, primary first

application/json
  1. response
addresses*array<>

Primary address first, then the mailbox's other routed addresses on domains that may send, then wildcards; at most 100 addresses. Not exhaustive: an address a narrower catch-all pattern routes here is sendable without being listed

Example Request
curl -X GET 'https://api.open.email/api/v1/mailboxes/string/send-as'
Example Response
{
  "addresses": [
    {
      "email": "string",
      "subaddressing": true
    }
  ]
}

List what delivers to a mailbox GET

Returns the addresses that deliver mail to this mailbox, and whether it may send as each: its primary address, its other routes and their alias-domain…

Check whether a mailbox may send from an address POST

Checks one From address through the same routing, ownership, credential scope and sending-state authorization as submission, including aliases, subaddresses…