[Skip to content](/content/docs/reference/api/objects#nd-page/index.html) [Skip to content](/content/docs/reference/api/objects#nd-page/index.html) \[01/180\]AgentIdentityRequest Endpoint pages link here for nested objects. Fields marked required are always present in responses and must be sent in requests. ## [AgentIdentityRequest](/content/docs/reference/api/objects\#agentidentityrequest/index.html) FieldDescription `type``"anonymous" | "service_auth" | "identity_assertion"`Required Registration type. `name``string` Agent label (first 100 characters). Untrusted; shown as agent-described in the dashboard. `client_name``string` Alias of name. `login_hint``string` service\_auth: email address of the user the agent acts for. Required for that type. `assertion_type``string` identity\_assertion: urn:ietf:params:oauth:token-type:id-jag. Required for that type. `assertion``string` identity\_assertion: the ID-JAG (signed JWT). Required for that type. ## [AgentIdentityResponse](/content/docs/reference/api/objects\#agentidentityresponse/index.html) FieldDescription `registration_id``string`Required `agent_id``string`Required Same value as registration\_id. `registration_type``"anonymous" | "service_auth" | "identity_assertion"`Required anonymous: no human yet; a sandbox inbox until a human claims it. service\_auth: on behalf of a named user, who confirms first. identity\_assertion: an ID-JAG from a trusted agent provider. `identity_assertion``string` Service-signed JWT to exchange at /oauth2/token. Absent for service\_auth until the claim completes. `assertion_expires``string (date-time)` `scopes``("inboxes.read" | "inboxes.write" | "messages.read" | "messages.send" | "messages.write" | "webhooks.read" | "webhooks.write" | "domains.read" | "domains.write" | "lists.read" | "lists.write" | "metrics.read" | "pods.read" | "pods.write" | "api_keys.read" | "api_keys.write")[]` identity\_assertion registrations: the granted scopes. `pre_claim_scopes``("inboxes.read" | "inboxes.write" | "messages.read" | "messages.send" | "messages.write" | "webhooks.read" | "webhooks.write" | "domains.read" | "domains.write" | "lists.read" | "lists.write" | "metrics.read" | "pods.read" | "pods.write" | "api_keys.read" | "api_keys.write")[]` anonymous registrations: scopes before a human claims the agent (its sandbox inbox only). `post_claim_scopes``("inboxes.read" | "inboxes.write" | "messages.read" | "messages.send" | "messages.write" | "webhooks.read" | "webhooks.write" | "domains.read" | "domains.write" | "lists.read" | "lists.write" | "metrics.read" | "pods.read" | "pods.write" | "api_keys.read" | "api_keys.write")[]` Scopes after the claim. `claim_url``string` Where to start the claim ceremony (/agent/identity/claim). `claim_token``string` Secret for /agent/identity/claim and the claim grant. `claim_token_expires``string (date-time)` `claim``object` service\_auth registrations: the ceremony is already started. `inbox``object` anonymous registrations: the ephemeral sandbox inbox. There is no API key; authenticate with the access token from /oauth2/token. ## [AgentRegistration](/content/docs/reference/api/objects\#agentregistration/index.html) An agent registration. Hashes and tokens are never included. FieldDescription `agent_id``string`Required ID of the registration (reg\_...). `registration_id``string`Required Same value as agent\_id. `registration_type``"anonymous" | "service_auth" | "identity_assertion"`Required `status``"pending_claim" | "claimed" | "revoked"`Required `name``string` Agent-described label. Untrusted. `client``string` Provider name for identity\_assertion, otherwise agent (self-described) or anonymous agent. `organization_id``string` Organization the registration is bound to (after a claim, or right away for identity\_assertion). `inbox_id``string` The sandbox inbox of an anonymous registration. `email``string` Verified email bound at claim or carried by the identity assertion. `issuer``string` Issuer of the identity assertion (identity\_assertion). `agent_platform``string` agent\_platform claim of the identity assertion. `created_at``string (date-time)`Required When the agent registered. `claimed_at``string (date-time)` When a human claimed the registration. `revoked_at``string (date-time)` When the registration was revoked. `expires_at``string (date-time)` When an unclaimed registration expires. ## [ApiKeyPermissions](/content/docs/reference/api/objects\#apikeypermissions/index.html) Permissions of the key, as `{ "": true }`. Only names set to `true` are granted; `false` is the same as leaving the name out. An omitted (or `null`) permission object means full access for the key scope, like `{"*": true}`; neither includes `inbound_raw`, which must be granted by name. A key can only be given permissions its creator has. Another name set to `true` (for example AgentMail’s `calendar_*`, `app_*` or `account_update`, which MachineMail does not support) is a `400`. FieldDescription `*``boolean` Every permission except inbound\_raw. {"\*": true, "inbound\_raw": true} is full access plus raw injection. `inbox_read``boolean` Read inbox details. `inbox_create``boolean` Create new inboxes. `inbox_update``boolean` Update inbox settings. `inbox_delete``boolean` Delete inboxes. `thread_read``boolean` Read threads. `thread_delete``boolean` Delete threads. `message_read``boolean` Read messages. `message_reply``boolean` Reply and reply-all. message\_send allows them too. `message_send``boolean` Send messages (and reply, reply-all, forward). `message_update``boolean` Update message labels. Also required to update threads. `message_delete``boolean` Delete messages. `label_spam_read``boolean` Access messages labeled spam. `label_blocked_read``boolean` Access messages labeled blocked. `label_unauthenticated_read``boolean` Access messages labeled unauthenticated. `label_trash_read``boolean` Access messages labeled trash. `draft_read``boolean` Read drafts. `draft_create``boolean` Create drafts. `draft_update``boolean` Update drafts. `draft_delete``boolean` Delete drafts. `draft_send``boolean` Send drafts. `webhook_read``boolean` Read webhook configurations. `webhook_create``boolean` Create webhooks. `webhook_update``boolean` Update webhooks. `webhook_delete``boolean` Delete webhooks. `domain_read``boolean` Read domain details. `domain_create``boolean` Create domains. `domain_update``boolean` Update domains. `domain_delete``boolean` Delete domains. `list_entry_read``boolean` Read list entries and suppressions. `list_entry_create``boolean` Create list entries and suppressions. `list_entry_delete``boolean` Delete list entries and suppressions. `trusted_domain_read``boolean` Read trusted domains and preview new ones. `trusted_domain_create``boolean` Add trusted domains. Organization API keys and the dashboard only: pod and inbox keys get 403 even with it. `trusted_domain_update``boolean` Change trusted domains. Organization API keys and the dashboard only, as for trusted\_domain\_create. `trusted_domain_delete``boolean` Remove trusted domains. `metrics_read``boolean` Read metrics and events. `api_key_read``boolean` Read API keys. `api_key_create``boolean` Create API keys. `api_key_update``boolean` Update API keys. `api_key_delete``boolean` Delete API keys. `pod_read``boolean` Read pods. `pod_create``boolean` Create pods. `pod_update``boolean` Update pods. `pod_delete``boolean` Delete pods. `inbound_raw``boolean` Inject raw mail with POST /inbound/raw. Never implied by an unrestricted key or \*: it must be granted by name. ## [Attachment](/content/docs/reference/api/objects\#attachment/index.html) FieldDescription `attachment_id``string`Required ID of the attachment. `filename``string` Filename of the attachment. `size``integer`Required Size of the attachment in bytes. `content_type``string` Content type of the attachment. `content_disposition``string` Content disposition of the attachment (inline or attachment). `content_id``string` Content ID of the attachment. ## [AttachmentResponse](/content/docs/reference/api/objects\#attachmentresponse/index.html) FieldDescription `attachment_id``string`Required ID of the attachment. `filename``string` Filename of the attachment. `size``integer`Required Size of the attachment in bytes. `content_type``string` Content type of the attachment. `content_disposition``string` Content disposition of the attachment (inline or attachment). `content_id``string` Content ID of the attachment. `download_url``string`Required URL of the attachment bytes. Depending on the storage backend: a signed storage URL, the API URL GET .../attachments/{attachment\_id}/download (send your API key), or a data: URI. `expires_at``string (date-time)`Required When download\_url expires: one hour from the request unless the signed URL sets its own expiry. ## [AuthConfigResponse](/content/docs/reference/api/objects\#authconfigresponse/index.html) How people sign in to MachineMail. FieldDescription `workos``boolean`Required Legacy alias of email\_code, kept for older clients: sign in with an email code (POST /auth/email/start), a social provider (GET /auth/social/{provider}) or SSO. `email_code``boolean`Required Email-code sign-in (POST /auth/email/start, then POST /auth/email/verify) is available. `providers``("google" | "github" | "apple" | "microsoft")[]`Required Social providers on offer (GET /auth/social/{provider}). Empty when none are offered. `magic_link``boolean`Required Magic-link sign-in (POST /auth/magic-link) is available. `password``boolean`Required The deprecated password endpoints are available. `authkit``boolean`RequiredDeprecated Deprecated: always false. Kept for older clients; see email\_code. `passkey``boolean`Required Passkey sign-in (POST /auth/passkey/options, then POST /auth/passkey/verify) is offered: show “Sign in with a passkey” and passkey autofill on the email field. ## [AuthorizationServerMetadata](/content/docs/reference/api/objects\#authorizationservermetadata/index.html) RFC 8414 Authorization Server Metadata (as the MCP authorization specification asks for it) plus the auth.md `agent_auth` block. FieldDescription `resource``string`Required The protected resource: / (the REST API and MCP), or / for a path-suffixed document. On the MCP server’s own host, the MCP server’s URL (https://mcp.machinemail.dev/mcp); on the issuer, /mcp is the legacy MCP alias. `authorization_servers``string[]`Required `scopes_supported``("inboxes.read" | "inboxes.write" | "messages.read" | "messages.send" | "messages.write" | "webhooks.read" | "webhooks.write" | "domains.read" | "domains.write" | "lists.read" | "lists.write" | "metrics.read" | "pods.read" | "pods.write" | "api_keys.read" | "api_keys.write")[]`Required `bearer_methods_supported``string[]`Required header. `issuer``string`Required `authorization_endpoint``string`Required /oauth2/authorize: authorization code grant with PKCE (S256). `token_endpoint``string`Required `registration_endpoint``string`Required /oauth2/register: Dynamic Client Registration (RFC 7591), public or confidential clients. `revocation_endpoint``string`Required `device_authorization_endpoint``string`Required /auth/cli/device/code: the device grant of the MachineMail CLI (client\_id machinemail-cli only). `jwks_uri``string`Required `service_documentation``string`Required `grant_types_supported``string[]`Required authorization\_code, refresh\_token, urn:ietf:params:oauth:grant-type:device\_code, urn:ietf:params:oauth:grant-type:jwt-bearer, urn:workos:agent-auth:grant-type:claim. `response_types_supported``string[]`Required code. `response_modes_supported``string[]`Required query. `code_challenge_methods_supported``string[]`Required S256. `token_endpoint_auth_methods_supported``string[]`Required none (public clients: every URL client ID, and registrations without a secret), client\_secret\_post and client\_secret\_basic (registrations that asked for a secret). Every client uses PKCE. `revocation_endpoint_auth_methods_supported``string[]`Required Same as token\_endpoint\_auth\_methods\_supported. `client_id_metadata_document_supported``boolean`Required true: an https URL is accepted as client\_id (OAuth Client ID Metadata Document). `authorization_response_iss_parameter_supported``boolean`Required true: authorization responses carry iss (RFC 9207). `agent_auth``object`Required ## [BatchGetMessagesRequest](/content/docs/reference/api/objects\#batchgetmessagesrequest/index.html) FieldDescription `message_ids``string[]`Required IDs of the messages to fetch. Only the first 100 distinct IDs are read. ## [BatchGetMessagesResponse](/content/docs/reference/api/objects\#batchgetmessagesresponse/index.html) FieldDescription `limit``integer`Required Number of IDs in the request. `count``integer`Required Number of messages returned. `messages` [Message\[\]](/content/docs/reference/api/objects#message/index.html) Required Found messages, in request order. IDs not found in the inbox are omitted. ## [BatchUpdateMessagesRequest](/content/docs/reference/api/objects\#batchupdatemessagesrequest/index.html) FieldDescription `message_ids``string[]`Required IDs of the messages to update. Only the first 100 distinct IDs are updated. `add_labels``string | string[]` Label or labels to add to every message. `remove_labels``string | string[]` Label or labels to remove from every message. ## [BatchUpdateMessagesResponse](/content/docs/reference/api/objects\#batchupdatemessagesresponse/index.html) FieldDescription `limit``integer`Required Number of IDs in the request. `count``integer`Required Number of messages updated. `updates` [UpdateMessageResponse\[\]](/content/docs/reference/api/objects#updatemessageresponse/index.html) Required Updated messages with their new labels, in request order. IDs not found are omitted. ## [BearerApiKey](/content/docs/reference/api/objects\#bearerapikey/index.html) An API key presented as a bearer token in the `Authorization` header. FieldDescription `type``"bearer"`Required Always bearer: MachineMail has no public-key credentials. `api_key_id``string`Required ID of the API key. `prefix``string`Required First 12 characters of the key (mm\_live\_ and 4 more), safe to display. `name``string`Required Name of the key. `pod_id``string` Pod the key is scoped to: it can only access resources in this pod. `inbox_id``string` Inbox the key is scoped to: it can only access this inbox. `permissions` [ApiKeyPermissions](/content/docs/reference/api/objects#apikeypermissions/index.html) Permissions of the key, as { "": true }. Only names set to true are granted; false is the same as leaving the name out. An omitted (or null) permission object means full access for the key scope, like {"\*": true}; neither includes inbound\_raw, which must be granted by name. A key can only be given permissions its creator has. Another name set to true (for example AgentMail’s calendar\_\*, app\_\* or account\_update, which MachineMail does not support) is a 400. `created_at``string (date-time)`Required Time at which the key was created. `expires_at``string (date-time)` Time at which the key expires: requests with it then get 401. Absent when it does not expire. `organization_id``string`Required ID of the organization. `used_at``string (date-time)` Time at which the key was last used. `revoked_at``string (date-time)` When the key was deleted (revoked). Revoked keys are not listed but can still be fetched by ID. `updated_at``string (date-time)`Required Time at which the name, permissions or revocation last changed. Use does not change it. ## [Bounce](/content/docs/reference/api/objects\#bounce/index.html) FieldDescription `inbox_id``string`Required ID of the inbox. `thread_id``string`Required ID of the thread. `message_id``string`Required ID of the message. `timestamp``string (date-time)`Required When it happened. `type``string`Required Bounce type: Permanent or Transient (or the provider type). `sub_type``string`Required Bounce sub-type, General when the provider gives none. `recipients` [Recipient\[\]](/content/docs/reference/api/objects#recipient/index.html) Required Bounced recipients. Permanent bounces are added to the suppression list. ## [ClaimBlock](/content/docs/reference/api/objects\#claimblock/index.html) RFC 8628-shaped claim ceremony block. FieldDescription `user_code``string`Required 6-digit code the human enters in the dashboard. `verification_uri``string`Required https://machinemail.dev/claim?claim\_attempt\_token=cat\_...: the page to send the human to. `expires_in``integer`Required Seconds until user\_code expires. `interval``integer`Required Minimum seconds between /oauth2/token polls. ## [ClaimCompleteRequest](/content/docs/reference/api/objects\#claimcompleterequest/index.html) FieldDescription `user_code``string`Required The 6-digit code the agent shows; spaces and dashes are ignored. `claim_attempt_token``string` The cat\_... token from verification\_uri; when given, it must belong to the same attempt as user\_code. ## [ClaimCompleteResponse](/content/docs/reference/api/objects\#claimcompleteresponse/index.html) The claimed registration plus the moved inbox. FieldDescription `agent_id``string`Required ID of the registration (reg\_...). `registration_id``string`Required Same value as agent\_id. `registration_type``"anonymous" | "service_auth" | "identity_assertion"`Required `status``"claimed"`Required `name``string` Agent-described label. Untrusted. `client``string` Provider name for identity\_assertion, otherwise agent (self-described) or anonymous agent. `organization_id``string`Required The organization of the signed-in user. `inbox_id``string` The sandbox inbox of an anonymous registration. `email``string` Verified email bound at claim or carried by the identity assertion. `issuer``string` Issuer of the identity assertion (identity\_assertion). `agent_platform``string` agent\_platform claim of the identity assertion. `created_at``string (date-time)`Required When the agent registered. `claimed_at``string (date-time)` When a human claimed the registration. `revoked_at``string (date-time)` When the registration was revoked. `expires_at``string (date-time)` When an unclaimed registration expires. `inbox``object` The former sandbox inbox, now permanent and in the user’s default pod. ## [ClaimPreviewResponse](/content/docs/reference/api/objects\#claimpreviewresponse/index.html) An agent registration plus the claim details. FieldDescription `agent_id``string`Required ID of the registration (reg\_...). `registration_id``string`Required Same value as agent\_id. `registration_type``"anonymous" | "service_auth" | "identity_assertion"`Required `status``"pending_claim" | "claimed" | "revoked"`Required `name``string` Agent-described label. Untrusted. `client``string` Provider name for identity\_assertion, otherwise agent (self-described) or anonymous agent. `organization_id``string` Organization the registration is bound to (after a claim, or right away for identity\_assertion). `inbox_id``string` The sandbox inbox of an anonymous registration. `email``string` Verified email bound at claim or carried by the identity assertion. `issuer``string` Issuer of the identity assertion (identity\_assertion). `agent_platform``string` agent\_platform claim of the identity assertion. `created_at``string (date-time)`Required When the agent registered. `claimed_at``string (date-time)` When a human claimed the registration. `revoked_at``string (date-time)` When the registration was revoked. `expires_at``string (date-time)` When an unclaimed registration expires. `claim_email``string` Only this user may claim the registration. `user_code_expires_at``string (date-time)` When the code expires. `sandbox_inbox``object` The sandbox inbox of an anonymous registration. ## [ClaimStartRequest](/content/docs/reference/api/objects\#claimstartrequest/index.html) Send `claim_token` (and optionally `email`), or `agent_id` with Bearer proof. FieldDescription `claim_token``string` Protocol form: the claim\_token from registration. `email``string` Binds the claim to this human. For service\_auth and identity\_assertion it must match the bound email. `agent_id``string` Alternative to claim\_token; needs the registration’s access token or identity assertion as Authorization: Bearer. `registration_id``string` Alias of agent\_id. ## [ClaimStartResponse](/content/docs/reference/api/objects\#claimstartresponse/index.html) The `claim_attempt` block and the flat `user_code`, `verification_uri`, `expires_in` and `interval` carry the same values. FieldDescription `registration_id``string`Required `agent_id``string`Required `claim_attempt_id``string`Required `status``"initiated"`Required `expires_at``string (date-time)`Required When this attempt expires. `claim_attempt` [ClaimBlock](/content/docs/reference/api/objects#claimblock/index.html) Required RFC 8628-shaped claim ceremony block. `user_code``string`Required 6-digit code the human enters in the dashboard. `verification_uri``string`Required https://machinemail.dev/claim?claim\_attempt\_token=cat\_...: the page to send the human to. `expires_in``integer`Required Seconds until user\_code expires. `interval``integer`Required Minimum seconds between /oauth2/token polls. ## [CliDeviceApproveRequest](/content/docs/reference/api/objects\#clideviceapproverequest/index.html) FieldDescription `user_code``string`Required The code the CLI printed (XXXX-XXXX); case, spaces and dashes are ignored. `organization_id``string` The organization the key is for, as the page showed it: it must be the one the session is signed in to (409 conflict otherwise, for example after another tab switched organizations). To create the key in another organization the person belongs to, switch the session to it first (POST /auth/organizations/switch). Default: the session’s organization. ## [CliDeviceAuthorization](/content/docs/reference/api/objects\#clideviceauthorization/index.html) A pending CLI sign-in, as the approval page shows it. Never includes the device code. FieldDescription `user_code``string`Required The code, formatted XXXX-XXXX. `device_id``string`Required Opaque ID of this sign-in (cld\_...), not a secret: the device\_id of the session.cli.device stream events that report it approved, denied or redeemed. `client_id``string`Required Always machinemail-cli. `client_name``string | null`Required What the CLI says it is. Self-reported. `hostname``string | null`Required The machine the CLI says it runs on. Self-reported. `key_name``string`Required Name of the key approval creates: CLI on . `permissions``string[]`Required Permissions of that key: \["\*"\] (every permission except inbound\_raw). `created_at``string (date-time)`Required When the CLI asked for the code. `expires_at``string (date-time)`Required When the code expires. ## [CliDeviceCodeRequest](/content/docs/reference/api/objects\#clidevicecoderequest/index.html) FieldDescription `client_id``string`Required Always machinemail-cli. `client_name``string` Shown to the human on the approval page, for example MachineMail CLI 0.4.0. At most 100 characters. (max length 100) `hostname``string` The machine the CLI runs on. Names the key (CLI on ) and is shown on the approval page. At most 253 characters. (max length 253) ## [CliDeviceCodeResponse](/content/docs/reference/api/objects\#clidevicecoderesponse/index.html) RFC 8628 device authorization response. FieldDescription `device_code``string`Required Secret the CLI polls the token endpoint with. Never show it. `user_code``string`Required Code the human checks on the approval page: 8 letters as XXXX-XXXX (consonants only, no look-alikes). `verification_uri``string`Required https://machinemail.dev/cli: where the human approves. `verification_uri_complete``string`Required verification\_uri with ?code=, for opening in a browser. `expires_in``integer`Required Seconds until both codes expire (600). `interval``integer`Required Minimum seconds between polls of the token endpoint (5). ## [CliDeviceDecision](/content/docs/reference/api/objects\#clidevicedecision/index.html) FieldDescription `status``"approved" | "denied"`Required `key_name``string`Required Name of the key the CLI receives (approved) or would have received (denied). ## [CliDeviceDecisionRequest](/content/docs/reference/api/objects\#clidevicedecisionrequest/index.html) FieldDescription `user_code``string`Required The code the CLI printed (XXXX-XXXX); case, spaces and dashes are ignored. ## [CliDeviceTokenRequest](/content/docs/reference/api/objects\#clidevicetokenrequest/index.html) FieldDescription `grant_type``string`Required urn:ietf:params:oauth:grant-type:device\_code. `device_code``string`Required The device\_code from the device authorization response. `client_id``string`Required Always machinemail-cli. ## [CliDeviceTokenResponse](/content/docs/reference/api/objects\#clidevicetokenresponse/index.html) An organization API key with every permission except `inbound_raw`, minted for the approving user. FieldDescription `access_token``string`Required The new API key (mm\_live\_...). Returned once; send it as Authorization: Bearer. `token_type``"Bearer"`Required `api_key_id``string`Required ID of the key, for DELETE /v0/api-keys/{api\_key\_id} on logout. `key_name``string`Required Name of the key: CLI on . `organization` [Organization](/content/docs/reference/api/objects#organization/index.html) Required The organization the key belongs to. `user` [User](/content/docs/reference/api/objects#user/index.html) Required The person who approved the sign-in. ## [ClientRegistrationRequest](/content/docs/reference/api/objects\#clientregistrationrequest/index.html) RFC 7591 client metadata. Unknown members are ignored. FieldDescription `redirect_uris``string[]`Required Where the authorization response may be sent: https URLs, http loopback URLs (http://127.0.0.1, http://\[::1\] or http://localhost; any port is accepted at authorization time, RFC 8252), or a private-use scheme of a native app (cursor://...). No fragments. At most 10. (min items 1, max items 10) `client_name``string` Shown on the consent page, marked as unverified. At most 200 characters. (max length 200) `client_uri``string` Home page of the client; shown on the consent page when it is https. (max length 2000) `logo_uri``string` Logo shown on the consent page when it is https. (max length 2000) `token_endpoint_auth_method``string` none (the default: a public client, PKCE only), client\_secret\_post or client\_secret\_basic (a confidential client: the response carries a client\_secret, and the token endpoint accepts it either way). Any other value is replaced with none in the response (RFC 7591 section 3.2.1). `grant_types``string[]` authorization\_code and refresh\_token (the default). Must include authorization\_code (invalid\_client\_metadata otherwise); other values are dropped from the registration. `response_types``string[]` code (the default). Other values: invalid\_client\_metadata. `scope``string` Space-separated Scope values the client may ask for. Default: every scope. (max length 2000) `application_type``"native" | "web"` native or web (OpenID Connect Dynamic Client Registration; required by MCP 2026-07-28). Default web. `software_id``string` Identifier of the client software. Stored, not verified. (max length 200) `software_version``string` Version of the client software. Stored, not verified. (max length 100) ## [ClientRegistrationResponse](/content/docs/reference/api/objects\#clientregistrationresponse/index.html) RFC 7591 client information response. A public client has no `client_secret`. FieldDescription `client_id``string`Required The new client identifier (oac\_...). `client_id_issued_at``integer`Required Seconds since the epoch. `client_name``string` `client_uri``string` `logo_uri``string` `redirect_uris``string[]`Required `grant_types``string[]`Required `response_types``string[]`Required `token_endpoint_auth_method``"none" | "client_secret_post" | "client_secret_basic"`Required As requested when supported, otherwise none. `client_secret``string` Confidential clients only (client\_secret\_post, client\_secret\_basic): shown once, stored only as a hash. Keep it secret. `client_secret_expires_at``integer` With client\_secret: 0, the secret does not expire. `application_type``"native" | "web"`Required `scope``string` `software_id``string` `software_version``string` ## [Complaint](/content/docs/reference/api/objects\#complaint/index.html) FieldDescription `inbox_id``string`Required ID of the inbox. `thread_id``string`Required ID of the thread. `message_id``string`Required ID of the message. `timestamp``string (date-time)`Required When it happened. `type``string`Required Complaint type, complaint when the provider gives none. `sub_type``string`Required Complaint sub-type, abuse when the provider gives none. `recipients` [Recipient\[\]](/content/docs/reference/api/objects#recipient/index.html) Required Complaining recipients, as {address, status} objects (AgentMail documents plain strings). They are added to the suppression list. ## [CreateApiKeyResponse](/content/docs/reference/api/objects\#createapikeyresponse/index.html) FieldDescription `api_key_id``string`Required ID of the API key. `prefix``string`Required First 12 characters of the key (mm\_live\_ and 4 more), safe to display. `name``string`Required Name of the key. `pod_id``string` Pod the key is scoped to: it can only access resources in this pod. `inbox_id``string` Inbox the key is scoped to: it can only access this inbox. `permissions` [ApiKeyPermissions](/content/docs/reference/api/objects#apikeypermissions/index.html) `created_at``string (date-time)`Required Time at which the key was created. `expires_at``string (date-time)` Time at which the key expires: requests with it then get 401. Absent when it does not expire. `api_key``string`Required The key itself (mm\_live\_ and 32 characters). Returned once; only a hash is stored. ## [CreateBearerApiKeyRequest](/content/docs/reference/api/objects\#createbearerapikeyrequest/index.html) The route sets the scope: `/v0/api-keys` makes an organization key, `/v0/pods/{pod_id}/api-keys` a pod key, `/v0/inboxes/{inbox_id}/api-keys` an inbox key. FieldDescription `name``string` Name of the key. Default API key. `permissions``object | null` Permissions of the new key. Omitted or null: full access for the key scope (inbound\_raw excepted). `expires_at``string (date-time) | null` When the key stops working, as an RFC 3339 timestamp at least 5 minutes from now (400 otherwise). A date alone or a time without a zone is read as UTC. Omit it or send null for no expiry (a key created with an expiring API key gets that key’s expiry instead). A key created with another API key cannot outlive it: a later time is a 403. An inherited expiry can be under 5 minutes away. It cannot be changed later; create a new key instead. ## [CreateDomainRequest](/content/docs/reference/api/objects\#createdomainrequest/index.html) FieldDescription `domain``string`Required The domain name, for example example.com. Cannot be the shared domain or a domain another organization registered. `feedback_enabled``boolean` Stored and returned; has no effect. Default false. `inbound_enabled``boolean` Receive email for this domain. Default true. false makes it send-only (the inbound MX record is not required). `client_id``string` Idempotency key: a create with a client\_id already used in the organization returns that domain with 200, or 409 when that domain is outside the pod of the API key or route. `pod_id``string` Pod to create the domain in. Defaults to the credential pod or the organization default pod. A pod-scoped credential can only name its own pod. `catch_all``boolean` Create an inbox for any address at the domain that receives mail. Default false. `catch_all_ttl_seconds``integer | null` Make inboxes created by catch-all ephemeral with this TTL. null or absent: permanent. ## [CreateDraftRequest](/content/docs/reference/api/objects\#createdraftrequest/index.html) FieldDescription `labels``string[]` Labels of the draft. `reply_to``string | string[]` Reply-to addresses: one address or a list. `to``string | string[]` Recipient addresses: one address or a list. `cc``string | string[]` CC addresses: one address or a list. `bcc``string | string[]` BCC addresses: one address or a list. `subject``string` Subject. `text``string` Plain text body. `html``string` HTML body. `attachments` [SendAttachment\[\]](/content/docs/reference/api/objects#sendattachment/index.html) Attachments, sent with the draft. Each needs content or url; a url is fetched when the draft is sent. `in_reply_to``string` ID of a message in this inbox to reply to: the sent message gets its In-Reply-To and References headers. `send_at``string (date-time) | null` Schedule the draft: it is sent automatically at this time (send\_status: scheduled). null or absent: not scheduled. `client_id``string` Idempotency key: a create with a client\_id already used in the organization returns that draft with 200, or 409 when that draft is outside the pod or inbox of the API key or route. ## [CreatedTrustedDomain](/content/docs/reference/api/objects\#createdtrusteddomain/index.html) The entry, with any warnings about mail that stays blocked. FieldDescription `trusted_domain_id``string`Required ID of the entry (td\_...). `entry_type``"domain" | "email"`Required domain: every address at the domain (and its subdomains with include\_subdomains). email: exactly one address. `domain``string`Required The domain, or for entry\_type: "email" the address, lowercased, with the domain in its ASCII (punycode) form. `domain_unicode``string`Required The same, with the domain in its Unicode form. Equal to domain for ASCII names. `include_subdomains``boolean`Required Also trust mail signed by subdomains (billing.example.com for example.com). Always false for addresses. `scope``"org" | "pod" | "inbox"`Required Where an entry applies: the whole organization, one pod, or one inbox. `pod_id``string | null`Required The pod, for pod- and inbox-scoped entries. `inbox_id``string | null`Required The inbox, for inbox-scoped entries. `reason``string | null`Required Why it was added, for people reading the list. Never included in a message’s trust report. `expires_at``string (date-time) | null`Required When the entry stops applying. null: never. `created_by``object | null`Required Who added the entry. `match_count``integer`Required Messages this entry has marked trusted. `last_matched_at``string (date-time) | null`Required When this entry last marked a message trusted. null: never. `created_at``string (date-time)`Required When the entry was added. `updated_at``string (date-time)`Required When the entry last changed. `warnings` [Warning\[\]](/content/docs/reference/api/objects#warning/index.html) Required Conflicts with block entries or allow-only scopes. Empty when there are none. ## [CreateInboxRequest](/content/docs/reference/api/objects\#createinboxrequest/index.html) FieldDescription `username``string` Local part of the address: a-z, 0-9 and . \_ + -, 1 to 64 characters. Randomly generated if omitted. On the shared domain, a username equal to another organization's slug is reserved for that organization (409). `domain``string` Domain of the address: a domain verified by this organization. Defaults to the shared domain. `display_name``string` Display name: Display Name . `client_id``string` Idempotency key: a create with a client\_id already used in the organization returns that inbox with 200, or 409 when that inbox is outside the pod of the API key or route. `status``"active" | "paused"` Whether the inbox sends and receives mail. paused stops both: sends return 403 (Inbox is paused), and incoming mail is not stored; a message.rejected event with reason inbox\_paused is emitted instead. Mail already in the inbox, its drafts and its API keys are kept. Set active to resume. `metadata``Record` Custom key-value pairs attached to the inbox. `pod_id``string` Pod to create the inbox in. Defaults to the credential pod or the organization default pod. `ephemeral``boolean` true without ttl\_seconds creates an ephemeral inbox with a one hour TTL (3600 seconds). `ttl_seconds``integer | null` Creates an ephemeral inbox that expires ttl\_seconds after creation, extended by each inbound message. `import_source``"agentmail"` Marks an inbox copied from another provider by an importer (machinemail import agentmail sets agentmail). The only effect: its inbox.created event is not delivered to webhooks or MCP subscribers, so they are not notified about an inbox that already existed elsewhere. The event is still recorded (GET /v0/events, the event stream), marked as an import in its payload, so the event log shows every import. Everything else about the create is unchanged. ## [CreateInvitationRequest](/content/docs/reference/api/objects\#createinvitationrequest/index.html) FieldDescription `email``string`Required Address to invite. `role``"owner" | "admin" | "member"` Role on joining. Default member. Only owners can invite owners. ## [CreateListEntryRequest](/content/docs/reference/api/objects\#createlistentryrequest/index.html) FieldDescription `entry``string`Required Email address or domain to add. (min length 1) `reason``string` Reason for adding the entry. ## [CreatePodRequest](/content/docs/reference/api/objects\#createpodrequest/index.html) FieldDescription `name``string` Name of the pod. Default Untitled pod. `client_id``string` Idempotency key: a create with a client\_id already used in the organization returns that pod with 200. ## [CreateSessionOrganizationRequest](/content/docs/reference/api/objects\#createsessionorganizationrequest/index.html) FieldDescription `name``string`Required Name of the new organization. ## [CreateSuppressionRequest](/content/docs/reference/api/objects\#createsuppressionrequest/index.html) FieldDescription `email``string`Required Address to suppress. `detail``string` Note stored as detail. `reason``string`Deprecated Old name of detail (it is stored as detail; the suppression reason is always manual). Ignored when detail is set. ## [CreateTrustedDomainRequest](/content/docs/reference/api/objects\#createtrusteddomainrequest/index.html) FieldDescription `domain``string`Required A domain (example.com) or an exact address (invoices@example.com). Unicode names are accepted and stored in ASCII (punycode) form. (min length 1, max length 320) `include_subdomains``boolean` Also trust mail signed by subdomains. Default false. Not allowed for an address. `reason``string` Why you trust it, for people reading the list. Never included in a message’s trust report. (max length 500) `expires_at``string (date-time)` When the entry stops applying. Must be in the future. Omit for never. `confirm``boolean` Required (true) for platforms where anyone can write the content (github.com, google.com, slack.com and similar, or one under the domain with include\_subdomains) and for one address on a group or marketplace relay (team@googlegroups.com): without it the answer is 422 confirmation\_required. `client_id``string` Idempotency key: a create with a client\_id already used in the organization returns that entry (200). ## [CreateWebhookRequest](/content/docs/reference/api/objects\#createwebhookrequest/index.html) FieldDescription `url``string`Required Endpoint URL: a public http(s) URL (private and loopback addresses are rejected, and re-checked before every delivery). `event_types``("message.received" | "message.received.spam" | "message.received.quarantined" | "message.received.unauthenticated" | "message.received.blocked" | "message.sent" | "message.delivered" | "message.bounced" | "message.complained" | "message.rejected" | "domain.verified" | "domain.updated" | "inbox.created" | "inbox.expired" | "draft.sent" | "webhook.test" | "trusted_domain.created" | "trusted_domain.updated" | "trusted_domain.deleted")[]` Event types the webhook receives. Omit it or send an empty array to receive every event type except domain.updated and trusted\_domain.\*, which are sent only when listed. `client_id``string` Idempotency key: a create with a client\_id already used in the organization returns that webhook with 200, or 409 when that webhook is outside the pod or inbox of the API key or route. `inbox_ids``string[]` Only deliver events of these inboxes. `pod_ids``string[]` Only deliver events of these pods. `headers``Record` Custom HTTP headers sent with every delivery to this webhook (every attempt, retry, replay and test event), alongside the X-MachineMail-\* headers, for example {"Authorization": "Bearer "} for an endpoint that requires one. Values are write-only: they are stored encrypted and no response returns them; reads list the names (header\_names). The headers are not part of the signed payload: X-MachineMail-Signature covers the body only. At most 10 headers. Names are HTTP tokens of up to 64 characters, compared without regard to case; values are printable ASCII (no line breaks or control characters) of up to 4096 characters, with surrounding spaces removed, and names plus values total at most 8192 bytes. Reserved names are refused with 400: Host, Content-Length, Content-Type, Content-Encoding, Transfer-Encoding, Connection, Upgrade, TE, Trailer, Keep-Alive, Expect, User-Agent, Accept-Encoding, and every name starting with Proxy-, Sec-, X-MachineMail-, Svix- or Webhook-. Authorization and Cookie are allowed. ## [DeleteOrganizationRequest](/content/docs/reference/api/objects\#deleteorganizationrequest/index.html) FieldDescription `code``string`Required The 6-digit code from the email. ## [DeleteOrganizationResponse](/content/docs/reference/api/objects\#deleteorganizationresponse/index.html) The organization is deleted. FieldDescription `ok``true`Required `organization_id``string`Required ID of the deleted organization. ## [Delivery](/content/docs/reference/api/objects\#delivery/index.html) FieldDescription `inbox_id``string`Required ID of the inbox. `thread_id``string`Required ID of the thread. `message_id``string`Required ID of the message. `timestamp``string (date-time)`Required When it happened. `recipients``string[]`Required Delivered recipients. ## [Domain](/content/docs/reference/api/objects\#domain/index.html) FieldDescription `pod_id``string`Required ID of the pod the domain belongs to. `domain_id``string`Required ID of the domain. `domain``string`Required The domain name (for example example.com), lowercased. `feedback_enabled``boolean`Required Stored as given. MachineMail does not send bounce and complaint notifications to inboxes; use the message.bounced and message.complained events. `inbound_enabled``boolean`Required Receive email for this domain. false makes it send-only: the inbound MX record is not required. `subdomains_enabled``boolean`Required Always false: inboxes on subdomains are not supported. `tracking_enabled``boolean`Required Always false: open tracking is not supported. `client_id``string` Client ID given at creation (idempotency key). `updated_at``string (date-time)`Required Time at which the domain was last updated. `created_at``string (date-time)`Required Time at which the domain was created. `status``"NOT_STARTED" | "PENDING" | "INVALID" | "FAILED" | "VERIFYING" | "VERIFIED"`Required NOT\_STARTED until the first verify, then VERIFIED when every required record is valid, INVALID when a required record has the wrong value, otherwise PENDING. For domains whose email provider reports its own verdict (Amazon SES): VERIFYING while every required record checks out but the provider has not confirmed them yet, and FAILED when the provider gave up (reason says why). `reason``string` Why the domain is not verified yet: what to do next, or which records are missing or invalid. Absent once VERIFIED. `records` [VerificationRecord\[\]](/content/docs/reference/api/objects#verificationrecord/index.html) Required DNS records to publish. `organization_id``string`Required ID of the organization. `catch_all``boolean`Required Mail to any address at the domain without an inbox creates one (created\_by: catch\_all). `catch_all_ttl_seconds``integer` TTL of inboxes created by catch-all; absent means they are permanent. `nameservers``string[]` Authoritative nameservers, detected on create and verify. `dns_provider``"cloudflare" | "route53" | "google" | "vercel" | "namecheap" | "godaddy" | "digitalocean" | "hetzner" | "porkbun" | "other"` DNS host the nameservers belong to. `dns_provider_url``string` Link to the DNS host console. `domain_connect``object` One-click DNS setup (Domain Connect), from the last discovery. See Get Domain Connect Setup. `verified_at``string (date-time)` When the domain became VERIFIED. `last_checked_at``string (date-time)` When the DNS records were last checked. ## [DomainConnect](/content/docs/reference/api/objects\#domainconnect/index.html) FieldDescription `supported``boolean`Required The zone DNS provider supports Domain Connect and has the MachineMail template. `provider_name``string` Display name of the DNS provider. `apply_url``string` Signed link that opens the provider with the outstanding records prefilled. Absent when nothing is left to add. `provider_id``string` Domain Connect provider ID. `url_sync_ux``string` Base URL of the provider synchronous flow. `width``integer` Suggested popup width, in pixels. `height``integer` Suggested popup height, in pixels. `reason``"no_domain_connect" | "provider_error" | "no_sync_flow" | "template_not_supported" | "records_not_templatable" | "already_configured" | "not_configured"` Why one-click setup is not available, or already\_configured when nothing is left to add. `checked_at``string (date-time)`Required When discovery last ran. ## [DomainItem](/content/docs/reference/api/objects\#domainitem/index.html) FieldDescription `pod_id``string`Required ID of the pod the domain belongs to. `domain_id``string`Required ID of the domain. `domain``string`Required The domain name (for example example.com), lowercased. `feedback_enabled``boolean`Required Stored as given. MachineMail does not send bounce and complaint notifications to inboxes; use the message.bounced and message.complained events. `inbound_enabled``boolean`Required Receive email for this domain. false makes it send-only: the inbound MX record is not required. `subdomains_enabled``boolean`Required Always false: inboxes on subdomains are not supported. `tracking_enabled``boolean`Required Always false: open tracking is not supported. `client_id``string` Client ID given at creation (idempotency key). `updated_at``string (date-time)`Required Time at which the domain was last updated. `created_at``string (date-time)`Required Time at which the domain was created. `status``"NOT_STARTED" | "PENDING" | "INVALID" | "FAILED" | "VERIFYING" | "VERIFIED"`Required Verification status, as on Domain. `reason``string` Why the domain is not verified yet, as on Domain. `records` [VerificationRecord\[\]](/content/docs/reference/api/objects#verificationrecord/index.html) Required DNS records to publish, as on Domain. `organization_id``string`Required ID of the organization. `catch_all``boolean`Required Mail to any address at the domain without an inbox creates one (created\_by: catch\_all). `catch_all_ttl_seconds``integer` TTL of inboxes created by catch-all; absent means they are permanent. `nameservers``string[]` Authoritative nameservers, detected on create and verify. `dns_provider``"cloudflare" | "route53" | "google" | "vercel" | "namecheap" | "godaddy" | "digitalocean" | "hetzner" | "porkbun" | "other"` DNS host the nameservers belong to. `dns_provider_url``string` Link to the DNS host console. `domain_connect``object` One-click DNS setup (Domain Connect), from the last discovery. See Get Domain Connect Setup. `verified_at``string (date-time)` When the domain became VERIFIED. `last_checked_at``string (date-time)` When the DNS records were last checked. ## [Draft](/content/docs/reference/api/objects\#draft/index.html) FieldDescription `inbox_id``string`Required ID of the inbox. `draft_id``string`Required ID of the draft. `labels``string[]`Required Labels of the draft. The sent message gets them. `to``string[]` Recipient addresses. `cc``string[]` CC addresses. `bcc``string[]` BCC addresses. `subject``string` Subject of the draft. `preview``string` Text preview of the draft. `attachments` [Attachment\[\]](/content/docs/reference/api/objects#attachment/index.html) Attachments of the draft. size is 0 for attachments given by url until the draft is sent (the URL is fetched then). `in_reply_to``string` ID of the message being replied to. `send_status``"scheduled" | "sending" | "failed"` scheduled while waiting for send\_at, sending while a sender holds it, failed when a scheduled send failed (it is not retried). Absent on drafts without send\_at. `send_at``string (date-time)` Time at which the draft is sent automatically. `updated_at``string (date-time)`Required Time at which the draft was last updated. `client_id``string` Client ID given at creation (idempotency key). `reply_to``string[]` Reply-to addresses. `text``string` Plain text body. `html``string` HTML body. `references``string[]` Message IDs the draft references (set from in\_reply\_to). `created_at``string (date-time)`Required Time at which the draft was created. `pod_id``string`Required ID of the pod. ## [DraftItem](/content/docs/reference/api/objects\#draftitem/index.html) FieldDescription `inbox_id``string`Required ID of the inbox. `draft_id``string`Required ID of the draft. `labels``string[]`Required Labels of the draft. The sent message gets them. `to``string[]` Recipient addresses. `cc``string[]` CC addresses. `bcc``string[]` BCC addresses. `subject``string` Subject of the draft. `preview``string` Text preview of the draft. `attachments` [Attachment\[\]](/content/docs/reference/api/objects#attachment/index.html) Attachments of the draft. size is 0 for attachments given by url until the draft is sent (the URL is fetched then). `in_reply_to``string` ID of the message being replied to. `send_status``"scheduled" | "sending" | "failed"` `send_at``string (date-time)` Time at which the draft is sent automatically. `updated_at``string (date-time)`Required Time at which the draft was last updated. `client_id``string` Client ID given at creation. `reply_to``string[]` Reply-to addresses. `text``string` Plain text body. `html``string` HTML body. `references``string[]` Message IDs the draft references. `created_at``string (date-time)`Required Time at which the draft was created. `pod_id``string`Required ID of the pod. ## [EmailCodesRequest](/content/docs/reference/api/objects\#emailcodesrequest/index.html) FieldDescription `enabled``boolean`Required false turns email sign-in codes off; true back on. ## [EmailCodesResponse](/content/docs/reference/api/objects\#emailcodesresponse/index.html) FieldDescription `email_codes``boolean`Required Email sign-in codes work for this account now. ## [EmailCodeStartRequest](/content/docs/reference/api/objects\#emailcodestartrequest/index.html) FieldDescription `email``string` Address to send the code to. Optional with invitation\_token (the code goes to the invited address). `next``string` Same-origin path to land on after sign-in, for example /cli?code=ABCD-EFGH. Anything else is ignored. Default /app. `invitation_token``string` An invitation token (from /invite/{token}): signing in accepts the invitation. ## [EmailCodeStartResponse](/content/docs/reference/api/objects\#emailcodestartresponse/index.html) FieldDescription `ok``true`Required `redirect_to``string` Set when the address’s domain signs in with SSO: send the browser here (the organization’s identity provider). Otherwise a code was emailed: show the code screen. ## [EmailCodeVerifyRequest](/content/docs/reference/api/objects\#emailcodeverifyrequest/index.html) FieldDescription `code``string`Required The 6-digit code from the email. Spaces and dashes are ignored. ## [Event](/content/docs/reference/api/objects\#event/index.html) An event in the replayable log. Webhooks, the SSE stream and the WebSocket deliver the event envelope instead (`type: "event"` with the `data` keys also at the top level). FieldDescription `event_id``string`Required ID of the event (evt\_...). Sorts by creation time. `event_type``"message.received" | "message.received.spam" | "message.received.quarantined" | "message.received.unauthenticated" | "message.received.blocked" | "message.sent" | "message.delivered" | "message.bounced" | "message.complained" | "message.rejected" | "domain.verified" | "domain.updated" | "inbox.created" | "inbox.expired" | "draft.sent" | "webhook.test" | "trusted_domain.created" | "trusted_domain.updated" | "trusted_domain.deleted" | "registration.created" | "token.issued" | "agent.claimed" | "agent.revoked" | "member.invited" | "member.role_changed" | "member.removed"`Required Type of event: an events\_EventType, or an audit event for agent registrations and members (registration.created, token.issued, agent.claimed, agent.revoked, member.invited, member.role\_changed, member.removed), which is logged but never delivered to webhooks or streams. `organization_id``string`Required ID of the organization. `pod_id``string` ID of the pod. Absent for organization-level events. `inbox_id``string` ID of the inbox. Absent for events without an inbox (for example domain.verified). `data``Record`Required Event payload, as delivered to webhooks: message.\* events carry message and thread, delivery events their send, delivery, bounce, complaint or reject object, inbox.\* the inbox, domain.verified and domain.updated the domain, trusted\_domain.\* the trusted\_domain. `timestamp``string (date-time)`Required When the event happened (same as created\_at). `created_at``string (date-time)`Required When the event was stored. ## [FirstKeyResponse](/content/docs/reference/api/objects\#firstkeyresponse/index.html) FieldDescription `api_key` [OneTimeApiKey](/content/docs/reference/api/objects#onetimeapikey/index.html) Required An API key with its plaintext secret, returned once. ## [HealthResponse](/content/docs/reference/api/objects\#healthresponse/index.html) FieldDescription `status``"ok"`Required ## [Identity](/content/docs/reference/api/objects\#identity/index.html) Identity and scope of the credential. FieldDescription `scope_type``"organization" | "pod" | "inbox"`Required The scope tier the credential is bound to. `scope_id``string`Required ID of the most specific scope: inbox\_id for an inbox credential, pod\_id for a pod credential, otherwise organization\_id. `organization_id``string`Required ID of the organization. `pod_id``string` ID of the pod the credential is scoped to. Present when scope\_type is pod, and for inbox credentials created under a pod. `inbox_id``string` ID of the inbox the credential is scoped to. Present when scope\_type is inbox. `api_key_id``string` ID of the API key used. Absent for dashboard sessions and agent access tokens. `api_key_expires_at``string (date-time)` When the API key used expires. Absent when it does not expire, and for other credentials. `user``object` The signed-in user, for a dashboard session. ## [InboundRawResponse](/content/docs/reference/api/objects\#inboundrawresponse/index.html) FieldDescription `count``integer`Required Number of messages stored (one per recipient inbox that accepted it). `messages` [Message\[\]](/content/docs/reference/api/objects#message/index.html) Required The stored messages, marked received\_via: "raw". `errors``object[]` Recipients that could not be delivered to, when there were several and at least one succeeded. `held``object[]` Recipients whose copy was held (not delivered yet) because the organization reached a Free plan limit: monthly, daily or storage, or queued behind mail already held. Held mail is delivered when the allowance resets or after an upgrade. ## [Inbox](/content/docs/reference/api/objects\#inbox/index.html) FieldDescription `pod_id``string`Required ID of the pod the inbox belongs to. `inbox_id``string`Required ID of the inbox: its email address, as in AgentMail (inbox\_id == email). `email``string`Required Email address of the inbox. `display_name``string` Display name: Display Name . `client_id``string` Client ID given at creation (idempotency key). `status``"active" | "paused"`Required `metadata``Record` Custom key-value pairs attached to the inbox. `updated_at``string (date-time)`Required Time at which the inbox was last updated. `created_at``string (date-time)`Required Time at which the inbox was created. `organization_id``string`Required ID of the organization. `ephemeral``boolean`Required Whether the inbox expires (see ttl\_seconds). `ttl_seconds``integer` TTL of an ephemeral inbox. Each inbound message pushes expires\_at to now + ttl\_seconds. `expires_at``string (date-time)` When an ephemeral inbox and its mail are deleted. `created_by``"api" | "catch_all" | "dashboard" | "agent"`Required What created the inbox: the API, a catch-all domain, the dashboard or an agent registration. ## [InboxAvailability](/content/docs/reference/api/objects\#inboxavailability/index.html) FieldDescription `available``boolean`Required `email``string`Required The address that was checked (lowercased). `reason``"invalid_username" | "domain_not_found" | "taken"` Why the address is not available. `message``string` Human-readable reason. ## [Invitation](/content/docs/reference/api/objects\#invitation/index.html) An invitation to join the organization. FieldDescription `invitation_id``string`Required ID of the invitation. `organization_id``string`Required ID of the organization the invitee joins. `email``string`Required Address the invitation was sent to. Only this address can accept it. `role``"owner" | "admin" | "member"`Required Role in the organization. Owners and admins invite, change roles and remove members; only owners grant or remove the owner role, and an organization always keeps one owner. `state``"pending" | "accepted" | "expired" | "revoked"`Required State of the invitation. `invited_by_user_id``string` ID of the member who sent it, when known. `expires_at``string (date-time)`Required When the invitation stops working (7 days after it was sent). `created_at``string (date-time)`Required When the invitation was sent. ## [InvitationPreviewResponse](/content/docs/reference/api/objects\#invitationpreviewresponse/index.html) What an invitation link is for, before signing in. FieldDescription `organization_name``string`Required The organization the invitation is to. `email``string`Required The invited address, masked (a••@example.com). `state``"pending" | "accepted" | "expired" | "revoked"`Required Only a pending invitation can be accepted. `expires_at``string (date-time)`Required When the invitation expires. ## [JsonRpcError](/content/docs/reference/api/objects\#jsonrpcerror/index.html) JSON-RPC 2.0 error response. FieldDescription `jsonrpc``"2.0"`Required `error``object`Required `id``string | number | null`Required ## [JsonWebKeySet](/content/docs/reference/api/objects\#jsonwebkeyset/index.html) RFC 7517 JWK Set. FieldDescription `keys``Record[]`Required ## [ListAgentRegistrationsResponse](/content/docs/reference/api/objects\#listagentregistrationsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `agent_registrations` [AgentRegistration\[\]](/content/docs/reference/api/objects#agentregistration/index.html) Required Newest first unless ascending is set. ## [ListApiKeysResponse](/content/docs/reference/api/objects\#listapikeysresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer`Required Page size used. `next_page_token``string` Page token for pagination. Absent on the last page. `api_keys` [BearerApiKey\[\]](/content/docs/reference/api/objects#bearerapikey/index.html) Required Keys in the route scope that are not revoked, ordered by created\_at, newest first unless ascending is set. ## [ListDeliveriesResponse](/content/docs/reference/api/objects\#listdeliveriesresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `deliveries` [WebhookDelivery\[\]](/content/docs/reference/api/objects#webhookdelivery/index.html) Required Ordered by created\_at, newest first unless ascending is set. ## [ListDomainsResponse](/content/docs/reference/api/objects\#listdomainsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `domains` [DomainItem\[\]](/content/docs/reference/api/objects#domainitem/index.html) Required Ordered by created\_at, newest first unless ascending is set. ## [ListDraftsResponse](/content/docs/reference/api/objects\#listdraftsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `drafts` [DraftItem\[\]](/content/docs/reference/api/objects#draftitem/index.html) Required Ordered by created\_at, newest first unless ascending is set. ## [ListEntry](/content/docs/reference/api/objects\#listentry/index.html) An allow or block list entry. The route sets the list: `/v0/lists` is the organization list, `/v0/pods/{pod_id}/lists` the pod list, `/v0/inboxes/{inbox_id}/lists` the inbox list. FieldDescription `entry``string`Required Email address or domain (lowercased). `organization_id``string`Required ID of the organization. `pod_id``string` ID of the pod, for pod-scoped entries. `inbox_id``string` ID of the inbox, for inbox-scoped entries. `reason``string` Reason given when the entry was added. `direction``"send" | "receive" | "reply"`Required receive: who may send to you (inbound mail from a blocked sender is labeled BLOCKED). send: who you may send to (a blocked recipient is a 403). reply entries are stored and listed but not applied to any mail yet. `list_type``"allow" | "block"`Required block refuses matching addresses. allow makes the list exclusive: once it has an entry, only matching addresses pass. `entry_type``"email" | "domain"`Required Whether the entry is an email address or a domain. `read_only``boolean`Required Always false: every entry can be deleted through the API. `created_at``string (date-time)`Required Time at which the entry was created. ## [ListEventsResponse](/content/docs/reference/api/objects\#listeventsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `events` [Event\[\]](/content/docs/reference/api/objects#event/index.html) Required Newest first; oldest first when after is set or ascending is true. ## [ListInboxesResponse](/content/docs/reference/api/objects\#listinboxesresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `inboxes` [Inbox\[\]](/content/docs/reference/api/objects#inbox/index.html) Required Ordered by created\_at, newest first unless ascending is set. ## [ListInvitationsResponse](/content/docs/reference/api/objects\#listinvitationsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `invitations` [Invitation\[\]](/content/docs/reference/api/objects#invitation/index.html) Required Pending invitations, newest first. ## [ListListEntriesResponse](/content/docs/reference/api/objects\#listlistentriesresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `entries` [ListEntry\[\]](/content/docs/reference/api/objects#listentry/index.html) Required Ordered by entry, ascending unless ascending is false. ## [ListMembersResponse](/content/docs/reference/api/objects\#listmembersresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `members` [Member\[\]](/content/docs/reference/api/objects#member/index.html) Required Oldest first unless ascending=false. ## [ListMessagesResponse](/content/docs/reference/api/objects\#listmessagesresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `messages` [MessageItem\[\]](/content/docs/reference/api/objects#messageitem/index.html) Required Ordered by timestamp, newest first unless ascending is set. ## [ListOAuthGrantsResponse](/content/docs/reference/api/objects\#listoauthgrantsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `oauth_grants` [OAuthGrant\[\]](/content/docs/reference/api/objects#oauthgrant/index.html) Required Newest first unless ascending is set. ## [ListPasskeysResponse](/content/docs/reference/api/objects\#listpasskeysresponse/index.html) FieldDescription `passkeys` [Passkey\[\]](/content/docs/reference/api/objects#passkey/index.html) Required The person’s passkeys, oldest first. `email_codes``boolean`Required Email sign-in codes work for this account. false once turned off (with at least one passkey). `step_up``object`Required Confirmation before sensitive changes. `prompt``boolean`Required Offer to create a passkey (no passkey yet, and the offer was not snoozed or declined). ## [ListPodsResponse](/content/docs/reference/api/objects\#listpodsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `pods` [Pod\[\]](/content/docs/reference/api/objects#pod/index.html) Required Ordered by created\_at, newest first unless ascending is set. A pod credential sees only its pod. ## [ListSessionOrganizationsResponse](/content/docs/reference/api/objects\#listsessionorganizationsresponse/index.html) FieldDescription `organizations` [MembershipOrganization\[\]](/content/docs/reference/api/objects#membershiporganization/index.html) Required Every organization the person belongs to, by name. ## [ListSuppressionsResponse](/content/docs/reference/api/objects\#listsuppressionsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `suppressions` [Suppression\[\]](/content/docs/reference/api/objects#suppression/index.html) Required Newest first unless ascending is set. ## [ListThreadsResponse](/content/docs/reference/api/objects\#listthreadsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `threads` [ThreadItem\[\]](/content/docs/reference/api/objects#threaditem/index.html) Required Ordered by timestamp, newest first unless ascending is set. `truncated``true` Present when q matched more than 500 messages: only the threads of the newest 500 matching messages were considered. ## [ListTrustedDomainsResponse](/content/docs/reference/api/objects\#listtrusteddomainsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `trusted_domains` [TrustedDomain\[\]](/content/docs/reference/api/objects#trusteddomain/index.html) Required Entries stored at exactly this level (organization, pod or inbox), newest first unless ascending is set. ## [ListWebhooksResponse](/content/docs/reference/api/objects\#listwebhooksresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `webhooks` [Webhook\[\]](/content/docs/reference/api/objects#webhook/index.html) Required Ordered by created\_at, newest first unless ascending is set. ## [LoginRequest](/content/docs/reference/api/objects\#loginrequest/index.html) FieldDescription `email``string`Required `password``string`Required ## [MagicLinkRequest](/content/docs/reference/api/objects\#magiclinkrequest/index.html) FieldDescription `email``string`Required Address to send the sign-in link to. `org_name``string` Organization name, used only when this is the address’s first sign-in. `next``string` Same-origin path to land on after sign-in, for example /claim?user\_code=123456. Anything else is ignored. Default /app. `organization_name``string` Alias of org\_name. `organizationName``string`Deprecated Alias of org\_name. ## [MagicLinkResponse](/content/docs/reference/api/objects\#magiclinkresponse/index.html) FieldDescription `ok``true`Required ## [McpDescription](/content/docs/reference/api/objects\#mcpdescription/index.html) How to connect to the remote MCP server. FieldDescription `name``string`Required `description``string`Required What the server is for, in one line. `icons``object[]`Required The MachineMail mark, for clients and registries that show an icon. `version``string`Required `transport``"streamable-http"`Required `url``string`Required The canonical MCP endpoint, https://mcp.machinemail.dev/mcp. https://machinemail.dev/mcp also works (legacy alias). `authentication``object`Required `docs``string`Required ## [Member](/content/docs/reference/api/objects\#member/index.html) A person in the organization, with their role there and how they sign in. FieldDescription `user_id``string`Required ID of the user. `email``string`Required Email address the user signs in with. `name``string | null` Display name, when set. `organization_id``string`Required ID of the organization this record is about: the session’s active organization, or the organization listed. `role``"owner" | "admin" | "member"`Required `created_at``string (date-time)`Required When the user was created. `sign_in_methods``("email" | "password" | "google" | "github" | "apple" | "microsoft" | "sso" | "passkey")[]`Required Every method the member has used to sign in to this organization, in the order first used. Empty until their first sign-in after this was recorded. `last_sign_in_method``("email" | "password" | "google" | "github" | "apple" | "microsoft" | "sso" | "passkey" | null) | null`Required How the member last signed in to this organization. null until their first sign-in after this was recorded. ## [MembershipOrganization](/content/docs/reference/api/objects\#membershiporganization/index.html) An organization the signed-in person belongs to. FieldDescription `organization_id``string`Required ID of the organization. `name``string`Required Name of the organization. `slug``string`Required URL-safe name of the organization. Fixed when the organization is created; it never changes. `role``"owner" | "admin" | "member"`Required `current``boolean`Required The session is signed in to this organization. ## [Message](/content/docs/reference/api/objects\#message/index.html) FieldDescription `inbox_id``string`Required ID of the inbox. `thread_id``string`Required ID of the thread. `message_id``string`Required ID of the message. `labels``string[]`Required Labels of the message. `timestamp``string (date-time)`Required Time at which the message was sent or received. `from``string`Required Address of the sender. In format username@domain.com or Display Name . `to``string[]`Required Addresses of the recipients. In format username@domain.com or Display Name . `cc``string[]` Addresses of the CC recipients. In format username@domain.com or Display Name . `bcc``string[]` Addresses of the BCC recipients. In format username@domain.com or Display Name . `subject``string` Subject of the message. `preview``string` Text preview of the message. `attachments` [Attachment\[\]](/content/docs/reference/api/objects#attachment/index.html) Attachments of the message. `in_reply_to``string` ID of the message being replied to. `references``string[]` IDs of previous messages in the thread. `headers``Record` Headers of the message. `authentication_results` [MessageAuthenticationResults](/content/docs/reference/api/objects#messageauthenticationresults/index.html) SPF, DKIM and DMARC verdicts for a received message, each with the domain it is about, as recorded when the message reached MachineMail: by the receiving mail provider (for example Amazon SES), or by the Authentication-Results header of the server that delivered it to MachineMail. A mechanism that was not evaluated is absent. The whole field is absent on sent messages, on messages injected through POST /inbound/raw (their headers are not believed), when nothing was evaluated, and on messages received before the field was introduced. As in AgentMail, only verdicts that speak for the sender are kept. spf is present only when spf\_domain is aligned with the sender (shares an organizational domain with the From domain, or with the Sender domain when From spans several domains): an unaligned SPF result is withheld whatever its value. dkim and dmarc are withheld when From spans more than one domain or could not be parsed. Unlike the trust report (trust.authentication), which collapses each result to the values MachineMail scores on and adds aligned, these are the uncollapsed results: permerror and temperror stay as they are. dkim\_domain is the signing domain as written: compare it with the From domain before treating a DKIM pass as proof of the sender, and use trust.level (or the UNAUTHENTICATED label) to decide whether to act on the message. Do not reject mail on dmarc: fail alone: forwarding breaks it. `size``integer`Required Size of the message in bytes. `updated_at``string (date-time)`Required Time at which the message was last updated. `created_at``string (date-time)`Required Time at which the message was created. `pod_id``string`Required ID of the pod. `direction``"inbound" | "outbound"`Required Whether the message was received or sent. `delivery_status``"sent" | "delivered" | "bounced" | "complained"` Outbound only: last delivery state reported by the transport. `trust_level``"verified" | "known" | "unknown" | "suspicious" | "quarantined"` Inbound only: trust.level, for list badges. `reply_to``string[]` Reply-to addresses. In format username@domain.com or Display Name . `text``string` Plain text body. Untrusted: agents should read trust.content.text or extracted\_text. `html``string` HTML body. Untrusted. `extracted_text``string` New text content, without quoted replies. `extracted_html``string` New HTML content, without quoted replies. `received_via``"raw"` raw when the message was injected with POST /inbound/raw (authentication not verified). `held_at``string (date-time)` When the message arrived, for inbound mail that was held because the organization reached a Free plan limit. created\_at is then when it was delivered (released). `trust` [TrustReport](/content/docs/reference/api/objects#trustreport/index.html) Trust report of an inbound message. ## [MessageAuthenticationResults](/content/docs/reference/api/objects\#messageauthenticationresults/index.html) SPF, DKIM and DMARC verdicts for a received message, each with the domain it is about, as recorded when the message reached MachineMail: by the receiving mail provider (for example Amazon SES), or by the `Authentication-Results` header of the server that delivered it to MachineMail. A mechanism that was not evaluated is absent. The whole field is absent on sent messages, on messages injected through `POST /inbound/raw` (their headers are not believed), when nothing was evaluated, and on messages received before the field was introduced. As in AgentMail, only verdicts that speak for the sender are kept. `spf` is present only when `spf_domain` is aligned with the sender (shares an organizational domain with the From domain, or with the Sender domain when From spans several domains): an unaligned SPF result is withheld whatever its value. `dkim` and `dmarc` are withheld when From spans more than one domain or could not be parsed. Unlike the trust report (`trust.authentication`), which collapses each result to the values MachineMail scores on and adds `aligned`, these are the uncollapsed results: `permerror` and `temperror` stay as they are. `dkim_domain` is the signing domain as written: compare it with the From domain before treating a DKIM `pass` as proof of the sender, and use `trust.level` (or the UNAUTHENTICATED label) to decide whether to act on the message. Do not reject mail on `dmarc: fail` alone: forwarding breaks it. FieldDescription `spf``"pass" | "fail" | "none" | "neutral" | "softfail" | "temperror" | "permerror"` Result of one authentication mechanism, in the vocabulary of the Authentication-Results header (RFC 8601). none: there was nothing to evaluate (no SPF record for the envelope sender domain, no DKIM signature, or no DMARC record for the From domain). temperror: the check could not complete, for example a DNS timeout. `dkim``"pass" | "fail" | "none" | "neutral" | "softfail" | "temperror" | "permerror"` `dmarc``"pass" | "fail" | "none" | "neutral" | "softfail" | "temperror" | "permerror"` `spf_domain``string` Envelope sender (MAIL FROM) domain the spf verdict is about (smtp.mailfrom, or the HELO name when the envelope sender was empty). `dkim_domain``string` Signing domain (d=) of the signature the dkim verdict is about: for pass, a signature that passed, preferring one aligned with the From domain. Present only when dkim is pass or fail. It is the domain as signed: compare it with the From domain before relying on it. `dmarc_domain``string` From domain the dmarc verdict is about (header.from). `arc_sealer``string` Domain of the forwarder whose ARC seal the verdicts were read from (for example google.com): they then describe the message as that forwarder received it. Present only on forwarded mail, and only beside at least one verdict. MachineMail does not validate ARC chains, so it reads verdicts from ARC only when its trust layer is set to believe any results header; by default it believes only its own receiving server and does not send this key. ## [MessageItem](/content/docs/reference/api/objects\#messageitem/index.html) A message without its bodies, as in lists. FieldDescription `inbox_id``string`Required ID of the inbox. `thread_id``string`Required ID of the thread. `message_id``string`Required ID of the message. `labels``string[]`Required Labels of the message. `timestamp``string (date-time)`Required Time at which the message was sent or received. `from``string`Required Address of the sender. In format username@domain.com or Display Name . `to``string[]`Required Addresses of the recipients. In format username@domain.com or Display Name . `cc``string[]` Addresses of the CC recipients. In format username@domain.com or Display Name . `bcc``string[]` Addresses of the BCC recipients. In format username@domain.com or Display Name . `subject``string` Subject of the message. `preview``string` Text preview of the message. `attachments` [Attachment\[\]](/content/docs/reference/api/objects#attachment/index.html) Attachments of the message. `in_reply_to``string` ID of the message being replied to. `references``string[]` IDs of previous messages in the thread. `headers``Record` Headers of the message. `authentication_results` [MessageAuthenticationResults](/content/docs/reference/api/objects#messageauthenticationresults/index.html) `size``integer`Required Size of the message in bytes. `updated_at``string (date-time)`Required Time at which the message was last updated. `created_at``string (date-time)`Required Time at which the message was created. `pod_id``string`Required ID of the pod. `direction``"inbound" | "outbound"`Required Whether the message was received or sent. `delivery_status``"sent" | "delivered" | "bounced" | "complained"` Outbound only: last delivery state reported by the transport. `trust_level``"verified" | "known" | "unknown" | "suspicious" | "quarantined"` Inbound only: trust.level, for list badges. ## [MetricBucket](/content/docs/reference/api/objects\#metricbucket/index.html) FieldDescription `timestamp``string (date-time)`Required Start of the bucket. `count``integer`Required Number of events in the bucket. ## [OAuthApproveRequest](/content/docs/reference/api/objects\#oauthapproverequest/index.html) FieldDescription `request_id``string`Required `pod_id``string` Limit the grant to one pod of the organization. Default: the whole organization. `inbox_id``string` Limit the grant to one inbox (and its pod). `organization_id``string` The organization the grant is for, as the consent page showed it: it must be the one the session is signed in to (409 conflict otherwise, for example after another tab switched organizations). To connect the app to another organization the person belongs to, switch the session to it first (POST /auth/organizations/switch). Default: the session’s organization. ## [OAuthAuthorizationRequest](/content/docs/reference/api/objects\#oauthauthorizationrequest/index.html) A pending authorization request, as the consent page shows it. FieldDescription `request_id``string`Required `client` [OAuthClientInfo](/content/docs/reference/api/objects#oauthclientinfo/index.html) Required `redirect_uri``string`Required Where the response goes. `redirect_host``string`Required Host (or scheme, for an app link) of redirect\_uri, for the human to check. `redirect_loopback``boolean`Required The response goes to a program on this computer (http://127.0.0.1, localhost). `resource``string`Required What the token will be good for: the MCP server (https://mcp.machinemail.dev/mcp, or the legacy /mcp) or / (the REST API and MCP). `scopes` [ScopeDescription\[\]](/content/docs/reference/api/objects#scopedescription/index.html) Required What the client asked for. `created_at``string (date-time)`Required `expires_at``string (date-time)`Required When the request expires (10 minutes after it was made). ## [OAuthClientInfo](/content/docs/reference/api/objects\#oauthclientinfo/index.html) FieldDescription `client_id``string`Required `client_name``string | null`Required Self-reported by the client. `client_uri``string | null`Required Self-reported; https only. `logo_uri``string | null`Required Self-reported; https only. `registration``"dynamic" | "metadata_document"`Required dynamic: registered at /oauth2/register (name and logo unverified). metadata\_document: client\_id is the URL of its metadata document, so its host is verified. `host``string | null`Required metadata\_document: the host that serves the document (for example claude.ai). ## [OAuthDecision](/content/docs/reference/api/objects\#oauthdecision/index.html) FieldDescription `status``"approved" | "denied"`Required `redirect_to``string`Required Send the browser here: redirect\_uri with code (or error=access\_denied), state and iss. ## [OAuthDenyRequest](/content/docs/reference/api/objects\#oauthdenyrequest/index.html) FieldDescription `request_id``string`Required ## [OAuthError](/content/docs/reference/api/objects\#oautherror/index.html) OAuth / auth.md error body (RFC 6749 section 5.2, RFC 7591 section 3.2.2). The `/agent/*` and `/oauth2/*` endpoints use this shape instead of the API error envelope. FieldDescription `error``string`Required Error code: invalid\_request, invalid\_grant, invalid\_client, invalid\_target, invalid\_scope, invalid\_client\_metadata, invalid\_redirect\_uri, unsupported\_grant\_type, unsupported\_response\_type, access\_denied, authorization\_pending, slow\_down, expired\_token, interaction\_required, login\_required, invalid\_claim\_token, claimed\_or\_in\_flight, claim\_expired, rate\_limited, anonymous\_not\_enabled, service\_auth\_not\_enabled, identity\_assertion\_not\_enabled, invalid\_issuer, invalid\_signature, invalid\_audience, expired, replay\_detected, invalid\_client\_id, missing\_verified\_email. `error_description``string`Required `message``string`Required Same text as error\_description. `registration_id``string` interaction\_required only. `agent_id``string` interaction\_required only. `registration_type``"anonymous" | "service_auth" | "identity_assertion"` interaction\_required only. `claim_url``string` interaction\_required only. `claim_token``string` interaction\_required only. `claim_token_expires``string (date-time)` interaction\_required only. interaction\_required only. `claim``object` interaction\_required only. `max_age``integer` login\_required only: the maximum auth\_time age in seconds. ## [OAuthGrant](/content/docs/reference/api/objects\#oauthgrant/index.html) An app a person connected with OAuth. Revoking it ends its access and refresh tokens at once. FieldDescription `grant_id``string`Required ID of the grant (oag\_...). `client_id``string`Required `client_name``string | null`Required Self-reported by the client at registration. `client_uri``string | null`Required `logo_uri``string | null`Required `registration``"dynamic" | "metadata_document"`Required `user_id``string`Required Who approved it. `user_email``string | null`Required `scopes``("inboxes.read" | "inboxes.write" | "messages.read" | "messages.send" | "messages.write" | "webhooks.read" | "webhooks.write" | "domains.read" | "domains.write" | "lists.read" | "lists.write" | "metrics.read" | "pods.read" | "pods.write" | "api_keys.read" | "api_keys.write")[]`Required `resource``string`Required Audience of its access tokens. `pod_id``string | null`Required Set when the grant is limited to one pod. `inbox_id``string | null`Required Set when the grant is limited to one inbox. `created_at``string (date-time)`Required `last_used_at``string (date-time) | null`Required Last token refresh or API call (updated at most once a minute). `expires_at``string (date-time)`Required When the current refresh token expires unless it is used (30 days after the last refresh). ## [OkResponse](/content/docs/reference/api/objects\#okresponse/index.html) Acknowledgement. FieldDescription `ok``true`Required ## [OneTimeApiKey](/content/docs/reference/api/objects\#onetimeapikey/index.html) An API key with its plaintext secret, returned once. FieldDescription `api_key_id``string`Required ID of the API key. `api_key``string`Required Plaintext secret (mm\_live\_...). Shown once. `prefix``string`Required First characters of the key, shown in listings. `name``string`Required Name of the key. `created_at``string (date-time)`Required When the key was created. ## [Organization](/content/docs/reference/api/objects\#organization/index.html) The organization of the credential. `plan` and `GET /v0/organizations/usage` report plan allowances; inboxes are unlimited (no `inbox_limit`) and there are no billing fields. FieldDescription `organization_id``string`Required ID of the organization. `name``string`Required Name of the organization. `slug``string`Required URL-safe name of the organization, chosen from its name when it is created. It never changes, not even when the organization is renamed. {slug}@ on the shared domain is reserved for this organization: no other organization can create that inbox. `plan``"free" | "pro" | "team" | "scale"`Required Plan of the organization. `inbox_count``integer`Required Number of inboxes in the credential scope. `domain_count``integer`Required Number of domains in the organization. `domain_limit``integer` Custom domains included in the plan. The Free plan cannot add more; paid plans can, and each extra domain is billed. Always present on GET /v0/organizations and PATCH /v0/organizations. `usage``object` Usage. Always present on GET /v0/organizations and PATCH /v0/organizations. `shared_domain``string` Domain every organization can create inboxes on, used when an inbox is created without domain. Always present on GET /v0/organizations and PATCH /v0/organizations. `undo_send``boolean`Required Undo send in the dashboard: when true (the default), a message sent from the MachineMail dashboard waits 5 seconds before it goes out, so it can be undone. Only the dashboard reads it: the API, the MCP server and the CLI always send at once. `default_inbox_id``string | null`Required The default inbox of the organization (its inbox\_id). A new organization gets {slug}@ on the shared domain, named after the organization, as its default inbox; when that address cannot be used (a reserved name), it starts without one. The dashboard lists the default inbox first. Change it with PATCH /v0/organizations. null when there is none: it was cleared, its inbox was deleted, or (for a pod or inbox credential) it is outside the credential scope. `updated_at``string (date-time)`Required Time at which the organization was last updated. `created_at``string (date-time)`Required Time at which the organization was created. ## [OrganizationDeletionStarted](/content/docs/reference/api/objects\#organizationdeletionstarted/index.html) A confirmation code was emailed to you. FieldDescription `email``string`Required Where the code was sent: your own address, partly hidden. `expires_at``string (date-time)`Required When the code stops working (10 minutes after it was sent). ## [Passkey](/content/docs/reference/api/objects\#passkey/index.html) A passkey the signed-in person can sign in with. FieldDescription `passkey_id``string`Required ID of the passkey (pk\_…). `name``string`Required Name shown in Settings (named after its password manager or device when added; up to 64 characters). `created_at``string (date-time)`Required When the passkey was added. `last_used_at``string (date-time) | null`Required When it last signed in or confirmed a change. `backed_up``boolean`Required Synced by its password manager to the person’s other devices. `device_type``"singleDevice" | "multiDevice"` multiDevice: a synced passkey. singleDevice: bound to one device or security key. ## [PasskeyCredentialRequest](/content/docs/reference/api/objects\#passkeycredentialrequest/index.html) FieldDescription `credential``Record`Required The browser’s AuthenticationResponseJSON. ## [PasskeyOptionsResponse](/content/docs/reference/api/objects\#passkeyoptionsresponse/index.html) FieldDescription `options``Record`Required PublicKeyCredentialRequestOptionsJSON: pass to navigator.credentials.get(). ## [PasskeyPromptRequest](/content/docs/reference/api/objects\#passkeypromptrequest/index.html) FieldDescription `action``"not_now" | "never"`Required not\_now: ask again in 14 days. never: don’t ask again. ## [PasskeyRegistrationOptionsResponse](/content/docs/reference/api/objects\#passkeyregistrationoptionsresponse/index.html) FieldDescription `options``Record`Required PublicKeyCredentialCreationOptionsJSON: pass to navigator.credentials.create(). ## [PasskeySignInOptionsRequest](/content/docs/reference/api/objects\#passkeysigninoptionsrequest/index.html) FieldDescription `next``string` Same-origin path to land on after sign-in. Anything else is ignored. Default /app. `invitation_token``string` An invitation token (from /invite/{token}): signing in accepts the invitation. ## [PendingOrganizationRequest](/content/docs/reference/api/objects\#pendingorganizationrequest/index.html) FieldDescription `organization_id``string`Required One of the organizations from GET /auth/pending. ## [PendingSignInResponse](/content/docs/reference/api/objects\#pendingsigninresponse/index.html) The sign-in in progress in this browser. FieldDescription `step``"code" | "organization" | "verify_email"`Required code: waiting for the emailed sign-in code. organization: pick an organization. verify\_email: enter the code that verifies the email. `email``string` The address signing in, when known. `organizations``object[]` For organization: the organizations to pick from. `invitation``boolean`Required Signing in accepts an invitation. ## [PendingVerifyRequest](/content/docs/reference/api/objects\#pendingverifyrequest/index.html) FieldDescription `code``string`Required The 6-digit code from the email. Spaces and dashes are ignored. ## [PlanLimits](/content/docs/reference/api/objects\#planlimits/index.html) The allowances that apply to the organization. FieldDescription `messages_per_month``integer | null`Required Inbound messages and outbound recipients together per calendar month (UTC). null: no combined cap (paid plans). `messages_per_day``integer | null`Required The same, per UTC day. null: no daily cap. `inbound_per_month``integer | null`Required Inbound messages included per month on paid plans (more is billed as overage). null on Free. `outbound_per_month``integer | null`Required Outbound recipients included per month on paid plans (more is billed as overage). null on Free. `storage_bytes``integer`Required Storage included, in bytes (1 GB = 1,000,000,000 bytes). `custom_domains``integer`Required Custom domains included. `seats``integer | null`Required Members (including pending invitations). null: unlimited. `overage``boolean`Required true: usage past an allowance is billed, never blocked. false (Free): inbound past it is held and sending is refused until the reset. ## [PlanUsage](/content/docs/reference/api/objects\#planusage/index.html) Plan allowances and usage of the organization in the current period. FieldDescription `plan``"free" | "pro" | "team" | "scale"`Required Plan of the organization: free, pro, team or scale. `period``object`Required `limits` [PlanLimits](/content/docs/reference/api/objects#planlimits/index.html) Required The allowances that apply to the organization. `usage``object`Required `held``object`Required `enforcement``"enforce" | "shadow" | "off" | "exempt"`Required enforce: limits apply. shadow and off: limits are not applied right now (usage is still counted). exempt: this organization has its own limits (unclaimed agent sandbox). ## [Pod](/content/docs/reference/api/objects\#pod/index.html) FieldDescription `pod_id``string`Required ID of the pod. `organization_id``string`Required ID of the organization. `name``string`Required Name of the pod. `is_default``boolean`Required Whether this is the default pod, where inboxes go when no pod is given. It cannot be deleted. `client_id``string` Client ID given at creation (idempotency key). `updated_at``string (date-time)`Required Time at which the pod was last updated. `created_at``string (date-time)`Required Time at which the pod was created. ## [PreviewTrustedDomainRequest](/content/docs/reference/api/objects\#previewtrusteddomainrequest/index.html) FieldDescription `domain``string`Required `include_subdomains``boolean` As for create. ## [PreviewTrustedDomainResponse](/content/docs/reference/api/objects\#previewtrusteddomainresponse/index.html) What a create would do, without saving anything. FieldDescription `domain``string | null`Required The entry as it would be stored (ASCII form). null when it is not a domain or address. `domain_unicode``string | null`Required The same in Unicode form. `entry_type``object`Required `allowed``boolean`Required Whether a create would be accepted (with confirm: true when confirmation\_required), plan limit aside. `refusal``("free_mail" | "privacy_relay" | "shared_platform" | "public_suffix" | "disposable" | "invalid" | "confusable_idn" | null) | null`Required Why it cannot be trusted. null when it can. `message``string | null`Required The refusal or confirmation, in one sentence. null when there is neither. `confirmation_required``boolean`Required A platform where anyone can write the content, or a relay address: a create needs confirm: true. `warnings` [Warning\[\]](/content/docs/reference/api/objects#warning/index.html) Required Conflicts with block entries or allow-only scopes, as a create would report them. `would_release``object | null`Required Not computed yet: always null. `suggestions``string[] | null`Required Narrower entries to consider (an exact address). Not computed yet: always null. ## [ProtectedResourceMetadata](/content/docs/reference/api/objects\#protectedresourcemetadata/index.html) RFC 9728 OAuth Protected Resource Metadata. FieldDescription `resource``string`Required `authorization_servers``string[]`Required `bearer_methods_supported``string[]`Required header. `resource_name``string`Required `resource_logo_uri``string`Required `resource_documentation``string`Required The /auth.md document, or the MCP guide for /mcp. ## [RatePoint](/content/docs/reference/api/objects\#ratepoint/index.html) FieldDescription `timestamp``string (date-time)`Required End of the window the point covers; the window is the window seconds before it. `rate``number` Bounced (or complained) messages divided by messages sent over the window, as a fraction (0.05 is 5%). Absent when nothing was sent in the window. `sent``integer`Required Messages sent in the window. ## [ReadyResponse](/content/docs/reference/api/objects\#readyresponse/index.html) FieldDescription `status``"ready" | "unavailable"`Required ready when storage answers; the HTTP status is then 200, otherwise 503. `checks``object`Required The checks behind status. ## [Recipient](/content/docs/reference/api/objects\#recipient/index.html) FieldDescription `address``string`Required Recipient address. `status``string`Required bounced or complained. ## [RegisterPasskeyRequest](/content/docs/reference/api/objects\#registerpasskeyrequest/index.html) FieldDescription `credential``Record`Required The browser’s RegistrationResponseJSON. `name``string` Name for the passkey (up to 64 characters). Default: its password manager or device, or “Passkey”. ## [Reject](/content/docs/reference/api/objects\#reject/index.html) FieldDescription `inbox_id``string`Required ID of the inbox. `thread_id``null`Required Always null: nothing was stored. `message_id``null`Required Always null: nothing was stored. `timestamp``string (date-time)`Required When it happened. `reason``"inbox_paused" | "plan_limit" | "plan_limit_expired"`Required Why the message was rejected. inbox\_paused: the inbox is paused. plan\_limit (MachineMail): the organization reached a Free plan limit and already holds as much mail as it may. plan\_limit\_expired (MachineMail): held mail was not released in time and was deleted. `from``string`Required Sender of the rejected message. `subject``string` Subject of the rejected message. ## [RemovePasskeyResponse](/content/docs/reference/api/objects\#removepasskeyresponse/index.html) FieldDescription `ok``true`Required `sessions_ended``integer`Required Sessions the passkey had signed in that were signed out. `signed_out``boolean`Required This session was one of them: sign in again. ## [RenamePasskeyRequest](/content/docs/reference/api/objects\#renamepasskeyrequest/index.html) FieldDescription `name``string`Required New name, 1 to 64 characters. ## [ReplyAllMessageRequest](/content/docs/reference/api/objects\#replyallmessagerequest/index.html) FieldDescription `labels``string | string[]` Labels of the message. SENT is always added. `reply_to``string | string[]` Reply-to address or addresses. `text``string` Plain text body. `html``string` HTML body. `attachments` [SendAttachment\[\]](/content/docs/reference/api/objects#sendattachment/index.html) Attachments to include. `headers``Record` Headers to include. In-Reply-To and References also thread the message. `to``string | string[]` More recipients, added to the sender and recipients of the original. `cc``string | string[]` More CC recipients, added to the CC recipients of the original. `bcc``string | string[]` BCC recipient address or addresses. `subject``string` Subject of the reply. Defaults to the original subject with Re: in front. ## [ReplyToMessageRequest](/content/docs/reference/api/objects\#replytomessagerequest/index.html) FieldDescription `labels``string | string[]` Labels of the message. SENT is always added. `reply_to``string | string[]` Reply-to address or addresses. `to``string | string[]` Recipient address or addresses. Defaults to the sender of the original (its reply-to addresses if any); for an outbound original, its recipients. `cc``string | string[]` CC recipient address or addresses. `bcc``string | string[]` BCC recipient address or addresses. `reply_all``boolean` true replies to all recipients of the original, as Reply All Message does; to and cc are then added to them. `text``string` Plain text body. `html``string` HTML body. `attachments` [SendAttachment\[\]](/content/docs/reference/api/objects#sendattachment/index.html) Attachments to include. `headers``Record` Headers to include. In-Reply-To and References also thread the message. `subject``string` Subject of the reply. Defaults to the original subject with Re: in front. ## [RevokeOtherSessionsResponse](/content/docs/reference/api/objects\#revokeothersessionsresponse/index.html) FieldDescription `ok``true`Required `ended``integer`Required Other sessions signed out. ## [RevokeRequest](/content/docs/reference/api/objects\#revokerequest/index.html) FieldDescription `token``string`Required An access token, a refresh token or an identity assertion. `token_type_hint``string` access\_token, refresh\_token or identity\_assertion. A refresh token revokes its whole grant; an identity assertion its whole registration. Other values are ignored. `client_id``string` Refresh and access tokens of an app: when given, must be the client the token was issued to, or nothing is revoked. `client_secret``string` A confidential client authenticates as at the token endpoint (client\_secret\_post, or HTTP Basic). ## [ScopeDescription](/content/docs/reference/api/objects\#scopedescription/index.html) FieldDescription `scope``"inboxes.read" | "inboxes.write" | "messages.read" | "messages.send" | "messages.write" | "webhooks.read" | "webhooks.write" | "domains.read" | "domains.write" | "lists.read" | "lists.write" | "metrics.read" | "pods.read" | "pods.write" | "api_keys.read" | "api_keys.write"`Required OAuth scope. Each grants API key permissions: inboxes.\* (inbox\_\*), messages.read (message, thread and label reads), messages.send (send, reply, drafts), messages.write (update and delete messages and threads), webhooks.\*, domains.\*, lists.\* (allow/block lists and suppressions), pods.\*, api\_keys.\*, metrics.read (metrics and the event log). `description``string`Required ## [SearchInboxesResponse](/content/docs/reference/api/objects\#searchinboxesresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `inboxes` [Inbox\[\]](/content/docs/reference/api/objects#inbox/index.html) Required Matching inboxes, newest first. `truncated``true` Present when the organization has more than 500 inboxes in scope: only the newest 500 were searched. ## [SearchMessagesResponse](/content/docs/reference/api/objects\#searchmessagesresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `messages` [MessageItem\[\]](/content/docs/reference/api/objects#messageitem/index.html) Required Matching messages, newest first unless ascending is set. ## [SearchThreadsResponse](/content/docs/reference/api/objects\#searchthreadsresponse/index.html) FieldDescription `count``integer`Required Number of items returned. `limit``integer` Maximum number of items per page. Default 50, maximum 500; larger values are capped. `next_page_token``string` Page token for pagination. Absent on the last page. `threads` [ThreadItem\[\]](/content/docs/reference/api/objects#threaditem/index.html) Required Matching threads, ordered by timestamp, newest first unless ascending is set. `truncated``true` Present when q matched more than 500 messages: only the threads of the newest 500 matching messages were considered. ## [Send](/content/docs/reference/api/objects\#send/index.html) FieldDescription `inbox_id``string`Required ID of the inbox. `thread_id``string`Required ID of the thread. `message_id``string`Required ID of the message. `timestamp``string (date-time)`Required When it happened. `recipients``string[]`Required Every recipient (to, cc and bcc). ## [SendAttachment](/content/docs/reference/api/objects\#sendattachment/index.html) Provide either `content` or `url` for each attachment. FieldDescription `filename``string` Filename of the attachment. Defaults to the last segment of url. `content_type``string` Content type of the attachment. Defaults to the Content-Type of the url response. `content_disposition``"inline" | "attachment"` Content disposition of the attachment. `content_id``string` Content ID, for inline images referenced as cid: in the HTML body. `content``string` Base64 encoded content of the attachment. `url``string` URL the API downloads the attachment from: public http(s) only, no redirects, at most 10 MB, 20 second timeout. ## [SendMessageRequest](/content/docs/reference/api/objects\#sendmessagerequest/index.html) FieldDescription `labels``string | string[]` Labels of the message. SENT is always added. `reply_to``string | string[]` Reply-to address or addresses. `to``string | string[]` Recipient address or addresses. `cc``string | string[]` CC recipient address or addresses. `bcc``string | string[]` BCC recipient address or addresses. `subject``string` Subject of the message. `text``string` Plain text body. `html``string` HTML body. `attachments` [SendAttachment\[\]](/content/docs/reference/api/objects#sendattachment/index.html) Attachments to include. `headers``Record` Headers to include. In-Reply-To and References also thread the message. ## [SendMessageResponse](/content/docs/reference/api/objects\#sendmessageresponse/index.html) FieldDescription `message_id``string`Required ID of the message. `thread_id``string`Required ID of the thread. `timestamp``string (date-time)`Required When the message was sent. ## [SessionResponse](/content/docs/reference/api/objects\#sessionresponse/index.html) The signed-in user and their organization. FieldDescription `user` [User](/content/docs/reference/api/objects#user/index.html) Required A person who signs in to the dashboard. `organization` [Organization](/content/docs/reference/api/objects#organization/index.html) Required The organization of the credential. plan and GET /v0/organizations/usage report plan allowances; inboxes are unlimited (no inbox\_limit) and there are no billing fields. ## [SetError](/content/docs/reference/api/objects\#seterror/index.html) RFC 8935 SET delivery error. FieldDescription `err``string`Required invalid\_request, invalid\_issuer, invalid\_key or invalid\_audience. `description``string`Required ## [SignInStepResponse](/content/docs/reference/api/objects\#signinstepresponse/index.html) The result of a sign-in step. FieldDescription `ok``true`Required `signed_in``boolean`Required true: the mm\_session cookie is set. false: another step comes first (organization picker, email verification, SSO). `redirect_to``string`Required Where to send the browser next, built by the server: next (with welcome=1 after a first sign-in), /login/organization, /login/verify, an identity provider, or /login?error=. ## [SignupRequest](/content/docs/reference/api/objects\#signuprequest/index.html) FieldDescription `email``string`Required `password``string`Required At least 8 characters. `name``string` Display name of the user. `org_name``string` Organization name. `organization_name``string` Alias of org\_name. `organizationName``string`Deprecated Alias of org\_name. ## [SignupResponse](/content/docs/reference/api/objects\#signupresponse/index.html) The new user, their organization and the first organization API key (shown once). FieldDescription `user` [User](/content/docs/reference/api/objects#user/index.html) Required A person who signs in to the dashboard. `organization` [Organization](/content/docs/reference/api/objects#organization/index.html) Required `api_key` [OneTimeApiKey](/content/docs/reference/api/objects#onetimeapikey/index.html) Required An API key with its plaintext secret, returned once. ## [StartOrganizationDeletionRequest](/content/docs/reference/api/objects\#startorganizationdeletionrequest/index.html) FieldDescription `confirm_name``string`Required The name of the organization, exactly as it is shown (case and spaces included). ## [StepUpEmailResponse](/content/docs/reference/api/objects\#stepupemailresponse/index.html) FieldDescription `ok``true`Required `email``string`Required Where the code went, masked. `expires_at``string (date-time)`Required When the code expires (10 minutes). ## [StepUpEmailVerifyRequest](/content/docs/reference/api/objects\#stepupemailverifyrequest/index.html) FieldDescription `code``string`Required The 6-digit code from the email. Spaces and dashes are ignored. ## [StepUpResponse](/content/docs/reference/api/objects\#stepupresponse/index.html) FieldDescription `ok``true`Required `recent_until``string (date-time)`Required Until when sensitive changes need no further confirmation. ## [Suppression](/content/docs/reference/api/objects\#suppression/index.html) An address MachineMail will not send to. Suppressions apply to the whole organization. FieldDescription `email``string`Required The suppressed address (lowercased). `organization_id``string`Required ID of the organization. `reason``"bounce" | "complaint" | "manual"`Required bounce: a permanent bounce. complaint: the recipient reported spam; only MachineMail support can remove it. manual: added with POST /v0/suppressions. `detail``string` Free text: the bounce diagnostic, or the note given when the address was added manually. `source_message_id``string` Message whose bounce or complaint caused the suppression. `created_at``string (date-time)`Required When the address was suppressed. ## [SwitchOrganizationRequest](/content/docs/reference/api/objects\#switchorganizationrequest/index.html) FieldDescription `organization_id``string`Required ID of an organization the person belongs to. ## [Thread](/content/docs/reference/api/objects\#thread/index.html) FieldDescription `inbox_id``string`Required ID of the inbox. `thread_id``string`Required ID of the thread. `labels``string[]`Required Labels of the thread: the union of the labels of its messages. `timestamp``string (date-time)`Required Timestamp of the last sent or received message. `received_timestamp``string (date-time)` Timestamp of the last received message. `sent_timestamp``string (date-time)` Timestamp of the last sent message. `senders``string[]`Required Senders in the thread. In format username@domain.com. `recipients``string[]`Required Recipients (to and cc) in the thread. In format username@domain.com. `subject``string` Subject of the thread. `preview``string` Text preview of the last message in the thread. `attachments` [Attachment\[\]](/content/docs/reference/api/objects#attachment/index.html) Attachments in the thread. `last_message_id``string`Required ID of the last message in the thread. `message_count``integer`Required Number of messages in the thread. `size``integer`Required Size of the thread in bytes. `updated_at``string (date-time)`Required Time at which the thread was last updated. `created_at``string (date-time)`Required Time at which the thread was created. `pod_id``string`Required ID of the pod. `count``integer`Required Number of messages in this page. `limit``integer` Maximum number of messages requested for this page. `next_page_token``string` Token for the next, older page of messages. Absent when this page completes the thread. `messages` [Message\[\]](/content/docs/reference/api/objects#message/index.html) Required Messages in this page, oldest first. The first page has the newest messages; follow next\_page\_token for older ones. ## [ThreadItem](/content/docs/reference/api/objects\#threaditem/index.html) FieldDescription `inbox_id``string`Required ID of the inbox. `thread_id``string`Required ID of the thread. `labels``string[]`Required Labels of the thread: the union of the labels of its messages. `timestamp``string (date-time)`Required Timestamp of the last sent or received message. `received_timestamp``string (date-time)` Timestamp of the last received message. `sent_timestamp``string (date-time)` Timestamp of the last sent message. `senders``string[]`Required Senders in the thread. In format username@domain.com. `recipients``string[]`Required Recipients (to and cc) in the thread. In format username@domain.com. `subject``string` Subject of the thread. `preview``string` Text preview of the last message in the thread. `attachments` [Attachment\[\]](/content/docs/reference/api/objects#attachment/index.html) Attachments in the thread. `last_message_id``string`Required ID of the last message in the thread. `message_count``integer`Required Number of messages in the thread. `size``integer`Required Size of the thread in bytes. `updated_at``string (date-time)`Required Time at which the thread was last updated. `created_at``string (date-time)`Required Time at which the thread was created. `pod_id``string`Required ID of the pod. ## [TokenRequest](/content/docs/reference/api/objects\#tokenrequest/index.html) FieldDescription `grant_type``string`Required authorization\_code (with PKCE) and refresh\_token for apps and MCP clients; urn:ietf:params:oauth:grant-type:device\_code for mm login; urn:ietf:params:oauth:grant-type:jwt-bearer (RFC 7523) exchanges an assertion; urn:workos:agent-auth:grant-type:claim polls with a claim\_token. Other values: unsupported\_grant\_type. `code``string` authorization\_code: the code from the authorization response. Single use; expires after 2 minutes. `redirect_uri``string` authorization\_code: the redirect\_uri of the authorization request, when it had one. `code_verifier``string` authorization\_code: the PKCE code verifier (43 to 128 characters). `refresh_token``string` refresh\_token: the current refresh token. Each use returns a new one; presenting a replaced one within 60 seconds of its replacement returns the current one, later it revokes the whole grant. `scope``string` refresh\_token, optional: narrow the new access token to these scopes of the grant. `device_code``string` device\_code: the device\_code from /auth/cli/device/code. `assertion``string` jwt-bearer grant: the identity\_assertion. `client_id``string` authorization\_code and refresh\_token: the client the code or token was issued to (invalid\_grant otherwise); may instead come from an HTTP Basic Authorization header (client\_secret\_basic), or be left out (taken from the code or token). device\_code: required. jwt-bearer, optional: the registration id. `client_secret``string` Confidential clients using client\_secret\_post (registered with a secret). Alternatively send Authorization: Basic base64(urlencode(client\_id):urlencode(client\_secret)) (client\_secret\_basic), not both. A missing or wrong secret: 401 invalid\_client. Public clients need none; one they send is ignored. `resource``string` RFC 8707. authorization\_code and refresh\_token: must be the resource of the authorization request (invalid\_target otherwise). jwt-bearer, optional audience pin: must be /. `claim_token``string` Claim grant: the claim\_token from registration. ## [TokenResponse](/content/docs/reference/api/objects\#tokenresponse/index.html) auth.md grants issue no refresh\_token (exchange the identity\_assertion again); the authorization code and refresh grants do. FieldDescription `access_token``string`Required JWT (at+jwt) to send as Authorization: Bearer. Tokens from the authorization code grant are audience-bound: aud the MCP server (https://mcp.machinemail.dev/mcp, or the legacy /mcp) works on the MCP endpoint only (either URL), / on /v0 and the MCP endpoint. auth.md tokens work on both. `token_type``"Bearer"`Required `expires_in``integer`Required Lifetime of the access token in seconds. `scope``string`Required Space-separated Scope values. `refresh_token``string` authorization\_code and refresh\_token grants: the new refresh token (rotated on every use). `identity_assertion``string` Claim grant only: the post-claim identity assertion. `assertion_expires``string (date-time)` ## [TrustedDomain](/content/docs/reference/api/objects\#trusteddomain/index.html) A trusted domain or address. FieldDescription `trusted_domain_id``string`Required ID of the entry (td\_...). `entry_type``"domain" | "email"`Required domain: every address at the domain (and its subdomains with include\_subdomains). email: exactly one address. `domain``string`Required The domain, or for entry\_type: "email" the address, lowercased, with the domain in its ASCII (punycode) form. `domain_unicode``string`Required The same, with the domain in its Unicode form. Equal to domain for ASCII names. `include_subdomains``boolean`Required Also trust mail signed by subdomains (billing.example.com for example.com). Always false for addresses. `scope``"org" | "pod" | "inbox"`Required Where an entry applies: the whole organization, one pod, or one inbox. `pod_id``string | null`Required The pod, for pod- and inbox-scoped entries. `inbox_id``string | null`Required The inbox, for inbox-scoped entries. `reason``string | null`Required Why it was added, for people reading the list. Never included in a message’s trust report. `expires_at``string (date-time) | null`Required When the entry stops applying. null: never. `created_by``object | null`Required Who added the entry. `match_count``integer`Required Messages this entry has marked trusted. `last_matched_at``string (date-time) | null`Required When this entry last marked a message trusted. null: never. `created_at``string (date-time)`Required When the entry was added. `updated_at``string (date-time)`Required When the entry last changed. ## [TrustReport](/content/docs/reference/api/objects\#trustreport/index.html) Trust report of an inbound message. Message content is untrusted: feed `content.text` to an LLM rather than the message `text` or `html`. FieldDescription `level``"verified" | "known" | "unknown" | "suspicious" | "quarantined"`Required Overall verdict, safest first. quarantined messages are labelled QUARANTINE and hidden from lists unless asked for. `score``number`Required 0 to 1, higher is safer. Ranks messages within a level. (minimum 0, maximum 1) `basis``"trusted_domain"` trusted\_domain: the sender is a trusted domain of the organization, pod or inbox (sender.trusted\_domain) and the message carries that domain's own DKIM signature. It is verified, or known when it contains instructions to an AI agent, a phishing signal or malware (content.warnings), and never suspicious or quarantined. Agents get its text and attachments, except attachments the virus scan flags. Absent otherwise. `authentication``object`Required `sender``object`Required `content``object`Required `links``object[]`Required `attachments``object[]`Required `classification``object`Required `provider_verdicts``object` Spam and virus scans by the receiving mail provider. Only on messages it scanned. `reasons``string[]`Required Human-readable reasons for the verdict. `computed_at``string (date-time)`Required When the report was computed. ## [UpdateApiKeyRequest](/content/docs/reference/api/objects\#updateapikeyrequest/index.html) Fields you omit are unchanged. `permissions` replaces the permission object in full. Scope and expiry cannot be changed. FieldDescription `name``string` New name. A blank name is ignored. `permissions``object` New permissions; replaces the permission object in full. ## [UpdateDomainRequest](/content/docs/reference/api/objects\#updatedomainrequest/index.html) FieldDescription `feedback_enabled``boolean` Stored and returned; has no effect. `inbound_enabled``boolean` Receive email for this domain. false makes the inbound MX record optional and re-evaluates the status. `catch_all``boolean` Create an inbox for any address at the domain that receives mail. `catch_all_ttl_seconds``integer | null` TTL of inboxes created by catch-all from now on. null makes them permanent. ## [UpdateDraftRequest](/content/docs/reference/api/objects\#updatedraftrequest/index.html) FieldDescription `reply_to``string | string[] | null` Reply-to addresses. null clears them. `to``string | string[] | null` Recipient addresses. null clears them. `cc``string | string[] | null` CC addresses. null clears them. `bcc``string | string[] | null` BCC addresses. null clears them. `subject``string | null` Subject. null clears it. `text``string | null` Plain text body. null clears it. `html``string | null` HTML body. null clears it. `add_attachments` [SendAttachment\[\]](/content/docs/reference/api/objects#sendattachment/index.html) Attachments to add. Each needs content or url. `remove_attachments``string[]` IDs of attachments to remove. Unknown IDs are ignored. `add_labels``string[]` Labels to add. `remove_labels``string[]` Labels to remove (applied after add\_labels). `send_at``string (date-time) | null` Schedule (or reschedule) the draft. null unschedules it. ## [UpdateInboxRequest](/content/docs/reference/api/objects\#updateinboxrequest/index.html) FieldDescription `display_name``string` Display name: Display Name . `status``"active" | "paused"` `metadata``(Record) | null` Merged into the existing metadata: keys you send are added or overwritten, keys set to null are removed, other keys are kept. null clears all metadata. `ttl_seconds``integer | null` Make the inbox ephemeral with this TTL (expires\_at restarts from now), or null to make it permanent. `ephemeral``boolean` false makes the inbox permanent (same as ttl\_seconds: null). true alone has no effect; send ttl\_seconds. ## [UpdateMemberRequest](/content/docs/reference/api/objects\#updatememberrequest/index.html) FieldDescription `role``"owner" | "admin" | "member"`Required ## [UpdateMessageRequest](/content/docs/reference/api/objects\#updatemessagerequest/index.html) FieldDescription `add_labels``string | string[]` Label or labels to add. `remove_labels``string | string[]` Label or labels to remove. ## [UpdateMessageResponse](/content/docs/reference/api/objects\#updatemessageresponse/index.html) FieldDescription `message_id``string`Required ID of the message. `labels``string[]`Required Labels of the message after the update. ## [UpdateOrganizationRequest](/content/docs/reference/api/objects\#updateorganizationrequest/index.html) FieldDescription `name``string` New name. Must not be blank. `slug``string` Immutable: the slug is fixed when the organization is created. Only the current value is accepted (a client echoing the organization back); any other value is a 400. `undo_send``boolean` `default_inbox_id``string | null` Make this inbox (an inbox\_id of the organization) the default inbox, or null to have none. An unknown inbox is a 404. ## [UpdatePodRequest](/content/docs/reference/api/objects\#updatepodrequest/index.html) FieldDescription `name``string` New name. Must not be blank. ## [UpdateThreadRequest](/content/docs/reference/api/objects\#updatethreadrequest/index.html) FieldDescription `add_labels``string | string[]` Label or labels to add to every message in the thread. `remove_labels``string | string[]` Label or labels to remove from every message in the thread. Applied after add\_labels. ## [UpdateTrustedDomainRequest](/content/docs/reference/api/objects\#updatetrusteddomainrequest/index.html) FieldDescription `include_subdomains``boolean` Also trust mail signed by subdomains. Not allowed for an address. `confirm``boolean` Required (true) to turn on include\_subdomains when a platform where anyone can write the content lies under the domain: without it the answer is 422 confirmation\_required. `reason``string | null` New reason; null clears it. (max length 500) `expires_at``string (date-time) | null` New expiry, in the future; null removes it. ## [UpdateWebhookHeadersRequest](/content/docs/reference/api/objects\#updatewebhookheadersrequest/index.html) Sets, replaces or removes custom delivery headers; the headers you do not name are unchanged. Give at least one of `headers` (each name is added, or replaces the value of the header of that name in any case) or `remove_headers`. A name cannot be both set and removed in one request. FieldDescription `headers``Record` `remove_headers``string[]` Names of custom headers to remove (any case). Names that are not set are ignored. ## [UpdateWebhookRequest](/content/docs/reference/api/objects\#updatewebhookrequest/index.html) FieldDescription Replaces the subscribed event types in full (not a merge). An empty array subscribes to every event type except domain.updated and trusted\_domain.\*, which are sent only when listed. Omit it to keep the types. `enabled``boolean` false disables the webhook: no new deliveries are queued (deliveries already queued are still attempted). true enables it again. Events that occurred while it was disabled are not delivered later. `add_inbox_ids``string[]` Inboxes to add to inbox\_ids. `remove_inbox_ids``string[]` Inboxes to remove from inbox\_ids. `add_pod_ids``string[]` Pods to add to pod\_ids. `remove_pod_ids``string[]` Pods to remove from pod\_ids. `url``string` New endpoint URL: a public http(s) URL. `headers``Record | null` Replaces the custom delivery headers in full (not a merge): the webhook then sends exactly these. null or {} removes them all; omit it to keep them. To change one header and keep the others, use PATCH /v0/webhooks/{webhook\_id}/headers. Values are write-only. At most 10 headers. Names are HTTP tokens of up to 64 characters, compared without regard to case; values are printable ASCII (no line breaks or control characters) of up to 4096 characters, with surrounding spaces removed, and names plus values total at most 8192 bytes. Reserved names are refused with 400: Host, Content-Length, Content-Type, Content-Encoding, Transfer-Encoding, Connection, Upgrade, TE, Trailer, Keep-Alive, Expect, User-Agent, Accept-Encoding, and every name starting with Proxy-, Sec-, X-MachineMail-, Svix- or Webhook-. Authorization and Cookie are allowed. ## [UsagePoint](/content/docs/reference/api/objects\#usagepoint/index.html) FieldDescription `timestamp``string (date-time)`Required Time of the value (end). `value``integer`Required Value of the usage metric now. ## [User](/content/docs/reference/api/objects\#user/index.html) A person who signs in to the dashboard. FieldDescription `user_id``string`Required ID of the user. `email``string`Required Email address the user signs in with. `name``string | null` Display name, when set. `organization_id``string`Required ID of the organization this record is about: the session’s active organization, or the organization listed. `role``"owner" | "admin" | "member"`Required `created_at``string (date-time)`Required When the user was created. ## [VerificationRecord](/content/docs/reference/api/objects\#verificationrecord/index.html) FieldDescription `type``"TXT" | "CNAME" | "MX"`Required `name``string`Required Name (host) of the record. `value``string`Required Value of the record. `status``"MISSING" | "INVALID" | "VALID"`Required MISSING: not published yet. INVALID: published with the wrong value. `priority``integer` Priority of an MX record. `reason``string` Why an INVALID record is invalid: Found: . `purpose``"inbound" | "spf" | "dkim" | "dmarc" | "provider"`Required What the record is for. provider records come from the sending provider. `required``boolean`Required Whether the record must be valid for the domain to verify. The inbound MX record is not required when inbound\_enabled is false. ## [Warning](/content/docs/reference/api/objects\#warning/index.html) A conflict that does not stop the entry from being saved, but means some of its mail is still blocked. FieldDescription `code``"shadowed_by_block" | "shadowed_by_allow_only"`Required shadowed\_by\_block: a receive/block list entry matches some or all of the mail this entry trusts, and a block always wins over trust. shadowed\_by\_allow\_only: the scope is allow-only (it has receive/allow entries) and none of them allows this sender, so the mail is still BLOCKED. `scope``"org" | "pod" | "inbox"`Required Where an entry applies: the whole organization, one pod, or one inbox. `pod_id``string` The pod of the list, for pod and inbox scopes. `inbox_id``string` The inbox of the list, for the inbox scope. `entry``object` shadowed\_by\_block only: the block entry. Left out for credentials without list\_entry\_read. `message``string`Required What the warning means, in one sentence. ## [Webhook](/content/docs/reference/api/objects\#webhook/index.html) FieldDescription `webhook_id``string`Required ID of the webhook. `url``string`Required URL of the webhook endpoint. `event_types``("message.received" | "message.received.spam" | "message.received.quarantined" | "message.received.unauthenticated" | "message.received.blocked" | "message.sent" | "message.delivered" | "message.bounced" | "message.complained" | "message.rejected" | "domain.verified" | "domain.updated" | "inbox.created" | "inbox.expired" | "draft.sent" | "webhook.test" | "trusted_domain.created" | "trusted_domain.updated" | "trusted_domain.deleted")[]`Required Event types the webhook receives. Empty: every event type except domain.updated and trusted\_domain.\*, which are sent only when listed. `pod_ids``string[]` Only events of these pods. Absent: every pod in scope. `inbox_ids``string[]` Only events of these inboxes. Absent: every inbox in scope. `pod_id``string` Set when the webhook was created with a pod-scoped credential (or under /v0/pods/{pod\_id}): it never receives events outside that pod. `inbox_id``string` Set when the webhook was created with an inbox-scoped credential (or under /v0/inboxes/{inbox\_id}): it only receives events of that inbox. `secret``string`Required Signing secret (whsec\_...) for X-MachineMail-Signature. Returned on every read. `enabled``boolean`Required Whether new events are delivered. Webhooks are never disabled automatically. `updated_at``string (date-time)`Required Time at which the webhook was last updated. `created_at``string (date-time)`Required Time at which the webhook was created. `client_id``string` Client ID given at creation (idempotency key). `status``"active" | "disabled"`Required active or disabled; mirrors enabled. `header_names``string[]`Required Names of the custom delivery headers (headers), as they were set; empty when there are none. Values are write-only and never returned. `headers_updated_at``string (date-time)` When the custom headers were last set or changed. Absent when they never were. ## [WebhookDelivery](/content/docs/reference/api/objects\#webhookdelivery/index.html) FieldDescription `delivery_id``string`Required ID of the delivery (X-MachineMail-Delivery-Id). `webhook_id``string`Required ID of the webhook. `event_id``string`Required ID of the event (X-MachineMail-Event-Id). `event_type``"message.received" | "message.received.spam" | "message.received.quarantined" | "message.received.unauthenticated" | "message.received.blocked" | "message.sent" | "message.delivered" | "message.bounced" | "message.complained" | "message.rejected" | "domain.verified" | "domain.updated" | "inbox.created" | "inbox.expired" | "draft.sent" | "webhook.test" | "trusted_domain.created" | "trusted_domain.updated" | "trusted_domain.deleted"`Required Type of event. AgentMail has no message.received.quarantined, domain.updated, inbox.created, inbox.expired, draft.sent or webhook.test; MachineMail does not emit message.opened or calendar.event.\*. domain.updated is sent whenever a DNS check changes the domain status or a record status (the change to VERIFIED also sends domain.verified). trusted\_domain.created, .updated and .deleted (MachineMail) record changes to trusted domains. Webhooks and WebSocket subscriptions receive domain.updated and the trusted\_domain.\* types only when their event\_types list them, while the SSE stream and the event log always include them. `attempt``integer`Required Number of attempts so far. `status``"pending" | "delivered" | "failed"`Required pending until a 2xx response (delivered), or failed when retries stop (5 days after the event) or the webhook or event was deleted. `response_status``integer` HTTP status of the last attempt. `response_body``string` First 1024 bytes of the last response body. `next_attempt_at``string (date-time)` When the next attempt is due, while pending. `last_error``string` Error of the last failed attempt (HTTP 500, a network error). `delivered_at``string (date-time)` When the delivery succeeded. `created_at``string (date-time)`Required When the delivery was queued. `updated_at``string (date-time)`Required Last change to the delivery. ## [WebhookHeaderNamesResponse](/content/docs/reference/api/objects\#webhookheadernamesresponse/index.html) FieldDescription `header_names``string[]`Required Names of the custom delivery headers of this webhook, as they were set. Values are never returned. `headers_updated_at``string (date-time)` When the custom headers were last set or changed. Absent when they never were. On this page [AgentIdentityRequest](/content/docs/reference/api/objects#agentidentityrequest/index.html) [AgentIdentityResponse](/content/docs/reference/api/objects#agentidentityresponse/index.html) [AgentRegistration](/content/docs/reference/api/objects#agentregistration/index.html) [ApiKeyPermissions](/content/docs/reference/api/objects#apikeypermissions/index.html) [Attachment](/content/docs/reference/api/objects#attachment/index.html) [AttachmentResponse](/content/docs/reference/api/objects#attachmentresponse/index.html) [AuthConfigResponse](/content/docs/reference/api/objects#authconfigresponse/index.html) [AuthorizationServerMetadata](/content/docs/reference/api/objects#authorizationservermetadata/index.html) [BatchGetMessagesRequest](/content/docs/reference/api/objects#batchgetmessagesrequest/index.html) [BatchGetMessagesResponse](/content/docs/reference/api/objects#batchgetmessagesresponse/index.html) [BatchUpdateMessagesRequest](/content/docs/reference/api/objects#batchupdatemessagesrequest/index.html) [BatchUpdateMessagesResponse](/content/docs/reference/api/objects#batchupdatemessagesresponse/index.html) [BearerApiKey](/content/docs/reference/api/objects#bearerapikey/index.html) [Bounce](/content/docs/reference/api/objects#bounce/index.html) [ClaimBlock](/content/docs/reference/api/objects#claimblock/index.html) [ClaimCompleteRequest](/content/docs/reference/api/objects#claimcompleterequest/index.html) [ClaimCompleteResponse](/content/docs/reference/api/objects#claimcompleteresponse/index.html) [ClaimPreviewResponse](/content/docs/reference/api/objects#claimpreviewresponse/index.html) [ClaimStartRequest](/content/docs/reference/api/objects#claimstartrequest/index.html) [ClaimStartResponse](/content/docs/reference/api/objects#claimstartresponse/index.html) [CliDeviceApproveRequest](/content/docs/reference/api/objects#clideviceapproverequest/index.html) [CliDeviceAuthorization](/content/docs/reference/api/objects#clideviceauthorization/index.html) [CliDeviceCodeRequest](/content/docs/reference/api/objects#clidevicecoderequest/index.html) [CliDeviceCodeResponse](/content/docs/reference/api/objects#clidevicecoderesponse/index.html) [CliDeviceDecision](/content/docs/reference/api/objects#clidevicedecision/index.html) [CliDeviceDecisionRequest](/content/docs/reference/api/objects#clidevicedecisionrequest/index.html) [CliDeviceTokenRequest](/content/docs/reference/api/objects#clidevicetokenrequest/index.html) [CliDeviceTokenResponse](/content/docs/reference/api/objects#clidevicetokenresponse/index.html) [ClientRegistrationRequest](/content/docs/reference/api/objects#clientregistrationrequest/index.html) [ClientRegistrationResponse](/content/docs/reference/api/objects#clientregistrationresponse/index.html) [Complaint](/content/docs/reference/api/objects#complaint/index.html) [CreateApiKeyResponse](/content/docs/reference/api/objects#createapikeyresponse/index.html) [CreateBearerApiKeyRequest](/content/docs/reference/api/objects#createbearerapikeyrequest/index.html) [CreateDomainRequest](/content/docs/reference/api/objects#createdomainrequest/index.html) [CreateDraftRequest](/content/docs/reference/api/objects#createdraftrequest/index.html) [CreatedTrustedDomain](/content/docs/reference/api/objects#createdtrusteddomain/index.html) [CreateInboxRequest](/content/docs/reference/api/objects#createinboxrequest/index.html) [CreateInvitationRequest](/content/docs/reference/api/objects#createinvitationrequest/index.html) [CreateListEntryRequest](/content/docs/reference/api/objects#createlistentryrequest/index.html) [CreatePodRequest](/content/docs/reference/api/objects#createpodrequest/index.html) [CreateSessionOrganizationRequest](/content/docs/reference/api/objects#createsessionorganizationrequest/index.html) [CreateSuppressionRequest](/content/docs/reference/api/objects#createsuppressionrequest/index.html) [CreateTrustedDomainRequest](/content/docs/reference/api/objects#createtrusteddomainrequest/index.html) [CreateWebhookRequest](/content/docs/reference/api/objects#createwebhookrequest/index.html) [DeleteOrganizationRequest](/content/docs/reference/api/objects#deleteorganizationrequest/index.html) [DeleteOrganizationResponse](/content/docs/reference/api/objects#deleteorganizationresponse/index.html) [Delivery](/content/docs/reference/api/objects#delivery/index.html) [Domain](/content/docs/reference/api/objects#domain/index.html) [DomainConnect](/content/docs/reference/api/objects#domainconnect/index.html) [DomainItem](/content/docs/reference/api/objects#domainitem/index.html) [Draft](/content/docs/reference/api/objects#draft/index.html) [DraftItem](/content/docs/reference/api/objects#draftitem/index.html) [EmailCodesRequest](/content/docs/reference/api/objects#emailcodesrequest/index.html) [EmailCodesResponse](/content/docs/reference/api/objects#emailcodesresponse/index.html) [EmailCodeStartRequest](/content/docs/reference/api/objects#emailcodestartrequest/index.html) [EmailCodeStartResponse](/content/docs/reference/api/objects#emailcodestartresponse/index.html) [EmailCodeVerifyRequest](/content/docs/reference/api/objects#emailcodeverifyrequest/index.html) [Event](/content/docs/reference/api/objects#event/index.html) [FirstKeyResponse](/content/docs/reference/api/objects#firstkeyresponse/index.html) [HealthResponse](/content/docs/reference/api/objects#healthresponse/index.html) [Identity](/content/docs/reference/api/objects#identity/index.html) [InboundRawResponse](/content/docs/reference/api/objects#inboundrawresponse/index.html) [Inbox](/content/docs/reference/api/objects#inbox/index.html) [InboxAvailability](/content/docs/reference/api/objects#inboxavailability/index.html) [Invitation](/content/docs/reference/api/objects#invitation/index.html) [InvitationPreviewResponse](/content/docs/reference/api/objects#invitationpreviewresponse/index.html) [JsonRpcError](/content/docs/reference/api/objects#jsonrpcerror/index.html) [JsonWebKeySet](/content/docs/reference/api/objects#jsonwebkeyset/index.html) [ListAgentRegistrationsResponse](/content/docs/reference/api/objects#listagentregistrationsresponse/index.html) [ListApiKeysResponse](/content/docs/reference/api/objects#listapikeysresponse/index.html) [ListDeliveriesResponse](/content/docs/reference/api/objects#listdeliveriesresponse/index.html) [ListDomainsResponse](/content/docs/reference/api/objects#listdomainsresponse/index.html) [ListDraftsResponse](/content/docs/reference/api/objects#listdraftsresponse/index.html) [ListEntry](/content/docs/reference/api/objects#listentry/index.html) [ListEventsResponse](/content/docs/reference/api/objects#listeventsresponse/index.html) [ListInboxesResponse](/content/docs/reference/api/objects#listinboxesresponse/index.html) [ListInvitationsResponse](/content/docs/reference/api/objects#listinvitationsresponse/index.html) [ListListEntriesResponse](/content/docs/reference/api/objects#listlistentriesresponse/index.html) [ListMembersResponse](/content/docs/reference/api/objects#listmembersresponse/index.html) [ListMessagesResponse](/content/docs/reference/api/objects#listmessagesresponse/index.html) [ListOAuthGrantsResponse](/content/docs/reference/api/objects#listoauthgrantsresponse/index.html) [ListPasskeysResponse](/content/docs/reference/api/objects#listpasskeysresponse/index.html) [ListPodsResponse](/content/docs/reference/api/objects#listpodsresponse/index.html) [ListSessionOrganizationsResponse](/content/docs/reference/api/objects#listsessionorganizationsresponse/index.html) [ListSuppressionsResponse](/content/docs/reference/api/objects#listsuppressionsresponse/index.html) [ListThreadsResponse](/content/docs/reference/api/objects#listthreadsresponse/index.html) [ListTrustedDomainsResponse](/content/docs/reference/api/objects#listtrusteddomainsresponse/index.html) [ListWebhooksResponse](/content/docs/reference/api/objects#listwebhooksresponse/index.html) [LoginRequest](/content/docs/reference/api/objects#loginrequest/index.html) [MagicLinkRequest](/content/docs/reference/api/objects#magiclinkrequest/index.html) [MagicLinkResponse](/content/docs/reference/api/objects#magiclinkresponse/index.html) [McpDescription](/content/docs/reference/api/objects#mcpdescription/index.html) [Member](/content/docs/reference/api/objects#member/index.html) [MembershipOrganization](/content/docs/reference/api/objects#membershiporganization/index.html) [Message](/content/docs/reference/api/objects#message/index.html) [MessageAuthenticationResults](/content/docs/reference/api/objects#messageauthenticationresults/index.html) [MessageItem](/content/docs/reference/api/objects#messageitem/index.html) [MetricBucket](/content/docs/reference/api/objects#metricbucket/index.html) [OAuthApproveRequest](/content/docs/reference/api/objects#oauthapproverequest/index.html) [OAuthAuthorizationRequest](/content/docs/reference/api/objects#oauthauthorizationrequest/index.html) [OAuthClientInfo](/content/docs/reference/api/objects#oauthclientinfo/index.html) [OAuthDecision](/content/docs/reference/api/objects#oauthdecision/index.html) [OAuthDenyRequest](/content/docs/reference/api/objects#oauthdenyrequest/index.html) [OAuthError](/content/docs/reference/api/objects#oautherror/index.html) [OAuthGrant](/content/docs/reference/api/objects#oauthgrant/index.html) [OkResponse](/content/docs/reference/api/objects#okresponse/index.html) [OneTimeApiKey](/content/docs/reference/api/objects#onetimeapikey/index.html) [Organization](/content/docs/reference/api/objects#organization/index.html) [OrganizationDeletionStarted](/content/docs/reference/api/objects#organizationdeletionstarted/index.html) [Passkey](/content/docs/reference/api/objects#passkey/index.html) [PasskeyCredentialRequest](/content/docs/reference/api/objects#passkeycredentialrequest/index.html) [PasskeyOptionsResponse](/content/docs/reference/api/objects#passkeyoptionsresponse/index.html) [PasskeyPromptRequest](/content/docs/reference/api/objects#passkeypromptrequest/index.html) [PasskeyRegistrationOptionsResponse](/content/docs/reference/api/objects#passkeyregistrationoptionsresponse/index.html) [PasskeySignInOptionsRequest](/content/docs/reference/api/objects#passkeysigninoptionsrequest/index.html) [PendingOrganizationRequest](/content/docs/reference/api/objects#pendingorganizationrequest/index.html) [PendingSignInResponse](/content/docs/reference/api/objects#pendingsigninresponse/index.html) [PendingVerifyRequest](/content/docs/reference/api/objects#pendingverifyrequest/index.html) [PlanLimits](/content/docs/reference/api/objects#planlimits/index.html) [PlanUsage](/content/docs/reference/api/objects#planusage/index.html) [Pod](/content/docs/reference/api/objects#pod/index.html) [PreviewTrustedDomainRequest](/content/docs/reference/api/objects#previewtrusteddomainrequest/index.html) [PreviewTrustedDomainResponse](/content/docs/reference/api/objects#previewtrusteddomainresponse/index.html) [ProtectedResourceMetadata](/content/docs/reference/api/objects#protectedresourcemetadata/index.html) [RatePoint](/content/docs/reference/api/objects#ratepoint/index.html) [ReadyResponse](/content/docs/reference/api/objects#readyresponse/index.html) [Recipient](/content/docs/reference/api/objects#recipient/index.html) [RegisterPasskeyRequest](/content/docs/reference/api/objects#registerpasskeyrequest/index.html) [Reject](/content/docs/reference/api/objects#reject/index.html) [RemovePasskeyResponse](/content/docs/reference/api/objects#removepasskeyresponse/index.html) [RenamePasskeyRequest](/content/docs/reference/api/objects#renamepasskeyrequest/index.html) [ReplyAllMessageRequest](/content/docs/reference/api/objects#replyallmessagerequest/index.html) [ReplyToMessageRequest](/content/docs/reference/api/objects#replytomessagerequest/index.html) [RevokeOtherSessionsResponse](/content/docs/reference/api/objects#revokeothersessionsresponse/index.html) [RevokeRequest](/content/docs/reference/api/objects#revokerequest/index.html) [ScopeDescription](/content/docs/reference/api/objects#scopedescription/index.html) [SearchInboxesResponse](/content/docs/reference/api/objects#searchinboxesresponse/index.html) [SearchMessagesResponse](/content/docs/reference/api/objects#searchmessagesresponse/index.html) [SearchThreadsResponse](/content/docs/reference/api/objects#searchthreadsresponse/index.html) [Send](/content/docs/reference/api/objects#send/index.html) [SendAttachment](/content/docs/reference/api/objects#sendattachment/index.html) [SendMessageRequest](/content/docs/reference/api/objects#sendmessagerequest/index.html) [SendMessageResponse](/content/docs/reference/api/objects#sendmessageresponse/index.html) [SessionResponse](/content/docs/reference/api/objects#sessionresponse/index.html) [SetError](/content/docs/reference/api/objects#seterror/index.html) [SignInStepResponse](/content/docs/reference/api/objects#signinstepresponse/index.html) [SignupRequest](/content/docs/reference/api/objects#signuprequest/index.html) [SignupResponse](/content/docs/reference/api/objects#signupresponse/index.html) [StartOrganizationDeletionRequest](/content/docs/reference/api/objects#startorganizationdeletionrequest/index.html) [StepUpEmailResponse](/content/docs/reference/api/objects#stepupemailresponse/index.html) [StepUpEmailVerifyRequest](/content/docs/reference/api/objects#stepupemailverifyrequest/index.html) [StepUpResponse](/content/docs/reference/api/objects#stepupresponse/index.html) [Suppression](/content/docs/reference/api/objects#suppression/index.html) [SwitchOrganizationRequest](/content/docs/reference/api/objects#switchorganizationrequest/index.html) [Thread](/content/docs/reference/api/objects#thread/index.html) [ThreadItem](/content/docs/reference/api/objects#threaditem/index.html) [TokenRequest](/content/docs/reference/api/objects#tokenrequest/index.html) [TokenResponse](/content/docs/reference/api/objects#tokenresponse/index.html) [TrustedDomain](/content/docs/reference/api/objects#trusteddomain/index.html) [TrustReport](/content/docs/reference/api/objects#trustreport/index.html) [UpdateApiKeyRequest](/content/docs/reference/api/objects#updateapikeyrequest/index.html) [UpdateDomainRequest](/content/docs/reference/api/objects#updatedomainrequest/index.html) [UpdateDraftRequest](/content/docs/reference/api/objects#updatedraftrequest/index.html) [UpdateInboxRequest](/content/docs/reference/api/objects#updateinboxrequest/index.html) [UpdateMemberRequest](/content/docs/reference/api/objects#updatememberrequest/index.html) [UpdateMessageRequest](/content/docs/reference/api/objects#updatemessagerequest/index.html) [UpdateMessageResponse](/content/docs/reference/api/objects#updatemessageresponse/index.html) [UpdateOrganizationRequest](/content/docs/reference/api/objects#updateorganizationrequest/index.html) [UpdatePodRequest](/content/docs/reference/api/objects#updatepodrequest/index.html) [UpdateThreadRequest](/content/docs/reference/api/objects#updatethreadrequest/index.html) [UpdateTrustedDomainRequest](/content/docs/reference/api/objects#updatetrusteddomainrequest/index.html) [UpdateWebhookHeadersRequest](/content/docs/reference/api/objects#updatewebhookheadersrequest/index.html) [UpdateWebhookRequest](/content/docs/reference/api/objects#updatewebhookrequest/index.html) [UsagePoint](/content/docs/reference/api/objects#usagepoint/index.html) [User](/content/docs/reference/api/objects#user/index.html) [VerificationRecord](/content/docs/reference/api/objects#verificationrecord/index.html) [Warning](/content/docs/reference/api/objects#warning/index.html) [Webhook](/content/docs/reference/api/objects#webhook/index.html) [WebhookDelivery](/content/docs/reference/api/objects#webhookdelivery/index.html) [WebhookHeaderNamesResponse](/content/docs/reference/api/objects#webhookheadernamesresponse/index.html) 100% readTop