Mailocity admin API

Find mailboxes of every team

• 200 The mailboxes, as GET .../accounts/{accountId} gives them.

  {
    "items": [
      {
        "address": "carol@acme.test",
        "displayName": "Carol",
        "id": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "role": "member",
        "status": "active",
        "tenantId": "4ee2971f-0fae-4230-8512-ddf1704a769d"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

List the tenant's accounts

• 200 Accounts, oldest first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Create an account

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get an account

• 200 The account.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change an account's name, role, status, password or recovery address

• 200 The updated account.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

A mailbox's API tokens

• 200 The tokens.

  {
    "items": [
      {
        "createdAt": "2026-10-08T12:00:00Z",
        "createdBy": "the platform API key",
        "id": "5d1e2f3a-4b5c-4d6e-8f70-819203a4b5c6",
        "lastUsedAt": null,
        "name": "Zappocity mail",
        "scopes": [
          "send"
        ]
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Make an API token for the mailbox

{
  "name": "Zappocity mail",
  "scopes": [
    "send"
  ]
}

• 201 The token, shown once.

  {
    "createdBy": "the platform API key",
    "id": "5d1e2f3a-4b5c-4d6e-8f70-819203a4b5c6",
    "name": "Zappocity mail",
    "scopes": [
      "send"
    ],
    "token": "cs_mt_Yk3"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Revoke a mailbox API token

• 204 Revoked.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

List an account's app passwords

• 200 The app passwords, oldest first.

  {
    "items": [
      {
        "createdAt": "2026-10-07T09:12:00Z",
        "id": "3f0c9a52-1b7e-4d1a-9c55-0d6f2f1f4a10",
        "lastUsedAt": "2026-10-07T18:40:11Z",
        "name": "Phone"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Revoke one app password

• 204 The app password is revoked.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

A mailbox's calendar subscription links

• 200 The links.

  {
    "items": [
      {
        "calendarId": "K12",
        "calendarName": "Work",
        "createdAt": "2026-10-08T15:00:00Z",
        "detail": "busy",
        "id": "3d0c8e52-7a41-4f7e-b6a1-0c2e9d5f8a34",
        "label": "For clients",
        "lastUsed": "2026-10-08T16:05:00Z"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Revoke a calendar subscription link

• 204 Revoked.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

A user's domain blocks

• 200 The blocks.

  {
    "items": [
      {
        "action": "reject",
        "createdAt": "2026-10-09T12:00:00Z",
        "createdBy": "admin@example.com",
        "id": 7,
        "kind": "mx",
        "note": "Snowshoe spam",
        "value": "bulk-mailer.example"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Block a domain

{
  "action": "reject",
  "kind": "named",
  "note": "Links in the invoice scam",
  "value": "phish.example"
}

• 201 The block.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove a domain block

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

A user's features, from the plan and their own switches

• 200 The plan's entitlements, the user's switches and the result.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Turn features off for one user, or give them more

{
  "off": [
    "imap",
    "forwarding"
  ]
}

• 200 The new state.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Make a link that opens webmail as the user

{
  "reason": "Ticket 4182: filters not working"
}

• 201 The link.

  {
    "expiresAt": "2026-10-08T12:05:00Z",
    "url": "https://webmail.example.com/#impersonate=Qm1..."
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

A user's imports from other mail servers, newest first

• 200 The imports.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Import a user's mail from another server over IMAP

{
  "host": "imap.gmail.com",
  "password": "app password",
  "skipFolders": [
    "[Gmail]/Spam"
  ],
  "username": "amy@gmail.com"
}

• 201 Queued.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Cancel a queued or running import

• 204 Cancelled.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

Export an account's records for a lawful request

{
  "caseReference": "Subpoena 2026-117",
  "from": "2026-01-01",
  "include": [
    "account",
    "logins",
    "messages",
    "content"
  ],
  "to": "2026-10-01"
}

• 200 The ZIP file.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Show one user's limits and usage

• 200 The user's limits.

  {
    "effective": {
      "maxMessageBytes": 26214400,
      "maxRecipients": 100,
      "quotaBytes": 5368709120,
      "sendPerDay": 1000,
      "sendPerHour": 50
    },
    "overrides": {
      "maxMessageBytes": null,
      "maxRecipients": null,
      "quotaBytes": null,
      "sendPerDay": null,
      "sendPerHour": 50
    },
    "plan": "team",
    "planLimits": {
      "maxMessageBytes": 26214400,
      "maxRecipients": 100,
      "quotaBytes": 5368709120,
      "sendPerDay": 1000,
      "sendPerHour": 200
    },
    "usage": {
      "sentLastDay": 140,
      "sentLastHour": 12,
      "storageBytes": 73400320
    }
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Set one user's own limits

• 200 The user's limits after the change.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Lift a lockout

• 204 Unlocked; the failure count starts again.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

A user's sign-in attempts, newest first

• 200 The attempts.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Resume a mailbox's sending after a pause for complaints

• 204 Resumed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

A user's open webmail sessions

• 200 The sessions, last used first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Sign a user out of webmail everywhere

• 204 Signed out.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Who a mailbox is shared with

• 200 The shares.

  {
    "items": [
      {
        "access": "send",
        "createdAt": "2026-10-08T15:00:00Z",
        "grantee": "assistant@acme.test",
        "granteeId": "6f1c2a9e-1b7d-4f0e-9a3c-2d8b5e4f7a10",
        "granteeName": "Sam",
        "owner": "boss@acme.test"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Share a mailbox with a teammate, or change how

{
  "access": "write"
}

• 200 The share.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Stop sharing a mailbox with a teammate

• 204 No longer shared.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

What the checks found when the account signed up

• 200 The report, or {"checked":false}.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

A user's own spam threshold and sender lists

• 200 The policy; empty when none is set.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Replace a user's own spam threshold and sender lists

{
  "allow": [
    "newsletter.example"
  ],
  "junkScore": 4
}

• 200 The new policy.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Recipients who complained about a mailbox's mail

• 200 The recipients.

  {
    "items": [
      {
        "createdAt": "2026-10-09T03:00:00Z",
        "reason": "complaint",
        "recipient": "carol@example.net"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Let a mailbox mail a recipient who complained again

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Turn off an account's two-step sign-in

• 204 Two-step sign-in is off.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Mark an account verified by hand, or take that away

{
  "note": "Called the customer on their number on file.",
  "verified": true
}

• 200 The account.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The signed-in administrator and the session's CSRF token

• 200 The session.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Sign an administrator in to the admin panel

{
  "email": "ops@example.com",
  "password": "a long passphrase"
}

• 201 Signed in. The response sets the session cookie.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 415 The body is not JSON.
• 429 Too many failed sign-ins.

Sign out

• 204 Signed out.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 The CSRF token is missing or wrong.

Which ways of signing in to the panel are open

• 200 Whether Sign in with Zappocity is offered, and whether passwords still work.

  {
    "passwordSignin": true,
    "sso": true
  }

Where Zappocity sends the browser back

• 302 To /admin, signed in; or to /admin#sso-error=... (expired, unverified, not-staff, unavailable).

Sign in to the panel with Zappocity

• 302 To Zappocity

List the tenant's aliases

• 200 Aliases by address.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Add an alias address for an account

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove an alias

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Place a legal hold on one user's archived mail

{
  "reason": "Smith v. Example, preserve from 2026-03"
}

• 200 The hold.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Lift a user's legal hold

• 204 Lifted (or there was none).
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Search the archive

• 200 Matching messages.

  {
    "items": [
      {
        "accountId": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "address": "sam@example.com",
        "archivedAt": "2026-10-08T12:00:00Z",
        "direction": "out",
        "expiresAt": "2033-10-07T12:00:00Z",
        "from": "sam@example.com",
        "id": 912,
        "messageId": "abc@example.com",
        "rcpts": [
          "buyer@example.org"
        ],
        "size": 4210,
        "subject": "Quote",
        "tenantId": "4f1c2d3e-1111-4a2b-9c3d-5e6f7a8b9c0d"
      }
    ]
  }

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Who searched, downloaded or changed the archive

• 200 Newest first.

  {
    "items": [
      {
        "action": "search",
        "at": "2026-10-08T12:00:00Z",
        "by": "owner@example.com",
        "detail": "q=\"quote\" address=\"\" direction=\"\" from=\"\" to=\"\" results=3",
        "id": 41
      }
    ]
  }

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Archiving settings, size and holds

• 200 The settings, how much is archived, and the users on hold.

  {
    "accountHolds": [
      {
        "accountId": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "address": "sam@example.com",
        "by": "owner@example.com",
        "createdAt": "2026-10-08T12:00:00Z",
        "platform": false,
        "reason": "Smith v. Example, preserve from 2026-03"
      }
    ],
    "bytes": 734003200,
    "messages": 18230,
    "oldest": "2026-01-04T09:12:00Z",
    "settings": {
      "enabled": true,
      "entitled": true,
      "hold": false,
      "holdBy": "",
      "holdPlatform": false,
      "holdReason": "",
      "retentionDays": 2555,
      "updatedAt": "2026-10-08T12:00:00Z"
    }
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Turn archiving on or off, set retention, place or lift a team-wide hold

{
  "enabled": true,
  "retentionDays": 3650
}

• 200 The new settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Download an archived message

• 200 The message.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

DMARC aggregate reports received for a shared domain

• 200 Reports.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

One DMARC report with its rows

• 200 The report; records are sorted by message count, largest first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Sending sources seen in DMARC reports for a shared domain

• 200 The summary.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

DMARC aggregate reports received for one of the tenant's domains

• 200 Reports.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

One DMARC report with its rows

• 200 The report; records are sorted by message count, largest first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Sending sources seen in DMARC reports for one of the tenant's domains

• 200 The summary.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Make a shared domain a team's own

• 200 The domain
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The team is at its domain limit.
• 422 Addresses on the domain belong to other teams.

Check the domain's DNS records

• 200 The check.

  {
    "checkedAt": "2026-10-09T12:00:00Z",
    "ok": false,
    "records": [
      {
        "found": [
          "10 mx.zappo.city."
        ],
        "name": "example.com",
        "priority": 10,
        "purpose": "Deliver mail for the domain to this server",
        "status": "ok",
        "type": "MX",
        "value": "mx.zappo.city."
      },
      {
        "found": [
          "v=DMARC1; p=none"
        ],
        "name": "_dmarc.example.com",
        "purpose": "DMARC",
        "status": "wrong",
        "type": "TXT",
        "value": "v=DMARC1; p=quarantine"
      },
      {
        "found": [],
        "name": "_jmap._tcp.example.com",
        "optional": true,
        "purpose": "JMAP discovery",
        "status": "missing",
        "type": "SRV",
        "value": "0 1 443 mx.zappo.city."
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

The team's open domain offers, made and received

• 200 The offers
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Withdraw (the giving team) or decline (the receiving team) an offer

• 204 Gone.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Take a domain offered to the team

• 200 The domain
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 A team is not in good standing, the domain is in use, or the team is at its domain limit.

List the tenant's domains

• 200 Domains by name.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Add a domain to the tenant without DNS proof

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get one of the tenant's domains and its settings

• 200 The domain.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change a domain's settings

• 200 The updated domain.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The domain's BIMI logo

• 200 The logo's state.

  {
    "dmarcNote": "",
    "dmarcReady": true,
    "domain": "example.com",
    "hasCertificate": false,
    "hasLogo": true,
    "logoUrl": "https://mailo.city/bimi/example.com.svg",
    "record": {
      "name": "default._bimi.example.com",
      "purpose": "BIMI: the brand logo receivers may show next to the domain's mail",
      "type": "TXT",
      "value": "v=BIMI1; l=https://mailo.city/bimi/example.com.svg; a="
    },
    "updatedAt": "2026-10-09T04:00:00Z"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Set the domain's BIMI logo

{
  "svg": "\u003csvg xmlns=\"http://www.w3.org/2000/svg\" version=\"1.2\" baseProfile=\"tiny-ps\" viewBox=\"0 0 100 100\"\u003e\u003ctitle\u003eExample\u003c/title\u003e\u003ccircle cx=\"50\" cy=\"50\" r=\"40\" fill=\"#06c\"/\u003e\u003c/svg\u003e"
}

• 200 The logo's state.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove the domain's BIMI logo

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Check the published BIMI record

• 200 The check.

  {
    "dmarcNote": "",
    "dmarcReady": true,
    "expected": "v=BIMI1; l=https://mailo.city/bimi/example.com.svg; a=",
    "matches": true,
    "published": "v=BIMI1; l=https://mailo.city/bimi/example.com.svg; a="
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

List the DKIM keys of one of the tenant's domains

• 200 Keys.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Create a DKIM key for a rotation

{
  "algorithm": "rsa"
}

• 201 The key.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a pending or retired key

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

Make a key the one that signs

• 200 The key, now active.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

DNS records the tenant must publish

• 200 Records to publish, as JSON or a zone file.

  "; DNS records for example.com, made by Zappocity on 2026-10-07 15:49 UTC.\n$ORIGIN example.com.\n$TTL 3600\n\n; Deliver mail for the domain to this server\n@\t3600\tIN\tMX\t10 mx.zappocity.example.\n"

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Check the domain's DNS records

• 200 The check.

  {
    "checkedAt": "2026-10-09T12:00:00Z",
    "ok": false,
    "records": [
      {
        "found": [
          "10 mx.zappo.city."
        ],
        "name": "example.com",
        "priority": 10,
        "purpose": "Deliver mail for the domain to this server",
        "status": "ok",
        "type": "MX",
        "value": "mx.zappo.city."
      },
      {
        "found": [
          "v=DMARC1; p=none"
        ],
        "name": "_dmarc.example.com",
        "purpose": "DMARC",
        "status": "wrong",
        "type": "TXT",
        "value": "v=DMARC1; p=quarantine"
      },
      {
        "found": [],
        "name": "_jmap._tcp.example.com",
        "optional": true,
        "purpose": "JMAP discovery",
        "status": "missing",
        "type": "SRV",
        "value": "0 1 443 mx.zappo.city."
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Move a domain to another team at once (staff)

• 200 The domain
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 A team is not in good standing, the domain is in use, or the receiving team is at its domain limit.

Check the domain's MTA-STS from outside

• 200 What was found; an empty `problems` means all is well.

  {
    "fetched": true,
    "maxAge": 604800,
    "mode": "enforce",
    "mx": [
      "mx.example.com"
    ],
    "problems": [],
    "recordFound": true,
    "recordId": "20261008T120000"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Mark a domain proved by hand

• 200 The domain.

  {
    "name": "zappo.city",
    "tenantId": "4ee2971f-0fae-4230-8512-ddf1704a769d",
    "verifiedAt": "2026-10-09T02:10:00Z"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Offer a domain to another team

{
  "to": "owner@other.example"
}

• 201 The offer.

  {
    "createdAt": "2026-10-09T12:00:00Z",
    "domain": "example.com",
    "expiresAt": "2026-10-23T12:00:00Z",
    "fromTeam": "Acme",
    "fromTenantId": "8b30...",
    "id": "2f4c...",
    "offeredBy": "boss@acme.example",
    "toTeam": "Other",
    "toTenantId": "51aa..."
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 A team is not in good standing, or the domain still has mailboxes or aliases.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Prove a domain added without proof

• 200 The domain
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 The record is not there yet.

Domains waiting for their proof record

• 200 Pending domains by name.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Ask for a domain that DNS must prove first

• 201 The record to publish.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Drop a pending domain request

• 204 Dropped.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Check the proof record and add the domain

• 201 The new domain.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

List invitation links

• 200 The invitations.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Make invitation links

{
  "count": 5,
  "note": "beta testers",
  "plan": "free",
  "validDays": 7
}

• 201 The new invitations, each with its link.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Cancel an unused invitation link

• 204 Cancelled.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Show a user's invitations to give

• 200 The allowance.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Set, add to or reset a user's invitations

• 200 The new allowance.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The team's invitation links, newest first

• 200 The links.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Make a link to join the team

{
  "days": 30,
  "maxUses": 5,
  "note": "New starters"
}

• 201 The link.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Stop a link working

• 204 Revoked.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Get the shared domain rules

• 200 The rules; an empty script means none.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Replace the shared domain rules

• 200 The rules as saved.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Check a Sieve script

{
  "script": "require \"fileinto\";\nif header :contains \"subject\" \"invoice\" { fileinto \"Invoices\"; }"
}

• 200 Whether the script compiles.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

List an account's filter scripts

• 200 The scripts by name, with their content.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Add a filter script to an account

{
  "active": true,
  "name": "Newsletters",
  "script": "require \"fileinto\";\nif exists \"list-id\" { fileinto \"Newsletters\"; }"
}

• 201 The script.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get one of an account's filter scripts

• 200 The script.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Rename, replace, turn on or turn off a filter script

• 200 The script.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a filter script

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

Get the domain rules

• 200 The rules; an empty script means none.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Replace the domain rules

• 200 The rules as saved.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get the tenant rules

• 200 The rules; an empty script means none.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Replace the tenant rules

• 200 The rules as saved.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Mail to other domains still in the queue

• 200 Queue entries, oldest message first (at most 1000).
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

The entitlements a plan can switch on

• 200 The catalogue.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

List plans

• 200 Plans by sort order.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Add a plan

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get a plan

• 200 The plan.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change a plan's name, limits, entitlements or availability

• 200 The updated plan.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove a plan no tenant is on

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

Captcha and signup address checks

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change the captcha and signup address checks

{
  "action": "review",
  "captchaProvider": "pow",
  "ipqsEnabled": true,
  "ipqsKey": "...",
  "ipqsMaxScore": 85
}

• 200 The new settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Run the signup checks on an address

• 200 What each check found and the verdict.

  {
    "ip": "203.0.113.5",
    "ipqs": {
      "asn": 64500,
      "country": "NL",
      "fraudScore": 97,
      "isp": "Hosting",
      "proxy": true,
      "tor": false,
      "vpn": false
    },
    "network": {
      "asn": 64500,
      "entity": "Example Hosting"
    },
    "reasons": [
      "IPQualityScore fraud score 97 (limit 85)"
    ],
    "verdict": "review"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Complaints from providers' feedback loops, and complaint rates

• 200 Complaints and rates.

  {
    "items": [
      {
        "accountId": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "address": "bob@acme.test",
        "feedbackType": "abuse",
        "id": 7,
        "messageId": "m1@acme.test",
        "receivedAt": "2026-10-09T03:00:00Z",
        "recipient": "carol@example.net",
        "reporter": "Yahoo!-Mail-Feedback/2.0",
        "tenantId": "4ee2971f-0fae-4230-8512-ddf1704a769d"
      }
    ],
    "rates": [
      {
        "accountId": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "address": "bob@acme.test",
        "complaints": 4,
        "permille": 4.4,
        "sendingPausedAt": "2026-10-09T03:00:01Z",
        "sent": 900,
        "tenantId": "4ee2971f-0fae-4230-8512-ddf1704a769d"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

The platform's domain blocks

• 200 The blocks.

  {
    "items": [
      {
        "action": "reject",
        "createdAt": "2026-10-09T12:00:00Z",
        "createdBy": "admin@example.com",
        "id": 7,
        "kind": "mx",
        "note": "Snowshoe spam",
        "value": "bulk-mailer.example"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Block a domain

{
  "action": "reject",
  "kind": "named",
  "note": "Links in the invoice scam",
  "value": "phish.example"
}

• 201 The block.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove a domain block

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

The abuse feedback loop's settings

• 200 The settings.

  {
    "address": "fbl@mailo.city",
    "minSent": 200,
    "pausePermille": 3
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change the feedback loop's settings

{
  "address": "fbl@mailo.city",
  "pausePermille": 3
}

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Greylisting times and the platform's IP allowlist

• 200 The settings.

  {
    "delaySeconds": 300,
    "ipAllowlist": [
      "198.51.100.0/24",
      "2001:db8:1::/48"
    ],
    "passDays": 36,
    "retryHours": 24
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change greylisting times and the platform's IP allowlist

{
  "ipAllowlist": [
    "192.0.2.10",
    "198.51.100.0/24"
  ]
}

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The audit log of legal exports, newest first

• 200 The exports.

  {
    "items": [
      {
        "accountAddress": "alice@acme.com",
        "bytes": 182211,
        "caseReference": "Subpoena 2026-117",
        "createdAt": "2026-10-08T15:00:00Z",
        "id": "6c1d...",
        "note": "",
        "requestedBy": "ops@example.com",
        "scope": {
          "from": "2026-01-01T00:00:00Z",
          "include": [
            "account",
            "messages"
          ],
          "to": "2026-10-01T00:00:00Z"
        },
        "sha256": "9f2c..."
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Search the mail log

• 200 The lines.

  {
    "items": [
      {
        "at": "2026-10-09T12:00:01Z",
        "id": 912,
        "line": "2026-10-09 12:00:01 1u2v3w-00AbCd-Xy =\u003e bob@example.net H=mx.example.net R=dnslookup T=remote_smtp",
        "log": "main",
        "messageId": "1u2v3w-00AbCd-Xy"
      },
      {
        "at": "2026-10-09T12:00:00Z",
        "id": 911,
        "line": "2026-10-09 12:00:00 1u2v3w-00AbCd-Xy \u003c= alice@example.com H=client.example [192.0.2.1] P=esmtpsa A=plain:alice@example.com S=1234 id=\u003cx@y\u003e",
        "log": "main",
        "messageId": "1u2v3w-00AbCd-Xy"
      }
    ],
    "next": 911
  }

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

How long the mail log is kept for searching

• 200 The settings.

  {
    "days": 30
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change how long the mail log is kept

{
  "days": 90
}

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

MTA-STS defaults and how sent mail follows other domains' policies

• 200 The settings.

  {
    "defaultMaxAge": 604800,
    "defaultMode": "testing",
    "outbound": "follow",
    "updatedAt": "2026-10-08T12:00:00Z"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change MTA-STS defaults and the handling of sent mail

{
  "defaultMode": "enforce"
}

• 200 The new settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

How Mailocity sends its notices

• 200 The setting.

  {
    "accountId": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
    "address": "noreply@mailo.city",
    "hasJmapToken": true,
    "hasSmtpPassword": false,
    "jmapUrl": "",
    "mode": "jmap",
    "smtpHost": "",
    "smtpPort": 587,
    "smtpSecurity": "starttls",
    "smtpUsername": ""
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change how Mailocity sends its notices

• 200 The setting.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Send a test notice

• 200 Whether it went, and the error if not.

  {
    "error": "signing in to mailo.city: 535 authentication failed",
    "ok": false
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Lockout, sign-in history and alert settings

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change lockout, sign-in history and alert settings

{
  "historyDays": 180,
  "lockoutMinutes": 30,
  "lockoutThreshold": 8
}

• 200 The new settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Platform-wide signup and webmail settings

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change signups, their limits and the webmail host

• 200 The updated settings.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

List the platform's shared domains

• 200 Shared domains by name.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Add a shared domain

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get a shared domain

• 200 The domain.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change a shared domain's settings

• 200 The updated domain.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove a shared domain nobody has an address on

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

The domain's BIMI logo

• 200 The logo's state.

  {
    "dmarcNote": "",
    "dmarcReady": true,
    "domain": "example.com",
    "hasCertificate": false,
    "hasLogo": true,
    "logoUrl": "https://mailo.city/bimi/example.com.svg",
    "record": {
      "name": "default._bimi.example.com",
      "purpose": "BIMI: the brand logo receivers may show next to the domain's mail",
      "type": "TXT",
      "value": "v=BIMI1; l=https://mailo.city/bimi/example.com.svg; a="
    },
    "updatedAt": "2026-10-09T04:00:00Z"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Set the domain's BIMI logo

{
  "svg": "\u003csvg xmlns=\"http://www.w3.org/2000/svg\" version=\"1.2\" baseProfile=\"tiny-ps\" viewBox=\"0 0 100 100\"\u003e\u003ctitle\u003eExample\u003c/title\u003e\u003ccircle cx=\"50\" cy=\"50\" r=\"40\" fill=\"#06c\"/\u003e\u003c/svg\u003e"
}

• 200 The logo's state.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove the domain's BIMI logo

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Check the published BIMI record

• 200 The check.

  {
    "dmarcNote": "",
    "dmarcReady": true,
    "expected": "v=BIMI1; l=https://mailo.city/bimi/example.com.svg; a=",
    "matches": true,
    "published": "v=BIMI1; l=https://mailo.city/bimi/example.com.svg; a="
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

List the DKIM keys of a shared domain

• 200 Keys.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Create a DKIM key for a rotation

{
  "algorithm": "rsa"
}

• 201 The key.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a pending or retired key

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

Make a key the one that signs

• 200 The key, now active.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

DNS records a shared domain must publish

• 200 Records to publish, as JSON or a zone file.

  "; DNS records for example.com, made by Zappocity on 2026-10-07 15:49 UTC.\n$ORIGIN example.com.\n$TTL 3600\n\n; Deliver mail for the domain to this server\n@\t3600\tIN\tMX\t10 mx.zappocity.example.\n"

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Check the domain's MTA-STS from outside

• 200 What was found; an empty `problems` means all is well.

  {
    "fetched": true,
    "maxAge": 604800,
    "mode": "enforce",
    "mx": [
      "mx.example.com"
    ],
    "problems": [],
    "recordFound": true,
    "recordId": "20261008T120000"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Spam and phishing reports from every tenant, newest first

• 200 The reports.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

The Rspamd connection and the platform's spam thresholds

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change the Rspamd connection or the platform's thresholds

{
  "enabled": true,
  "junkScore": 6,
  "password": "controller password",
  "rejectScore": 15,
  "url": "http://127.0.0.1:11334"
}

• 200 The new settings.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Check the saved Rspamd connection

• 200 What was found; `error` says what failed.

  {
    "millis": 3,
    "passwordOk": true,
    "reachable": true,
    "version": "3.9.1"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Single sign-on through Zappocity

• 200 The settings.

  {
    "adminPasswordSignin": true,
    "clientId": "mailocity",
    "enabled": true,
    "hasClientSecret": true,
    "issuer": "https://zappo.city",
    "webmailPasswordSignin": true
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change single sign-on, or turn the password sign-ins off

{
  "webmailPasswordSignin": false
}

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Connect to the Zappocity on this server

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 503 Zappocity is not in this process.

The panel's administrators and their permissions

• 200 Staff, and the permission catalogue.

  {
    "items": [
      {
        "disabled": false,
        "email": "help@example.com",
        "id": "2b1f...",
        "name": "Helper",
        "permissions": [
          "read",
          "tenants",
          "reports"
        ]
      }
    ],
    "permissions": [
      "read",
      "tenants",
      "approvals",
      "reports",
      "plans",
      "settings",
      "legal",
      "staff",
      "impersonate"
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.

Add a panel administrator

{
  "email": "help@example.com",
  "name": "Helper",
  "password": "a long password",
  "permissions": [
    "read",
    "tenants",
    "reports",
    "impersonate"
  ]
}

• 201 Added.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Change a staff member's name, permissions, password or status

• 200 Changed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

A team's complaints and complaint rates

• 200 Complaints and rates.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

A team's domain blocks

• 200 The blocks.

  {
    "items": [
      {
        "action": "reject",
        "createdAt": "2026-10-09T12:00:00Z",
        "createdBy": "admin@example.com",
        "id": 7,
        "kind": "mx",
        "note": "Snowshoe spam",
        "value": "bulk-mailer.example"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Block a domain

{
  "action": "reject",
  "kind": "named",
  "note": "Links in the invoice scam",
  "value": "phish.example"
}

• 201 The block.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove a domain block

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

A team's IP allowlist

• 200 The networks.

  {
    "items": [
      "203.0.113.10/32",
      "198.51.100.0/24"
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Replace a team's IP allowlist

{
  "items": [
    "203.0.113.10",
    "198.51.100.0/24"
  ]
}

• 200 The networks
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

A team's limits

• 200 The limits.

  {
    "effective": {
      "maxAliases": 100,
      "maxAliasesPerUser": 10,
      "maxDomains": 10,
      "maxMessageBytes": 26214400,
      "maxRecipients": 100,
      "maxSharedAliasesPerUser": 10,
      "maxUsers": 50,
      "quotaBytes": -1,
      "sendPerDay": -1,
      "sendPerHour": -1
    },
    "overrides": {
      "maxAliases": null,
      "maxAliasesPerUser": null,
      "maxDomains": null,
      "maxMessageBytes": null,
      "maxRecipients": null,
      "maxSharedAliasesPerUser": null,
      "quotaBytes": -1,
      "sendPerDay": -1,
      "sendPerHour": -1
    },
    "plan": "team",
    "planLimits": {
      "maxAliases": 100,
      "maxAliasesPerUser": 10,
      "maxDomains": 10,
      "maxMessageBytes": 26214400,
      "maxRecipients": 100,
      "maxSharedAliasesPerUser": 10,
      "maxUsers": 50,
      "quotaBytes": 32212254720,
      "sendPerDay": 1000,
      "sendPerHour": 200
    },
    "seatLimit": -1
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Replace a team's own limits

{
  "quotaBytes": -1,
  "sendPerDay": -1,
  "sendPerHour": -1
}

• 200 The limits
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Search a team's mail log

• 200 The lines.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Internal notes on a user

• 200 Newest first.

  {
    "items": [
      {
        "author": "help@example.com",
        "body": "Sent spam on 8 Oct; watch.",
        "createdAt": "2026-10-08T12:00:00Z",
        "id": 3,
        "scope": "staff"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Add an internal note on a user

• 201 Added.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

A tenant's tickets

• 200 The tickets.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Open a ticket

{
  "accountId": "3d05579f-ed2b-40c4-a5a7-5a3717b216ec",
  "body": "We saw 4000 messages in an hour.",
  "kind": "abuse",
  "subject": "Spam sent from your account"
}

• 201 The ticket.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

A ticket and its messages

• 200 The ticket and messages, oldest first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Change a ticket's status, priority, queue, assignee or kind

• 200 The ticket.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Reply, or add an internal note

• 204 Added.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The platform support queue

• 200 The tickets.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

List tenants

• 200 Tenants, oldest first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Create a tenant

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get a tenant

• 200 The tenant.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Rename, resize, suspend or reactivate a tenant

• 200 The updated tenant.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The team's API keys (never the keys themselves)

• 200 The keys.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Make an API key for the team

{
  "name": "HR sync"
}

• 201 The key, shown this once.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Revoke an API key

• 204 Revoked; requests with it answer 401 at once.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Approve a signup that waits for approval

• 200 The tenant.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Reject a signup

• 200 The tenant.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

The team's spam thresholds and sender lists

• 200 The policy; empty when none is set.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Replace the team's spam thresholds and sender lists

{
  "allow": [
    "partner.example"
  ],
  "block": [
    "spammy.example",
    "someone@bad.example"
  ],
  "junkScore": 5,
  "rejectScore": 12
}

• 200 The new policy.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The team's spam and phishing reports, newest first

• 200 The reports.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

One report

• 200 The report.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Resolve or reopen a report, or change its note

{
  "note": "Blocked the sender's domain for the team.",
  "status": "resolved"
}

• 200 The report.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The reported message, as an .eml file to save

• 200 The message as received (up to 10 MiB).
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Move every copy of the reported message in the team to Junk

• 200 How many copies were moved, and the report.

  {
    "moved": 4,
    "report": {
      "id": "6f1e...",
      "kind": "phishing",
      "quarantined": 4
    }
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

The team's joining, welcome and page settings

• 200 The settings, with the join page's address.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Change the team's joining, welcome and page settings

{
  "accent": "#1a73e8",
  "signupDomain": "acme.com",
  "welcomeBody": "Hi {name}, your address is {address}.",
  "welcomeEnabled": true
}

• 200 The new settings.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

What the tenant uses against its plan

• 200 Counts and the plan's limits.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Get an account's vacation response

• 200 The vacation response.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Set an account's vacation response

{
  "fromDate": "2026-12-20T00:00:00Z",
  "htmlBody": null,
  "isEnabled": true,
  "subject": "Out of office",
  "textBody": "I am away until 4 January and will reply when I am back.",
  "toDate": "2027-01-04T00:00:00Z"
}

• 200 The vacation response as stored.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.