Inboxes

Update an inbox

Partially update an inbox's `display_name` and/or `metadata`. At least one field must be supplied. Metadata merges: supplied keys are set, a key with a `null` value is removed, and `metadata: null` clears all metadata. The `email` address is immutable.

PATCH
/inboxes/{inbox_id}

Partially update an inbox's display_name and/or metadata. At least one field must be supplied. Metadata merges: supplied keys are set, a key with a null value is removed, and metadata: null clears all metadata. The email address is immutable.

Authorization

x-api-key<token>

The per-tenant API key. Sent as the x-api-key request header. The key is tenant-scoped.

In: header

Path Parameters

inbox_id*string

The inbox's opaque id (e.g. inb_…).

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Update-inbox body (partial). Supply at least one of display_name or metadata. Metadata merges onto the current map; a null value removes that key, and metadata: null clears all metadata.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X PATCH "https://example.com/inboxes/string" \  -H "Content-Type: application/json" \  -d '{}'
{  "inbox_id": "string",  "email": "user@example.com",  "display_name": "string",  "client_id": "string",  "metadata": {    "property1": "string",    "property2": "string"  },  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z"}
{  "name": "string",  "message": "string"}
{  "name": "string",  "message": "string"}
{  "name": "string",  "message": "string"}
{  "name": "validation",  "errors": {    "property1": "string",    "property2": "string"  }}
{  "name": "string",  "message": "string"}

List inboxes GET

List the inboxes belonging to the authenticated tenant, newest-first by default, with cursor pagination. An account with no inboxes gets an empty list, not an error.

Get an attachment download URL GET

Returns the attachment's metadata plus a short-lived presigned `download_url` — the client fetches the bytes from that URL. The URL expires (`expires_at`); re-call this endpoint to mint a fresh one. Unknown/cross-tenant ids return an indistinguishable `404`.