Zappocity account API

Whether the account is to be deleted

• 200 The deletion state.

  {
    "confirmWith": "password",
    "deleteAfter": null
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Delete my Zappocity account

• 202 Scheduled.

  {
    "deleteAfter": "2026-10-23T12:00:00Z",
    "status": "active"
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Wrong password or email
• 409 Refused, with the reason in detail: the only owner of an organization, or a mailbox under a legal hold or its team's last owner.

Keep my Zappocity account (and the mailboxes scheduled with it)

• 204 No longer to be deleted.
• 401 Not signed in, or the CSRF token is missing or wrong.

Make a supporto.city help desk

{
  "name": "Acme Support"
}

• 201 The desk.

  {
    "name": "Acme Support",
    "slug": "acme-support",
    "url": "https://acme-support.supporto.city/support"
  }

• 400 Not JSON, or unknown fields.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 The email is not confirmed.
• 409 Too many desks.
• 422 A value is not acceptable, such as a password under 12 characters.

The person's invitation link and the invitations they sent

• 200 The link and invitations.

  {
    "items": [
      {
        "email": "bob@example.com",
        "joined": true,
        "sentAt": "2026-10-08T12:00:00Z"
      }
    ],
    "joined": 1,
    "link": "https://zappo.city/account#signup\u0026invite=k3j9m2xp4q"
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Email an invitation

{
  "email": "bob@example.com"
}

• 204 Sent.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 The person's own address is not confirmed.
• 409 That address already has an account.
• 422 Not an email address
• 429 Enough invitations for today.

The account and its organizations

• 200 The account.

  {
    "orgs": [
      {
        "orgId": "0f9e8d7c-6b5a-4c3d-2e1f-0a9b8c7d6e5f",
        "orgName": "Acme",
        "role": "owner",
        "subscriptions": [
          {
            "period": "year",
            "plan": "team",
            "product": "mailocity",
            "status": "active"
          }
        ]
      }
    ],
    "person": {
      "email": "amy@example.com",
      "emailVerifiedAt": "2026-10-08T12:00:00Z",
      "id": "6c1f0b7e-2d4a-4b8e-9f3c-1a2b3c4d5e6f",
      "name": "Amy",
      "number": 17
    }
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Change your name

• 200 The account.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 422 A value is not acceptable, such as a password under 12 characters.

An organization's balance, history and invoices

• 200 The billing.

  {
    "billing": {
      "autoPay": true,
      "balanceCents": 2500,
      "free": false
    },
    "invoices": [],
    "ledger": [],
    "org": {
      "name": "Acme"
    }
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 Not an organization whose billing you handle.

Pay invoices automatically, or not

• 200 The billing profile.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 Not an organization whose billing you handle.

The organization's coupons

• 200 The redemptions.

  {
    "items": [
      {
        "active": true,
        "by": "pat@acme.test",
        "coupon": {
          "code": "WELCOME20",
          "description": "20% off your first three months",
          "kind": "percent",
          "percentOff": 20
        },
        "discountCents": 200,
        "endReason": null,
        "endedAt": null,
        "endsAt": "2027-01-09T12:00:00Z",
        "id": "0b8e5f43-2d6c-4c55-8f1e-7c9a3e2d1b00",
        "invoices": 1,
        "invoicesLeft": null,
        "redeemedAt": "2026-10-09T12:00:00Z"
      }
    ]
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such organization

Redeem a code

{
  "code": "WELCOME20"
}

• 201 The redemption.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Missing or wrong X-CSRF-Token header.
• 404 No such code (or organization).
• 409 Refused, with the reason in detail (expired, used up, first order only...).
• 429 Too many wrong codes.

One invoice with its lines

• 200 The invoice.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such invoice of this organization.

Pay an open invoice now

• 200 Where to go.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such invoice of this organization.
• 409 The invoice has nothing to pay.
• 503 Card payments are not set up.

Save a payment method

• 200 Where to go.

  {
    "url": "https://checkout.stripe.com/c/pay/cs_..."
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 Not an organization whose billing you handle.
• 503 Card payments are not set up.

Remove the saved payment method

• 204 Removed.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 Not an organization whose billing you handle.
• 503 Card payments are not set up.

Change a self-serve subscription's plan, seats or billing period

• 200 The subscription.
• 400 Not JSON, or unknown fields.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Not an owner or billing member.
• 404 No such subscription here.
• 409 Refused

Change your password

• 204 Changed.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 The current password is not right (it counts as a failed sign-in).
• 422 A value is not acceptable, such as a password under 12 characters.

A product's plans and prices

• 200 Its active plans.

  {
    "currency": "USD",
    "plans": [
      {
        "active": true,
        "code": "team",
        "features": [
          "help_center",
          "sla"
        ],
        "limits": {
          "agents": -1,
          "agentsBySeats": 1,
          "queues": -1
        },
        "name": "Team",
        "perSeat": true,
        "prices": {
          "month": 2280,
          "year": 22800
        }
      }
    ]
  }

• 404 Not a self-serve product.

The person's points, their history and what the program gives

• 200 The points.

  {
    "items": [
      {
        "at": "2026-10-09T12:00:00Z",
        "balance": 520,
        "by": "Zappocity loyalty",
        "description": "Referral: bob@example.com became a customer",
        "id": 7,
        "kind": "referral",
        "points": 500,
        "reference": ""
      }
    ],
    "points": 520,
    "program": {
      "enabled": true,
      "invitations": true,
      "inviteCostPoints": 100,
      "inviteUsedPoints": 20,
      "minRedeemPoints": 500,
      "pointValue": 100,
      "pointsPerDollar": 1,
      "referralPoints": 500,
      "welcomePoints": 200
    }
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Turn points into credit for an organization

{
  "orgId": "3c1d9a7e-55b2-4b8e-9e1f-0a2b3c4d5e6f",
  "points": 500
}

• 201 The points entry and the credit entry.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Missing or wrong X-CSRF-Token header.
• 404 No such organization
• 409 Refused, with the reason in detail: the program is off, fewer than minRedeemPoints, or not enough points.

Get more Mailocity invitations for points

{
  "count": 2
}

• 201 The points entry and how many invitations the mailbox now has.

  {
    "entry": {
      "balance": 320,
      "kind": "invitations",
      "points": -200
    },
    "invitationsLeft": 3
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Missing or wrong X-CSRF-Token header.
• 409 Refused, with the reason in detail: not offered, not enough points, or no Mailocity mailbox (the points are given back).

The person's profile and badges

• 200 The profile and badges.

  {
    "badges": [
      {
        "color": "success",
        "icon": "star",
        "key": "early-adopter",
        "name": "Early adopter",
        "rule": "early_adopter"
      }
    ],
    "profile": {
      "bio": "Support lead",
      "createdAt": "2026-10-09T12:00:00Z",
      "handle": "pat",
      "name": "Pat Lee",
      "personId": "19adb6dd-1eac-4d74-8134-2668d30e9561",
      "pronouns": "they/them",
      "visible": true,
      "website": "https://pat.example"
    }
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Change the profile

{
  "bio": "Support lead",
  "handle": "pat",
  "name": "Pat Lee",
  "pronouns": "they/them",
  "visible": true,
  "website": "https://pat.example"
}

• 200 The profile and badges.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Missing or wrong X-CSRF-Token header.
• 409 That handle is taken.
• 422 A value is not valid.

Someone's visible profile

• 200 The profile and the badges that show.

  {
    "badges": [
      {
        "color": "primary",
        "icon": "user",
        "key": "staff",
        "name": "Staff",
        "rule": "staff"
      }
    ],
    "bio": "Support lead",
    "handle": "pat",
    "name": "Pat Lee",
    "pronouns": "they/them",
    "visible": true
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such visible profile.

Whether sign-ins from new devices are emailed

• 200 The setting.

  {
    "newSignIn": true
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Turn sign-in alerts on or off

{
  "newSignIn": false
}

• 200 The setting.
• 401 Not signed in, or the CSRF token is missing or wrong.

The account's security keys and passkeys

• 200 The keys.

  {
    "items": [
      {
        "createdAt": "2026-10-08T12:00:00Z",
        "id": "q8V2...",
        "lastUsed": "2026-10-09T08:30:00Z",
        "name": "YubiKey 5C",
        "passkey": false
      }
    ]
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Finish adding a key or passkey

{
  "challengeId": "5b0b4c1e-7d1a-4f5e-9a3b-1c2d3e4f5a6b",
  "credential": {
    "id": "q8V2...",
    "rawId": "q8V2...",
    "response": {
      "attestationObject": "o2Nm...",
      "clientDataJSON": "eyJ0..."
    },
    "type": "public-key"
  },
  "name": "YubiKey 5C"
}

• 201 Added.

  {
    "id": "q8V2...",
    "name": "YubiKey 5C",
    "passkey": false,
    "recoveryCodes": [
      "k3j9-2mxp",
      "..."
    ]
  }

• 400 The challenge expired or was used.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 409 The key is already registered
• 422 The key's answer did not check out.

Start adding a key or passkey

{
  "currentPassword": "correct horse battery",
  "passkey": true
}

• 200 The options.

  {
    "challengeId": "5b0b4c1e-7d1a-4f5e-9a3b-1c2d3e4f5a6b",
    "options": {
      "publicKey": {
        "challenge": "Wm9...",
        "pubKeyCredParams": [
          {
            "alg": -7,
            "type": "public-key"
          }
        ],
        "rp": {
          "id": "zappo.city",
          "name": "Zappocity"
        }
      }
    }
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Wrong password.

Rename a key

{
  "name": "Backup YubiKey"
}

• 204 Renamed.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such key.

Remove a key or passkey

{
  "currentPassword": "correct horse battery"
}

• 204 Removed.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Wrong password.
• 404 No such key.

Where you are signed in

• 200 Most recently used first.

  {
    "items": [
      {
        "createdAt": "2026-10-08T12:00:00Z",
        "current": true,
        "expiresAt": "2026-11-07T12:00:00Z",
        "id": 4,
        "ip": "203.0.113.9",
        "lastSeen": "2026-10-08T12:30:00Z",
        "userAgent": "Firefox"
      }
    ]
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Sign out everywhere else

• 204 Done.
• 401 Not signed in, or the CSRF token is missing or wrong.

Your recent sign-in attempts

• 200 Newest first, at most 100.

  {
    "items": [
      {
        "at": "2026-10-08T12:00:00Z",
        "email": "amy@example.com",
        "ip": "203.0.113.9",
        "reason": "password",
        "success": false,
        "userAgent": "Firefox"
      }
    ]
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Whether two-step sign-in is on

• 200 The state.

  {
    "enabled": true,
    "recoveryCodesLeft": 9
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Turn two-step sign-in off

• 204 Off.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 The password or code is not right (it counts as a failed sign-in).

Turn it on with a first code

• 200 The recovery codes.

  {
    "recoveryCodes": [
      "abcd-efgh-jkmn"
    ]
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 409 Setup was not started.
• 422 The code is not right.

Replace the recovery codes

• 200 The new codes
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 The password is not right.
• 409 Two-step sign-in is off.

Start setting up an authenticator app

• 200 The secret.

  {
    "qrCode": "data:image/png;base64,...",
    "secret": "JBSWY3DPEHPK3PXP",
    "uri": "otpauth://totp/Zappocity:amy@example.com?secret=..."
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 The password is not right.
• 409 It is already on.

Your DNS accounts

• 200 The accounts.

  {
    "items": [
      {
        "canEdit": true,
        "id": "1a2b3c4d-5e6f-4708-9a1b-2c3d4e5f6a7b",
        "name": "Acme",
        "orgId": "0f9e8d7c-6b5a-4c3d-2e1f-0a9b8c7d6e5f",
        "orgName": "Acme",
        "plan": "free",
        "status": "active",
        "zones": 1
      }
    ]
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Start a dnso.city DNS account

{
  "name": "Acme"
}

• 201 The DNS account.
• 400 Not JSON, or unknown fields.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 The email is not confirmed.
• 409 Not open yet
• 422 A value is not acceptable, such as a password under 12 characters.

A DNS account's zones

• 200 The zones.

  {
    "account": {
      "id": "1a2b3c4d-5e6f-4708-9a1b-2c3d4e5f6a7b",
      "name": "Acme",
      "plan": "personal",
      "status": "active"
    },
    "items": [
      {
        "id": "2b3c4d5e-6f70-4182-93a4-b5c6d7e8f901",
        "name": "example.com",
        "records": 2,
        "serial": 2026100901,
        "status": "active"
      }
    ]
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such DNS account

Serve a zone

• 201 The zone.
• 400 Not JSON, or unknown fields.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Only the organization's owners change its zones.
• 404 No such DNS account
• 409 The zone is served already, or the plan's limit is reached.
• 422 The record or zone is not valid

A zone and its records

• 200 The zone and its records.

  {
    "dnssec": {
      "algorithm": 13,
      "ds": "24680 13 2 9A1B...",
      "dsRecord": "example.com.\t3600\tIN\tDS\t24680 13 2 9A1B...",
      "keyTag": 24680,
      "ready": true
    },
    "records": [
      {
        "data": "10 mail.example.com.",
        "id": "3c4d5e6f-7081-4293-a4b5-c6d7e8f90123",
        "name": "@",
        "ttl": 3600,
        "type": "MX"
      }
    ],
    "transfers": {
      "addresses": [],
      "key": null
    },
    "zone": {
      "accountId": "1a2b3c4d-5e6f-4708-9a1b-2c3d4e5f6a7b",
      "id": "2b3c4d5e-6f70-4182-93a4-b5c6d7e8f901",
      "name": "example.com",
      "records": 2,
      "serial": 2026100901,
      "status": "active"
    }
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such DNS account

Stop serving a zone

• 204 Removed.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Only the organization's owners change its zones.
• 404 No such DNS account
• 409 The zone is served already, or the plan's limit is reached.
• 422 The record or zone is not valid

Check the zone's delegation

• 200 The parent's answer.

  {
    "delegation": {
      "checkedAt": "2026-10-09T12:00:00Z",
      "ds": "off",
      "missing": [
        "ns2.dnso.city"
      ],
      "nameServers": [
        "ns1.dnso.city",
        "ns1.oldhost.net"
      ],
      "parent": "com",
      "status": "partly"
    },
    "expected": [
      "ns1.dnso.city",
      "ns2.dnso.city"
    ],
    "zone": "example.com"
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such DNS account or zone here.
• 503 Delegation is not checked by this server.

Set a secondary zone's primaries

{
  "addresses": [
    "192.0.2.53"
  ],
  "key": {
    "algorithm": "hmac-sha256",
    "name": "transfer.example.org",
    "secret": "c2VjcmV0LXNlY3JldC1zZWNyZXQtc2VjcmV0LTAxMjM="
  }
}

• 200 The zone
• 400 Not JSON, or unknown fields.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Only the organization's owners change its zones.
• 404 No such DNS account or zone here.
• 409 The zone is not a secondary.
• 422 An address or the key is not valid.

Add a record

{
  "data": "10 mail.example.com.",
  "name": "@",
  "ttl": 3600,
  "type": "MX"
}

• 201 The zone and its records.

  {
    "dnssec": {
      "algorithm": 13,
      "ds": "24680 13 2 9A1B...",
      "dsRecord": "example.com.\t3600\tIN\tDS\t24680 13 2 9A1B...",
      "keyTag": 24680,
      "ready": true
    },
    "records": [
      {
        "data": "10 mail.example.com.",
        "id": "3c4d5e6f-7081-4293-a4b5-c6d7e8f90123",
        "name": "@",
        "ttl": 3600,
        "type": "MX"
      }
    ],
    "zone": {
      "accountId": "1a2b3c4d-5e6f-4708-9a1b-2c3d4e5f6a7b",
      "id": "2b3c4d5e-6f70-4182-93a4-b5c6d7e8f901",
      "name": "example.com",
      "records": 2,
      "serial": 2026100901,
      "status": "active"
    }
  }

• 400 Not JSON, or unknown fields.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Only the organization's owners change its zones.
• 404 No such DNS account
• 409 The zone is served already, or the plan's limit is reached.
• 422 The record or zone is not valid

Replace a record

{
  "data": "10 mail.example.com.",
  "name": "@",
  "ttl": 3600,
  "type": "MX"
}

• 200 The zone and its records.
• 400 Not JSON, or unknown fields.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Only the organization's owners change its zones.
• 404 No such DNS account
• 409 The zone is served already, or the plan's limit is reached.
• 422 The record or zone is not valid

Remove a record

• 200 The zone and its records.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Only the organization's owners change its zones.
• 404 No such DNS account
• 409 The zone is served already, or the plan's limit is reached.
• 422 The record or zone is not valid

Check a secondary zone now

• 200 The zone, its records and its secondary state.

  {
    "dnssec": {
      "ready": false,
      "secondary": true
    },
    "records": [
      {
        "data": "192.0.2.7",
        "name": "www",
        "ttl": 300,
        "type": "A"
      }
    ],
    "secondary": {
      "expire": 1209600,
      "keyName": "transfer.example.org.",
      "lastCheck": "2026-10-09T12:00:00Z",
      "lastError": "",
      "lastOk": "2026-10-09T12:00:00Z",
      "lastTransfer": "2026-10-09T12:00:00Z",
      "nextCheck": "2026-10-09T13:00:00Z",
      "primaries": [
        "192.0.2.53"
      ],
      "primarySerial": 7,
      "records": 3,
      "refresh": 3600,
      "retry": 600
    },
    "transfers": {
      "addresses": [],
      "key": null
    },
    "zone": {
      "id": "2b3c4d5e-6f70-4182-93a4-b5c6d7e8f901",
      "kind": "secondary",
      "name": "example.org",
      "records": 3,
      "serial": 7,
      "status": "active"
    }
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Only the organization's owners change its zones.
• 404 No such DNS account or zone here.
• 409 The zone is not a secondary.

Set the addresses the zone is transferred to

{
  "addresses": [
    "192.0.2.53",
    "2001:db8::53"
  ]
}

• 200 The zone's transfers; `key.secret` only when the key was just made.

  {
    "addresses": [
      "192.0.2.53",
      "2001:db8::53"
    ],
    "key": {
      "algorithm": "hmac-sha256",
      "createdAt": "2026-10-09T12:00:00Z",
      "name": "xfr.example.com.",
      "secret": "q2Lw...base64...="
    }
  }

• 400 Not JSON, or unknown fields.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Only the organization's owners change its zones, or the plan does not include secondary DNS.
• 404 No such DNS account or zone here.
• 422 An address is not valid, not on the internet, or there are more than 10.

Replace the zone's TSIG key

• 200 The zone's transfers with the new key's secret.

  {
    "addresses": [
      "192.0.2.53"
    ],
    "key": {
      "algorithm": "hmac-sha256",
      "createdAt": "2026-10-09T12:00:00Z",
      "name": "xfr.example.com.",
      "secret": "b7Rk...base64...="
    }
  }

• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Only the organization's owners change its zones, or the plan does not include secondary DNS.
• 404 No such DNS account or zone here.

Sign in with a passkey (start)

• 200 The options and a challengeId.

Sign in with a passkey (finish)

{
  "challengeId": "5b0b4c1e-7d1a-4f5e-9a3b-1c2d3e4f5a6b",
  "credential": {
    "id": "q8V2...",
    "response": {
      "authenticatorData": "SZYN...",
      "clientDataJSON": "eyJ0...",
      "signature": "MEUC...",
      "userHandle": "dXNl..."
    },
    "type": "public-key"
  }
}

• 201 Signed in; as POST /api/account/session.
• 400 The challenge expired or was used.
• 401 The passkey did not check out.

Sign in with a password and a security key (start)

{
  "email": "amy@example.com",
  "password": "correct horse battery"
}

• 200 The options and a challengeId.
• 401 Wrong email or password.
• 409 The account has no security key.
• 429 Too many failed sign-ins.

Sign in with a password and a security key (finish)

{
  "challengeId": "5b0b4c1e-7d1a-4f5e-9a3b-1c2d3e4f5a6b",
  "credential": {
    "id": "q8V2...",
    "response": {
      "authenticatorData": "SZYN...",
      "clientDataJSON": "eyJ0...",
      "signature": "MEUC..."
    },
    "type": "public-key"
  }
}

• 201 Signed in; as POST /api/account/session.
• 400 The challenge expired or was used.
• 401 The key did not check out.

A one-time code for a desk's host

{
  "host": "acme.supporto.city",
  "next": "/desk/acme",
  "state": "q1w2e3..."
}

• 200 Where to go.

  {
    "url": "https://acme.supporto.city/api/account/handoff/redeem?code=...\u0026next=%2Fdesk%2Facme"
  }

• 400 Not JSON, or unknown fields.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 422 A value is not acceptable, such as a password under 12 characters.

Use a handoff code

• 302 Signed in; to the desk.
• 400 The code cannot be used here.
• 403 The account is suspended.

Sign in on a supporto.city desk's host

• 302 To the account page.

Email a password reset link

• 202 If the address has an account
• 403 The captcha answer is missing or wrong (`captchaRequired` is true).
• 429 Too many attempts from this address, or too many recent links, or the account is locked.

Set a new password from a reset link

• 200 The password is set.
• 400 The link has expired or was already used.
• 422 A value is not acceptable, such as a password under 12 characters.

Who is signed in, and the CSRF token

• 200 Signed in.

  {
    "csrfToken": "Yk3...",
    "expiresAt": "2026-11-07T12:00:00Z",
    "person": {
      "email": "amy@example.com",
      "emailVerifiedAt": null,
      "id": "6c1f0b7e-2d4a-4b8e-9f3c-1a2b3c4d5e6f",
      "name": "Amy"
    }
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Sign in

• 201 Signed in.

  {
    "csrfToken": "Yk3...",
    "expiresAt": "2026-11-07T12:00:00Z",
    "person": {
      "email": "amy@example.com",
      "emailVerifiedAt": null,
      "id": "6c1f0b7e-2d4a-4b8e-9f3c-1a2b3c4d5e6f",
      "name": "Amy"
    }
  }

• 400 Not JSON, or unknown fields.
• 401 Wrong email or password.
• 403 The account is suspended (only said after the right password)
• 429 Too many attempts from this address, or too many recent links, or the account is locked.

Sign out

• 204 Signed out.

Prove who you are again

{
  "code": "123456",
  "password": "correct horse battery staple"
}

• 204 Confirmed.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Wrong password or code; twoFactorRequired is true when a code is needed.
• 429 Too many failed attempts.

Create an account

{
  "email": "amy@example.com",
  "name": "Amy",
  "password": "correct horse battery"
}

• 202 Check your email.
• 400 Not JSON, or unknown fields.
• 403 The captcha answer is missing or wrong (`captchaRequired` is true).
• 422 A value is not acceptable, such as a password under 12 characters.
• 429 Too many attempts from this address, or too many recent links, or the account is locked.

Confirm an email address from its link, and sign in

• 200 Confirmed and signed in (as Session), or, for an account with two-step sign-in, confirmed with signIn true: sign in the usual way.
• 400 The link has expired or was already used.

Send a new confirmation link

• 202 Sent.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 409 The address is already confirmed.
• 429 Too many attempts from this address, or too many recent links, or the account is locked.

The desk this host is

• 200 The desk.

  {
    "name": "Acme Support",
    "slug": "acme",
    "status": "active"
  }

• 404 Not a desk's host.

The help center

• 200 The categories and articles.

  {
    "categories": [
      {
        "articles": 6,
        "name": "Billing",
        "slug": "billing"
      }
    ],
    "items": [
      {
        "category": "billing",
        "kind": "faq",
        "slug": "refund",
        "snippet": "Open a request under Billing within 30 days",
        "title": "How do I get a refund?"
      }
    ],
    "signedIn": false
  }

• 404 No such category.

A help article, rendered

• 200 The article.

  {
    "category": "billing",
    "html": "\u003cp\u003eOpen a request under \u003cstrong\u003eBilling\u003c/strong\u003e within 30 days.\u003c/p\u003e",
    "kind": "faq",
    "slug": "refund",
    "title": "How do I get a refund?",
    "updatedAt": "2026-10-09T12:00:00Z"
  }

• 404 No such article

Say whether an article helped

{
  "helpful": true
}

• 204 Counted.
• 404 No such article.
• 422 helpful is missing.

What a request can be about

• 200 The queues.

  {
    "items": [
      {
        "allowContacts": true,
        "description": "Invoices, payments, plans and refunds.",
        "name": "Billing",
        "slug": "billing"
      }
    ]
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Your support requests

• 200 The tickets.

  {
    "items": [
      {
        "number": 41,
        "prefix": "BIL",
        "priority": "normal",
        "queue": "billing",
        "requesterEmail": "amy@example.com",
        "status": "pending",
        "subject": "Invoice question",
        "tag": "BIL-41",
        "updatedAt": "2026-10-08T12:00:00Z"
      }
    ]
  }

• 401 Not signed in, or the CSRF token is missing or wrong.

Open a support request

{
  "body": "Why was I charged twice?",
  "queue": "billing",
  "subject": "Invoice question"
}

• 201 The ticket.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 422 A value is not acceptable, such as a password under 12 characters.

A request with its messages and contacts

• 200 OK.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such ticket

Close your request

• 200 OK.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 403 Only staff close requests in this queue.
• 404 No such ticket

Add someone to the replies

• 200 OK.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such ticket
• 409 The queue does not take contacts

Take someone off the replies

• 200 OK.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such ticket

Reply

• 201 The ticket with its messages.
• 401 Not signed in, or the CSRF token is missing or wrong.
• 404 No such ticket
• 409 The request is closed.

Open a request from a notification link, without signing in

• 200 The ticket with its messages.
• 403 The queue needs signing in.
• 404 The link has expired.

Reply from a notification link

• 201 The ticket with its messages.
• 403 The queue needs signing in.
• 404 The link has expired.
• 409 The request is closed.