Mailocity admin API

Find mailboxes of every team

• 200 The mailboxes, as GET .../accounts/{accountId} gives them.

  {
    "items": [
      {
        "address": "carol@acme.test",
        "displayName": "Carol",
        "id": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "platformPersonId": "6c1f0b7e-2d4a-4b8e-9f3c-1a2b3c4d5e6f",
        "role": "member",
        "status": "active",
        "tenantId": "4ee2971f-0fae-4230-8512-ddf1704a769d",
        "tenantName": "Acme"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 person is not an id.

List the tenant's accounts

• 200 Accounts, oldest first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Create an account

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get an account

• 200 The account.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change an account's name, role, status, password or recovery address

• 200 The updated account.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a mailbox

• 202 Scheduled.

  {
    "deleteAfter": "2026-10-23T12:00:00Z",
    "requestedBy": "ops@example.test"
  }

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked to delete an owner.
• 404 No such object in this tenant (including objects of other tenants).
• 409 Under a legal hold

A mailbox's API tokens

• 200 The tokens.

  {
    "items": [
      {
        "createdAt": "2026-10-08T12:00:00Z",
        "createdBy": "the platform API key",
        "id": "5d1e2f3a-4b5c-4d6e-8f70-819203a4b5c6",
        "lastUsedAt": null,
        "name": "Zappocity mail",
        "scopes": [
          "send"
        ]
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Make an API token for the mailbox

{
  "name": "Zappocity mail",
  "scopes": [
    "send"
  ]
}

• 201 The token, shown once.

  {
    "createdBy": "the platform API key",
    "id": "5d1e2f3a-4b5c-4d6e-8f70-819203a4b5c6",
    "name": "Zappocity mail",
    "scopes": [
      "send"
    ],
    "token": "cs_mt_Yk3"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Revoke a mailbox API token

• 204 Revoked.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

List an account's app passwords

• 200 The app passwords, oldest first.

  {
    "items": [
      {
        "createdAt": "2026-10-07T09:12:00Z",
        "id": "3f0c9a52-1b7e-4d1a-9c55-0d6f2f1f4a10",
        "lastUsedAt": "2026-10-07T18:40:11Z",
        "name": "Phone"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Revoke one app password

• 204 The app password is revoked.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

A mailbox's calendar subscription links

• 200 The links.

  {
    "items": [
      {
        "calendarId": "K12",
        "calendarName": "Work",
        "createdAt": "2026-10-08T15:00:00Z",
        "detail": "busy",
        "id": "3d0c8e52-7a41-4f7e-b6a1-0c2e9d5f8a34",
        "label": "For clients",
        "lastUsed": "2026-10-08T16:05:00Z"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Revoke a calendar subscription link

• 204 Revoked.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

A user's domain blocks

• 200 The blocks.

  {
    "items": [
      {
        "action": "reject",
        "createdAt": "2026-10-09T12:00:00Z",
        "createdBy": "admin@example.com",
        "id": 7,
        "kind": "mx",
        "note": "Snowshoe spam",
        "value": "bulk-mailer.example"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Block a domain

{
  "action": "reject",
  "kind": "named",
  "note": "Links in the invoice scam",
  "value": "phish.example"
}

• 201 The block.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove a domain block

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

A user's features, from the plan and their own switches

• 200 The plan's entitlements, the user's switches and the result.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Turn features off for one user, or give them more

{
  "off": [
    "imap",
    "forwarding"
  ]
}

• 200 The new state.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Make a link that opens webmail as the user

{
  "reason": "Ticket 4182: filters not working"
}

• 201 The link.

  {
    "expiresAt": "2026-10-08T12:05:00Z",
    "url": "https://webmail.example.com/#impersonate=Qm1..."
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

A user's imports from other mail servers, newest first

• 200 The imports.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Import a user's mail from another server over IMAP

{
  "host": "imap.gmail.com",
  "password": "app password",
  "skipFolders": [
    "[Gmail]/Spam"
  ],
  "username": "amy@gmail.com"
}

• 201 Queued.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Cancel a queued or running import

• 204 Cancelled.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

Export an account's records for a lawful request

{
  "caseReference": "Subpoena 2026-117",
  "from": "2026-01-01",
  "include": [
    "account",
    "logins",
    "messages",
    "content"
  ],
  "to": "2026-10-01"
}

• 200 The ZIP file.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Show one user's limits and usage

• 200 The user's limits.

  {
    "effective": {
      "maxMessageBytes": 26214400,
      "maxRecipients": 100,
      "quotaBytes": 5368709120,
      "sendPerDay": 1000,
      "sendPerHour": 50
    },
    "overrides": {
      "maxMessageBytes": null,
      "maxRecipients": null,
      "quotaBytes": null,
      "sendPerDay": null,
      "sendPerHour": 50
    },
    "plan": "team",
    "planLimits": {
      "maxMessageBytes": 26214400,
      "maxRecipients": 100,
      "quotaBytes": 5368709120,
      "sendPerDay": 1000,
      "sendPerHour": 200
    },
    "usage": {
      "sentLastDay": 140,
      "sentLastHour": 12,
      "storageBytes": 73400320
    }
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Set one user's own limits

• 200 The user's limits after the change.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Lift a lockout

• 204 Unlocked; the failure count starts again.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

A user's sign-in attempts, newest first

• 200 The attempts.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Cancel a mailbox's deletion

• 200 The account, no longer to be deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Resume a mailbox's sending after a pause for complaints

• 204 Resumed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

A user's open webmail sessions

• 200 The sessions, last used first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Sign a user out of webmail everywhere

• 204 Signed out.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Who a mailbox is shared with

• 200 The shares.

  {
    "items": [
      {
        "access": "send",
        "createdAt": "2026-10-08T15:00:00Z",
        "grantee": "assistant@acme.test",
        "granteeId": "6f1c2a9e-1b7d-4f0e-9a3c-2d8b5e4f7a10",
        "granteeName": "Sam",
        "owner": "boss@acme.test"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Share a mailbox with a teammate, or change how

{
  "access": "write"
}

• 200 The share.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Stop sharing a mailbox with a teammate

• 204 No longer shared.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

What the checks found when the account signed up

• 200 The report, or {"checked":false}.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

A user's own spam threshold and sender lists

• 200 The policy; empty when none is set.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Replace a user's own spam threshold and sender lists

{
  "allow": [
    "newsletter.example"
  ],
  "junkScore": 4
}

• 200 The new policy.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Recipients who complained about a mailbox's mail

• 200 The recipients.

  {
    "items": [
      {
        "createdAt": "2026-10-09T03:00:00Z",
        "reason": "complaint",
        "recipient": "carol@example.net"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Let a mailbox mail a recipient who complained again

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Turn off an account's two-step sign-in

• 204 Two-step sign-in is off.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Mark an account verified by hand, or take that away

{
  "note": "Called the customer on their number on file.",
  "verified": true
}

• 200 The account.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Take a mailbox away from its Zappocity account

• 204 Unlinked.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such mailbox here

The address books the team owns

• 200 The books, with how many contacts each has.

  {
    "items": [
      {
        "contacts": 18,
        "description": "",
        "id": "A42",
        "memberAccess": "read",
        "name": "Suppliers"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Make a team address book

{
  "memberAccess": "write",
  "name": "Suppliers"
}

• 201 The book.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 A book has this name, or the team has 50.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Change a team address book

{
  "memberAccess": "read"
}

• 204 Changed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 A book has this name.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a team address book

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The book has contacts.

The team's deleted mailboxes

• 200 The deleted mailboxes.

  {
    "items": [
      {
        "accountId": "0b8e5f43-2d6c-4c55-8f1e-7c9a3e2d1b00",
        "address": "old@acme.test",
        "deleteAfter": "2026-10-23T12:00:00Z",
        "deletedAt": "2026-10-23T12:30:00Z",
        "requestedBy": "amy@acme.test"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

The team's bookable rooms and equipment

• 200 The resources.

  {
    "items": [
      {
        "address": "board@acme.com",
        "booking": "open",
        "capacity": 10,
        "createdAt": "2026-10-09T14:00:00Z",
        "description": "",
        "id": "6f1c2e8a-3b5d-4c7e-9f10-2a3b4c5d6e7f",
        "kind": "room",
        "location": "3rd floor",
        "maxMinutes": 240,
        "name": "Board room",
        "whoCanBook": "team"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Add a bookable room or piece of equipment

{
  "address": "board@acme.com",
  "capacity": 10,
  "location": "3rd floor",
  "maxMinutes": 240,
  "name": "Board room"
}

• 201 The resource.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 Another mailbox
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Change a room or piece of equipment

{
  "booking": "closed"
}

• 200 The resource.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a room or piece of equipment with its bookings

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

The team's shared mailboxes

• 200 The shared mailboxes with their members.

  {
    "items": [
      {
        "address": "sales@acme.com",
        "displayName": "Sales",
        "id": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "kind": "shared",
        "members": [
          {
            "granteeAddress": "amy@acme.com",
            "granteeName": "Amy",
            "maySend": true,
            "mayWrite": true
          }
        ],
        "status": "active"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Add a shared mailbox

{
  "address": "sales@acme.com",
  "displayName": "Sales"
}

• 201 The shared mailbox.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The address is taken, or the plan's limit is reached.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The team's custom roles, and the permissions they can have

• 200 The roles.

  {
    "items": [
      {
        "id": "6f1c2a9e-1b0e-4f3a-9a52-2f4d1e0c7b11",
        "members": 2,
        "name": "Helpdesk",
        "permissions": [
          "users",
          "support"
        ]
      }
    ],
    "permissions": [
      {
        "key": "users",
        "name": "Users: add, change, suspend and delete mailboxes..."
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 Not an owner or admin.

Make a custom role

{
  "name": "Helpdesk",
  "permissions": [
    "users",
    "support"
  ]
}

• 201 The role.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 A role with this name exists.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Rename a role or replace its permissions

{
  "permissions": [
    "users",
    "aliases",
    "support"
  ]
}

• 200 The role.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 A role with this name exists.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a role (its members keep their base role)

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

The team's templates

• 200 The templates.

  {
    "items": [
      {
        "createdAt": "2026-10-09T14:00:00Z",
        "createdBy": "lead@acme.com",
        "html": "\u003cp\u003eHi,\u003c/p\u003e\u003cp\u003eFollowing up on the quote we sent...\u003c/p\u003e",
        "id": "0b8e5d2c-1a3f-4e6d-9c7b-2f1e0d9c8b7a",
        "name": "Quote follow-up",
        "subject": "Your quote",
        "text": "",
        "updatedAt": "2026-10-09T14:00:00Z",
        "uses": 12
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Add a team template

{
  "html": "\u003cp\u003eHi,\u003c/p\u003e\u003cp\u003eFollowing up on the quote we sent...\u003c/p\u003e",
  "name": "Quote follow-up",
  "subject": "Your quote"
}

• 201 The template.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Change a team template

{
  "name": "Quote follow-up",
  "subject": "Your quote from Acme",
  "text": "Hi,\n\nFollowing up on the quote we sent."
}

• 200 The template.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a team template

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

The signed-in administrator and the session's CSRF token

• 200 The session.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Sign an administrator in to the admin panel

{
  "email": "ops@example.com",
  "password": "a long passphrase"
}

• 201 Signed in. The response sets the session cookie.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 415 The body is not JSON.
• 429 Too many failed sign-ins.

Sign out

• 204 Signed out.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 The CSRF token is missing or wrong.

Which ways of signing in to the panel are open

• 200 Whether Sign in with Zappocity is offered, and whether passwords still work.

  {
    "passwordSignin": true,
    "sso": true
  }

Where Zappocity sends the browser back

• 302 To /admin, signed in; or to /admin#sso-error=... (expired, unverified, not-staff, unavailable).

Sign in to the panel with Zappocity

• 302 To Zappocity

List the tenant's aliases

• 200 Aliases by address.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Add an alias address for an account

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove an alias

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Place a legal hold on one user's archived mail

{
  "reason": "Smith v. Example, preserve from 2026-03"
}

• 200 The hold.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Lift a user's legal hold

• 204 Lifted (or there was none).
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Search the archive

• 200 Matching messages.

  {
    "items": [
      {
        "accountId": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "address": "sam@example.com",
        "archivedAt": "2026-10-08T12:00:00Z",
        "direction": "out",
        "expiresAt": "2033-10-07T12:00:00Z",
        "from": "sam@example.com",
        "id": 912,
        "messageId": "abc@example.com",
        "rcpts": [
          "buyer@example.org"
        ],
        "size": 4210,
        "subject": "Quote",
        "tenantId": "4f1c2d3e-1111-4a2b-9c3d-5e6f7a8b9c0d"
      }
    ]
  }

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Who searched, downloaded or changed the archive

• 200 Newest first.

  {
    "items": [
      {
        "action": "search",
        "at": "2026-10-08T12:00:00Z",
        "by": "owner@example.com",
        "detail": "q=\"quote\" address=\"\" direction=\"\" from=\"\" to=\"\" results=3",
        "id": 41
      }
    ]
  }

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Archiving settings, size and holds

• 200 The settings, how much is archived, and the users on hold.

  {
    "accountHolds": [
      {
        "accountId": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "address": "sam@example.com",
        "by": "owner@example.com",
        "createdAt": "2026-10-08T12:00:00Z",
        "platform": false,
        "reason": "Smith v. Example, preserve from 2026-03"
      }
    ],
    "bytes": 734003200,
    "messages": 18230,
    "oldest": "2026-01-04T09:12:00Z",
    "settings": {
      "enabled": true,
      "entitled": true,
      "hold": false,
      "holdBy": "",
      "holdPlatform": false,
      "holdReason": "",
      "retentionDays": 2555,
      "updatedAt": "2026-10-08T12:00:00Z"
    }
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Turn archiving on or off, set retention, place or lift a team-wide hold

{
  "enabled": true,
  "retentionDays": 3650
}

• 200 The new settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Download an archived message

• 200 The message.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

DMARC aggregate reports received for a shared domain

• 200 Reports.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

One DMARC report with its rows

• 200 The report; records are sorted by message count, largest first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Sending sources seen in DMARC reports for a shared domain

• 200 The summary.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

DMARC aggregate reports received for one of the tenant's domains

• 200 Reports.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

One DMARC report with its rows

• 200 The report; records are sorted by message count, largest first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Sending sources seen in DMARC reports for one of the tenant's domains

• 200 The summary.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Make a shared domain a team's own

• 200 The domain
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The team is at its domain limit.
• 422 Addresses on the domain belong to other teams.

Check the domain's DNS records

• 200 The check.

  {
    "checkedAt": "2026-10-09T12:00:00Z",
    "ok": false,
    "records": [
      {
        "found": [
          "10 mx.zappo.city."
        ],
        "name": "example.com",
        "priority": 10,
        "purpose": "Deliver mail for the domain to this server",
        "status": "ok",
        "type": "MX",
        "value": "mx.zappo.city."
      },
      {
        "found": [
          "v=DMARC1; p=none"
        ],
        "name": "_dmarc.example.com",
        "purpose": "DMARC",
        "status": "wrong",
        "type": "TXT",
        "value": "v=DMARC1; p=quarantine"
      },
      {
        "found": [],
        "name": "_jmap._tcp.example.com",
        "optional": true,
        "purpose": "JMAP discovery",
        "status": "missing",
        "type": "SRV",
        "value": "0 1 443 mx.zappo.city."
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

The team's open domain offers, made and received

• 200 The offers
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Withdraw (the giving team) or decline (the receiving team) an offer

• 204 Gone.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Take a domain offered to the team

• 200 The domain
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 A team is not in good standing, the domain is in use, or the team is at its domain limit.

List the tenant's domains

• 200 Domains by name.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Add a domain to the tenant without DNS proof

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get one of the tenant's domains and its settings

• 200 The domain.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change a domain's settings

• 200 The updated domain.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove a domain with everything on it

• 202 Scheduled.

  {
    "mailboxes": [
      "amy@example.com",
      "sales@example.com"
    ],
    "removeAfter": "2026-11-09T12:00:00Z"
  }

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The domain's BIMI logo

• 200 The logo's state.

  {
    "dmarcNote": "",
    "dmarcReady": true,
    "domain": "example.com",
    "hasCertificate": false,
    "hasLogo": true,
    "logoUrl": "https://mailo.city/bimi/example.com.svg",
    "record": {
      "name": "default._bimi.example.com",
      "purpose": "BIMI: the brand logo receivers may show next to the domain's mail",
      "type": "TXT",
      "value": "v=BIMI1; l=https://mailo.city/bimi/example.com.svg; a="
    },
    "updatedAt": "2026-10-09T04:00:00Z"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Set the domain's BIMI logo

{
  "svg": "\u003csvg xmlns=\"http://www.w3.org/2000/svg\" version=\"1.2\" baseProfile=\"tiny-ps\" viewBox=\"0 0 100 100\"\u003e\u003ctitle\u003eExample\u003c/title\u003e\u003ccircle cx=\"50\" cy=\"50\" r=\"40\" fill=\"#06c\"/\u003e\u003c/svg\u003e"
}

• 200 The logo's state.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove the domain's BIMI logo

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Check the published BIMI record

• 200 The check.

  {
    "dmarcNote": "",
    "dmarcReady": true,
    "expected": "v=BIMI1; l=https://mailo.city/bimi/example.com.svg; a=",
    "matches": true,
    "published": "v=BIMI1; l=https://mailo.city/bimi/example.com.svg; a="
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

List the DKIM keys of one of the tenant's domains

• 200 Keys.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Create a DKIM key for a rotation

{
  "algorithm": "rsa"
}

• 201 The key.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a pending or retired key

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

Make a key the one that signs

• 200 The key, now active.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

DNS records the tenant must publish

• 200 Records to publish, as JSON or a zone file.

  "; DNS records for example.com, made by Zappocity on 2026-10-07 15:49 UTC.\n$ORIGIN example.com.\n$TTL 3600\n\n; Deliver mail for the domain to this server\n@\t3600\tIN\tMX\t10 mx.zappocity.example.\n"

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

The domain's automatic DNS

• 200 The automation, or null.

  {
    "automation": {
      "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
      "domain": "acme.com",
      "includeOptional": true,
      "lastChanges": 6,
      "lastError": "",
      "lastSyncAt": "2026-10-09T14:00:00Z",
      "provider": "route53",
      "region": "us-east-1",
      "secretSet": true,
      "zone": "acme.com",
      "zoneId": ""
    }
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Publish the domain's records automatically

• 200 The automation.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Stop publishing (records already published stay)

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Publish the records now

• 200 Whether it worked, and the record sets changed (none when all were right).

  {
    "changes": [
      {
        "name": "@",
        "type": "MX",
        "values": [
          "10 mx.mailo.city."
        ]
      }
    ],
    "ok": true
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Check the domain's DNS records

• 200 The check.

  {
    "checkedAt": "2026-10-09T12:00:00Z",
    "ok": false,
    "records": [
      {
        "found": [
          "10 mx.zappo.city."
        ],
        "name": "example.com",
        "priority": 10,
        "purpose": "Deliver mail for the domain to this server",
        "status": "ok",
        "type": "MX",
        "value": "mx.zappo.city."
      },
      {
        "found": [
          "v=DMARC1; p=none"
        ],
        "name": "_dmarc.example.com",
        "purpose": "DMARC",
        "status": "wrong",
        "type": "TXT",
        "value": "v=DMARC1; p=quarantine"
      },
      {
        "found": [],
        "name": "_jmap._tcp.example.com",
        "optional": true,
        "purpose": "JMAP discovery",
        "status": "missing",
        "type": "SRV",
        "value": "0 1 443 mx.zappo.city."
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Move a domain to another team at once (staff)

• 200 The domain
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 A team is not in good standing, the domain is in use, or the receiving team is at its domain limit.

Check the domain's MTA-STS from outside

• 200 What was found; an empty `problems` means all is well.

  {
    "fetched": true,
    "maxAge": 604800,
    "mode": "enforce",
    "mx": [
      "mx.example.com"
    ],
    "problems": [],
    "recordFound": true,
    "recordId": "20261008T120000"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Mark a domain proved by hand

• 200 The domain.

  {
    "name": "zappo.city",
    "tenantId": "4ee2971f-0fae-4230-8512-ddf1704a769d",
    "verifiedAt": "2026-10-09T02:10:00Z"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Keep a domain being removed

• 200 The domain.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Offer a domain to another team

{
  "to": "owner@other.example"
}

• 201 The offer.

  {
    "createdAt": "2026-10-09T12:00:00Z",
    "domain": "example.com",
    "expiresAt": "2026-10-23T12:00:00Z",
    "fromTeam": "Acme",
    "fromTenantId": "8b30...",
    "id": "2f4c...",
    "offeredBy": "boss@acme.example",
    "toTeam": "Other",
    "toTenantId": "51aa..."
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 A team is not in good standing, or the domain still has mailboxes or aliases.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Prove a domain added without proof

• 200 The domain
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 The record is not there yet.

Domains waiting for their proof record

• 200 Pending domains by name.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Ask for a domain that DNS must prove first

• 201 The record to publish.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Drop a pending domain request

• 204 Dropped.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Check the proof record and add the domain

• 201 The new domain.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Hide or show any post (staff)

{
  "hidden": true
}

• 204 Done.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Pin, lock or hide any topic (staff)

{
  "hidden": false,
  "locked": true
}

• 204 Done.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

The platform's forums

• 200 The forums.

  {
    "items": [
      {
        "closed": true,
        "createdAt": "2026-10-09T12:00:00Z",
        "description": "News from Mailocity",
        "enabled": true,
        "id": "6f1c2a9e-1b0e-4f3a-9a52-2f4d1e0c7b11",
        "lastPostAt": "2026-10-09T12:00:00Z",
        "name": "Announcements",
        "slug": "announcements",
        "sortOrder": 10,
        "tenantId": null,
        "topics": 3,
        "visibility": "public"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Make a platform forum

{
  "closed": true,
  "description": "News from Mailocity",
  "name": "Announcements",
  "slug": "announcements",
  "sortOrder": 10
}

• 201 The forum.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 A forum with this slug exists.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Change a platform forum

{
  "closed": false
}

• 200 The forum.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 A forum with this slug exists.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a platform forum with all its topics

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

A team's forums

• 200 The forums.

  {
    "enabled": true,
    "items": [
      {
        "closed": false,
        "description": "",
        "enabled": true,
        "id": "6f1c2a9e-1b0e-4f3a-9a52-2f4d1e0c7b11",
        "name": "General",
        "slug": "general",
        "sortOrder": 100,
        "team": "acme",
        "tenantId": "3c1d9a7e-55b2-4b8e-9e1f-0a2b3c4d5e6f",
        "topics": 12,
        "visibility": "members"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Make a team forum

{
  "description": "Anything about work",
  "name": "General",
  "slug": "general"
}

• 201 The forum.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 The team's plan does not include forums.
• 409 A forum with this slug exists.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Change a team forum

{
  "visibility": "public"
}

• 200 The forum.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a team forum with all its topics

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

The team's own addresses for its forums, wiki, webmail and team manager

• 200 The addresses.

  {
    "baseForum": "acme.f.zappo.city",
    "baseWiki": "acme.d.zappo.city",
    "checks": {
      "forum.acme.com": {
        "checkedAt": "2026-10-09T14:00:00Z",
        "detail": "No CNAME to sites.mailo.city found",
        "ok": false
      },
      "mail.acme.com": {
        "checkedAt": "2026-10-09T14:00:00Z",
        "detail": "CNAME to sites.mailo.city",
        "ok": true
      }
    },
    "forumHost": "forum.acme.com",
    "mailHost": "mail.acme.com",
    "manageHost": null,
    "target": "sites.mailo.city",
    "wikiHost": null
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Set the team's own addresses

{
  "forumHost": "forum.acme.com",
  "mailHost": "mail.acme.com"
}

• 200 The addresses.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 Not on one of the team's proven domains, already in use, or the same for two sites.

Check now whether the team's own addresses point here

• 200 The addresses with their checks
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Who reads and edits the team's wiki

• 200 The settings.

  {
    "editors": "members",
    "enabled": true,
    "public": false,
    "team": "acme",
    "tenantId": "3c1d9a7e-55b2-4b8e-9e1f-0a2b3c4d5e6f"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change who reads and edits the team's wiki

{
  "editors": "admins",
  "public": true
}

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

List invitation links

• 200 The invitations.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Make invitation links

{
  "count": 5,
  "note": "beta testers",
  "plan": "free",
  "validDays": 7
}

• 201 The new invitations, each with its link.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Cancel an unused invitation link

• 204 Cancelled.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Show a user's invitations to give

• 200 The allowance.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Set, add to or reset a user's invitations

• 200 The new allowance.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The team's invitation links, newest first

• 200 The links.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Make a link to join the team

{
  "days": 30,
  "maxUses": 5,
  "note": "New starters"
}

• 201 The link.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Stop a link working

• 204 Revoked.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Get the shared domain rules

• 200 The rules; an empty script means none.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Replace the shared domain rules

• 200 The rules as saved.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Check a Sieve script

{
  "script": "require \"fileinto\";\nif header :contains \"subject\" \"invoice\" { fileinto \"Invoices\"; }"
}

• 200 Whether the script compiles.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

List an account's filter scripts

• 200 The scripts by name, with their content.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Add a filter script to an account

{
  "active": true,
  "name": "Newsletters",
  "script": "require \"fileinto\";\nif exists \"list-id\" { fileinto \"Newsletters\"; }"
}

• 201 The script.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get one of an account's filter scripts

• 200 The script.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Rename, replace, turn on or turn off a filter script

• 200 The script.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a filter script

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

Get the domain rules

• 200 The rules; an empty script means none.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Replace the domain rules

• 200 The rules as saved.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get the tenant rules

• 200 The rules; an empty script means none.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Replace the tenant rules

• 200 The rules as saved.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The team's mailing lists

• 200 The lists, by address.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Make a mailing list

{
  "address": "team@acme.com",
  "joining": "team",
  "kind": "discussion",
  "name": "Team",
  "subjectPrefix": "[team]"
}

• 201 The list.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 A mailbox, alias or list has the address, or the plan's limit is reached.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

A mailing list

• 200 The list.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change a mailing list

{
  "others": "reject",
  "whoCanPost": "anyone"
}

• 200 The list.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a mailing list with its members and held posts

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Posts waiting for a moderator

• 200 The held posts, oldest first.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Throw a held post away

• 204 Discarded.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Send a held post to the members

• 204 Queued for the members.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 503 The post could not be queued; it is held again.

A mailing list's members

• 200 The members, by address.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Add a member or change one

{
  "moderator": true,
  "name": "Amy"
}

• 200 The member.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The plan's limit of members is reached.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Take an address off a mailing list

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

The outbound IPv4 addresses

• 200 The addresses.

  {
    "items": [
      {
        "address": "203.0.113.10",
        "createdAt": "2026-10-09T14:00:00Z",
        "enabled": true,
        "hostname": "o1.mailo.city",
        "kind": "shared",
        "note": "",
        "team": "",
        "tenantId": null
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Add an address of this server to the pool

{
  "address": "203.0.113.11",
  "hostname": "acme.out.mailo.city",
  "kind": "dedicated",
  "tenantId": "6f1c2e8a-3b5d-4c7e-9f10-2a3b4c5d6e7f"
}

• 201 The address.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 The address is in the pool already.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Change a pool address

{
  "enabled": false
}

• 200 The address.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Take an address out of the pool

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

IPv6 and publishing settings for outbound addresses

• 200 The settings.

  {
    "forwardZone": "mailo.city",
    "ipv6NameBase": "out.mailo.city",
    "ipv6Prefix": "2001:db8:1:2::/64",
    "preferIpv6": true,
    "publishError": "",
    "publishedAt": "2026-10-09T14:00:00Z",
    "reverseZones": [
      "113.0.203.in-addr.arpa",
      "2.0.0.0.1.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa"
    ],
    "updatedAt": "2026-10-09T14:00:00Z"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change the IPv6 and publishing settings

{
  "ipv6NameBase": "out.mailo.city",
  "ipv6Prefix": "2001:db8:1:2::/64"
}

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Publish the addresses' names and PTR records

• 200 Whether it worked, and the record sets changed.

  {
    "changes": [
      {
        "name": "10",
        "type": "PTR",
        "values": [
          "o1.mailo.city."
        ]
      }
    ],
    "error": "",
    "ok": true
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Mail to other domains still in the queue

• 200 Queue entries, oldest message first (at most 1000).
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Where the team's mail leaves from

• 200 Its IPv4 addresses (dedicated or shared) and each domain's address and IPv6.

  {
    "dedicated": true,
    "domains": [
      {
        "domain": "acme.com",
        "ipv4": "203.0.113.11",
        "ipv6": "2001:db8:1:2:9f3c:1a2b:4c5d:6e7f",
        "ipv6Name": "x1a2b3c4d5e.out.mailo.city"
      }
    ],
    "ipv4": [
      "203.0.113.11"
    ],
    "preferIpv6": true
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

The entitlements a plan can switch on

• 200 The catalogue.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

List plans

• 200 Plans by sort order.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Add a plan

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get a plan

• 200 The plan.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change a plan's name, limits, entitlements or availability

• 200 The updated plan.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove a plan no tenant is on

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

Captcha and signup address checks

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change the captcha and signup address checks

{
  "action": "review",
  "captchaProvider": "pow",
  "ipqsEnabled": true,
  "ipqsKey": "...",
  "ipqsMaxScore": 85
}

• 200 The new settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Run the signup checks on an address

• 200 What each check found and the verdict.

  {
    "ip": "203.0.113.5",
    "ipqs": {
      "asn": 64500,
      "country": "NL",
      "fraudScore": 97,
      "isp": "Hosting",
      "proxy": true,
      "tor": false,
      "vpn": false
    },
    "network": {
      "asn": 64500,
      "entity": "Example Hosting"
    },
    "reasons": [
      "IPQualityScore fraud score 97 (limit 85)"
    ],
    "verdict": "review"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The access blocks

• 200 The rules.

  {
    "actions": [
      "signup",
      "signin",
      "tickets"
    ],
    "items": [
      {
        "applies": [
          "signup",
          "tickets"
        ],
        "createdAt": "2026-10-09T12:00:00Z",
        "createdBy": "admin@example.com",
        "expiresAt": null,
        "hits": 41,
        "id": 3,
        "kind": "mx",
        "lastHitAt": "2026-10-09T15:02:00Z",
        "note": "Throwaway addresses",
        "value": "mail.disposable.example"
      }
    ],
    "kinds": [
      "email",
      "domain",
      "ip",
      "asn",
      "country",
      "mx",
      "ns"
    ],
    "networkLookups": true
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.

Add an access block

{
  "applies": [
    "signup",
    "signin"
  ],
  "days": 30,
  "kind": "ip",
  "note": "Credential stuffing",
  "value": "203.0.113.0/24"
}

• 201 The rule.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Which rule would refuse this

{
  "action": "signup",
  "email": "someone@disposable.example",
  "ip": "203.0.113.9"
}

• 200 The verdict.

  {
    "blocked": true,
    "rule": {
      "applies": [
        "signup",
        "tickets"
      ],
      "id": 3,
      "kind": "mx",
      "value": "mail.disposable.example"
    }
  }

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove an access block

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

The blogs' posts

• 200 The posts.

  {
    "items": [
      {
        "authorEmail": "admin@example.com",
        "authorName": "Terrance",
        "body": "Team admins can now...",
        "createdAt": "2026-10-09T15:00:00Z",
        "id": "5a1d2c3b-4e5f-4a6b-8c7d-9e0f1a2b3c4d",
        "publishAt": "2026-10-10T09:00:00Z",
        "site": "mailocity",
        "slug": "shared-templates",
        "status": "published",
        "summary": "Write the same reply once.",
        "tags": [
          "webmail",
          "teams"
        ],
        "title": "Templates for the whole team",
        "updatedAt": "2026-10-09T15:00:00Z"
      }
    ],
    "sites": [
      "mailocity",
      "zappocity"
    ]
  }

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.

Write a post

{
  "authorName": "Terrance",
  "body": "Team admins can now keep **templates** for everyone.",
  "publishAt": "2026-10-10T09:00:00Z",
  "site": "mailocity",
  "slug": "shared-templates",
  "status": "published",
  "summary": "Write the same reply once.",
  "tags": [
    "webmail",
    "teams"
  ],
  "title": "Templates for the whole team"
}

• 201 The post.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

A post, with its body rendered

• 200 The post and its HTML.

  {
    "html": "\u003cp\u003eTeam admins can now keep \u003cstrong\u003etemplates\u003c/strong\u003e for everyone.\u003c/p\u003e",
    "post": {
      "slug": "shared-templates",
      "status": "draft",
      "title": "Templates for the whole team"
    }
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change a post

{
  "body": "...",
  "site": "mailocity",
  "slug": "shared-templates",
  "status": "draft",
  "title": "Templates for the whole team"
}

• 200 The post.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Delete a post

• 204 Deleted.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Render Markdown as a post shows

{
  "body": "Hello **world**"
}

• 200 The HTML.

  {
    "html": "\u003cp\u003eHello \u003cstrong\u003eworld\u003c/strong\u003e\u003c/p\u003e"
  }

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Complaints from providers' feedback loops, and complaint rates

• 200 Complaints and rates.

  {
    "items": [
      {
        "accountId": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "address": "bob@acme.test",
        "feedbackType": "abuse",
        "id": 7,
        "messageId": "m1@acme.test",
        "receivedAt": "2026-10-09T03:00:00Z",
        "recipient": "carol@example.net",
        "reporter": "Yahoo!-Mail-Feedback/2.0",
        "tenantId": "4ee2971f-0fae-4230-8512-ddf1704a769d"
      }
    ],
    "rates": [
      {
        "accountId": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
        "address": "bob@acme.test",
        "complaints": 4,
        "permille": 4.4,
        "sendingPausedAt": "2026-10-09T03:00:01Z",
        "sent": 900,
        "tenantId": "4ee2971f-0fae-4230-8512-ddf1704a769d"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

The platform's domain blocks

• 200 The blocks.

  {
    "items": [
      {
        "action": "reject",
        "createdAt": "2026-10-09T12:00:00Z",
        "createdBy": "admin@example.com",
        "id": 7,
        "kind": "mx",
        "note": "Snowshoe spam",
        "value": "bulk-mailer.example"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

Block a domain

{
  "action": "reject",
  "kind": "named",
  "note": "Links in the invoice scam",
  "value": "phish.example"
}

• 201 The block.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove a domain block

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).

The abuse feedback loop's settings

• 200 The settings.

  {
    "address": "fbl@mailo.city",
    "minSent": 200,
    "pausePermille": 3
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change the feedback loop's settings

{
  "address": "fbl@mailo.city",
  "pausePermille": 3
}

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Greylisting times and the platform's IP allowlist

• 200 The settings.

  {
    "delaySeconds": 300,
    "ipAllowlist": [
      "198.51.100.0/24",
      "2001:db8:1::/48"
    ],
    "passDays": 36,
    "retryHours": 24
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change greylisting times and the platform's IP allowlist

{
  "ipAllowlist": [
    "192.0.2.10",
    "198.51.100.0/24"
  ]
}

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

The scheduled jobs

• 200 The jobs.

  {
    "items": [
      {
        "defaultEverySeconds": 21600,
        "description": "Deletes message files and attachments nothing uses any more.",
        "enabled": true,
        "everySeconds": 21600,
        "failures": 0,
        "lastDurationMs": 4012,
        "lastError": "",
        "lastFinishedAt": "2026-10-09T12:00:04Z",
        "lastOk": true,
        "lastResult": "12 files and 12 records removed",
        "lastStartedAt": "2026-10-09T12:00:00Z",
        "lastTrigger": "schedule",
        "name": "blob-cleanup",
        "nextAt": "2026-10-09T18:00:00Z",
        "running": false,
        "runs": 40,
        "title": "Unused files"
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.

Pause, resume or reschedule a job

{
  "everySeconds": 3600
}

• 200 The job.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Run a job now

• 200 Run here; its outcome.

  {
    "durationMs": 41,
    "error": "",
    "finished": true,
    "ok": true,
    "result": "12 mail log lines removed",
    "started": true
  }

• 202 Started.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).
• 409 It is running now.

The audit log of legal exports, newest first

• 200 The exports.

  {
    "items": [
      {
        "accountAddress": "alice@acme.com",
        "bytes": 182211,
        "caseReference": "Subpoena 2026-117",
        "createdAt": "2026-10-08T15:00:00Z",
        "id": "6c1d...",
        "note": "",
        "requestedBy": "ops@example.com",
        "scope": {
          "from": "2026-01-01T00:00:00Z",
          "include": [
            "account",
            "messages"
          ],
          "to": "2026-10-01T00:00:00Z"
        },
        "sha256": "9f2c..."
      }
    ]
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Search the mail log

• 200 The lines.

  {
    "items": [
      {
        "at": "2026-10-09T12:00:01Z",
        "id": 912,
        "line": "2026-10-09 12:00:01 1u2v3w-00AbCd-Xy =\u003e bob@example.net H=mx.example.net R=dnslookup T=remote_smtp",
        "log": "main",
        "messageId": "1u2v3w-00AbCd-Xy"
      },
      {
        "at": "2026-10-09T12:00:00Z",
        "id": 911,
        "line": "2026-10-09 12:00:00 1u2v3w-00AbCd-Xy \u003c= alice@example.com H=client.example [192.0.2.1] P=esmtpsa A=plain:alice@example.com S=1234 id=\u003cx@y\u003e",
        "log": "main",
        "messageId": "1u2v3w-00AbCd-Xy"
      }
    ],
    "next": 911
  }

• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

How long the mail log is kept for searching

• 200 The settings.

  {
    "days": 30
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change how long the mail log is kept

{
  "days": 90
}

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

MTA-STS defaults and how sent mail follows other domains' policies

• 200 The settings.

  {
    "defaultMaxAge": 604800,
    "defaultMode": "testing",
    "outbound": "follow",
    "updatedAt": "2026-10-08T12:00:00Z"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change MTA-STS defaults and the handling of sent mail

{
  "defaultMode": "enforce"
}

• 200 The new settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

How Mailocity sends its notices

• 200 The setting.

  {
    "accountId": "0b6e4c1e-9a0e-4c55-8f0b-3d1f6c1d2e3f",
    "address": "noreply@mailo.city",
    "hasJmapToken": true,
    "hasSmtpPassword": false,
    "jmapUrl": "",
    "mode": "jmap",
    "smtpHost": "",
    "smtpPort": 587,
    "smtpSecurity": "starttls",
    "smtpUsername": ""
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change how Mailocity sends its notices

• 200 The setting.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Send a test notice

• 200 Whether it went, and the error if not.

  {
    "error": "signing in to mailo.city: 535 authentication failed",
    "ok": false
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Lockout, sign-in history and alert settings

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change lockout, sign-in history, alert and session settings

{
  "adminIdleMinutes": 240,
  "historyDays": 180,
  "lockoutMinutes": 30,
  "lockoutThreshold": 8
}

• 200 The new settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Platform-wide signup and webmail settings

• 200 The settings.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Change signups, their limits and the webmail host

• 200 The updated settings.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

List the platform's shared domains

• 200 Shared domains by name.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.

Add a shared domain

• 201 Created.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Get a shared domain

• 200 The domain.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).

Change a shared domain's settings

• 200 The updated domain.
• 400 The body is not a valid JSON object, has unknown fields, or is too large.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 422 A value is out of range, or names a domain or account of another tenant. When one setting is refused, `field` names it and `detail` says what is allowed.

Remove a shared domain nobody has an address on

• 204 Removed.
• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 404 No such object in this tenant (including objects of other tenants).
• 409 The name or address is taken, the tenant has no free seats, a plan limit would be passed (the body adds limit, used and max), or the object is still in use.

The domain's BIMI logo

• 200 The logo's state.

  {
    "dmarcNote": "",
    "dmarcReady": true,
    "domain": "example.com",
    "hasCertificate": false,
    "hasLogo": true,
    "logoUrl": "https://mailo.city/bimi/example.com.svg",
    "record": {
      "name": "default._bimi.example.com",
      "purpose": "BIMI: the brand logo receivers may show next to the domain's mail",
      "type": "TXT",
      "value": "v=BIMI1; l=https://mailo.city/bimi/example.com.svg; a="
    },
    "updatedAt": "2026-10-09T04:00:00Z"
  }

• 401 The platform API key is missing or wrong, or there is no valid admin panel session.
• 403 A team admin asked for something only the platform operator may do, or for another team, or the CSRF token is missing or wrong.
• 404 No such object in this tenant (including objects of other tenants).