Depot mailboxes

Registers the mailbox routes on mux.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/mailbox-drivers

GETmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listMailboxDrivers lists the inbound and outbound drivers this Depot’s mode allows.

POP3 is not offered (E5); an existing POP3 mailbox still loads and saves.

Responses

Status	Body	Description
200	application/json, MailboxDriversView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.

200 response body

Field	Type	Description
inboundrequired	array of string
outboundrequired	array of string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mailbox-drivers' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mailbox-drivers' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailbox-drivers"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mailbox-drivers", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailbox-drivers";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mailbox-drivers");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/mailboxes

GETmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List mailboxes

Parameters

Name	In	Type	Required	Description
dir	query	string, one of asc, desc	No	Sort direction.
page	query	integer	No	One-based page number. Defaults to 1.
pageSize	query	integer	No	Rows per page, 1 to 200. Defaults to 50.
q	query	string	No	Free-text search term.
sort	query	string, one of address, driver, enabled, name, polled	No	Sort key.
state	query	string	No

Responses

Status	Body	Description
200	application/json, PagedResultMailboxView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
500	application/problem+json, ProblemDetails	No client store in request context.

200 response body

Field	Type	Description
itemsrequired	array of MailboxView
items[].addressrequired	string
items[].authModerequired	string
items[].canaryLastSeenAt	string (date-time) or null
items[].canaryLastSentAt	string (date-time) or null
items[].connectedAccount	string
items[].createdAtrequired	string (date-time)
items[].defaultClientId	string
items[].defaultClientName	string
items[].defaultPriority	string
items[].defaultType	string
items[].displayName	string
items[].driverrequired	string
items[].enabledrequired	boolean
items[].forwardAddress	string
items[].hideSubjectTagrequired	boolean
items[].host	string
items[].lastError	string
items[].lastPolledAt	string (date-time) or null
items[].lastReceivedAt	string (date-time) or null
items[].lastSyncAt	string (date-time) or null
items[].namerequired	string
items[].oauthClientId	string
items[].oauthClientSecretConfiguredrequired	boolean
items[].oauthRefreshTokenConfiguredrequired	boolean
items[].oauthTenantId	string
items[].outboundDriverrequired	string
items[].outboundPathrequired	string
items[].passwordConfiguredrequired	boolean
items[].pollIntervalSecondsrequired	integer
items[].port	integer
items[].publicIdrequired	string
items[].queueId	string
items[].scopeVerifiedrequired	boolean
items[].serviceAccountConfiguredrequired	boolean
items[].smtpHost	string
items[].smtpPasswordConfiguredrequired	boolean
items[].smtpPort	integer
items[].smtpUseTlsrequired	boolean
items[].smtpUsername	string
items[].statusrequired	string
items[].statusChangedAt	string (date-time) or null
items[].statusReason	string
items[].suspendedCountrequired	integer
items[].tokenExpiresAt	string (date-time) or null
items[].trustAllSenders	boolean or null
items[].unknownSendersrequired	string
items[].updatedAtrequired	string (date-time)
items[].useTlsrequired	boolean
items[].username	string
pagerequired	integer
pageSizerequired	integer
totalrequired	integer

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mailboxes?dir=asc&page=0&pageSize=0&q=<q>&sort=address&state=<state>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mailboxes?dir=asc&page=0&pageSize=0&q=<q>&sort=address&state=<state>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes"
params = {
    "dir": "asc",
    "page": "0",
    "pageSize": "0",
    "q": "<q>",
    "sort": "address",
    "state": "<state>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mailboxes?dir=asc&page=0&pageSize=0&q=<q>&sort=address&state=<state>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/mailboxes");
url.searchParams.set("dir", "asc");
url.searchParams.set("page", "0");
url.searchParams.set("pageSize", "0");
url.searchParams.set("q", "<q>");
url.searchParams.set("sort", "address");
url.searchParams.set("state", "<state>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mailboxes?dir=asc&page=0&pageSize=0&q=<q>&sort=address&state=<state>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mailboxes

POSTmailbox:manageshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

createMailbox adds a mailbox.

A forward mailbox gets its forwarding address from Core first: the row cannot exist without one (CK_MailboxConfig_ForwardSlug).

Request body

Required, sent as application/json.

Field	Type	Description
address	string or null
authMode	string or null
defaultClientId	string or null
defaultPriority	string or null
defaultType	string or null
displayName	string or null
driver	string or null
enabled	boolean or null
hideSubjectTag	boolean or null
host	string or null
name	string or null
oauthClientId	string or null
oauthClientSecret	string or null
oauthRefreshToken	string or null
oauthTenantId	string or null
outboundDriver	string or null
password	string or null
pollIntervalSeconds	integer or null
port	integer or null
queueId	string or null
serviceAccountJson	string or null
smtpHost	string or null
smtpPassword	string or null
smtpPort	integer or null
smtpUseTls	boolean or null
smtpUsername	string or null
unknownSenders	string or null
useTls	boolean or null
username	string or null

Responses

Status	Body	Description
201	application/json, MailboxView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	No resource matches.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

201 response body

Field	Type	Description
addressrequired	string
authModerequired	string
canaryLastSeenAt	string (date-time) or null
canaryLastSentAt	string (date-time) or null
connectedAccount	string
createdAtrequired	string (date-time)
defaultClientId	string
defaultClientName	string
defaultPriority	string
defaultType	string
displayName	string
driverrequired	string
enabledrequired	boolean
forwardAddress	string
hideSubjectTagrequired	boolean
host	string
lastError	string
lastPolledAt	string (date-time) or null
lastReceivedAt	string (date-time) or null
lastSyncAt	string (date-time) or null
namerequired	string
oauthClientId	string
oauthClientSecretConfiguredrequired	boolean
oauthRefreshTokenConfiguredrequired	boolean
oauthTenantId	string
outboundDriverrequired	string
outboundPathrequired	string
passwordConfiguredrequired	boolean
pollIntervalSecondsrequired	integer
port	integer
publicIdrequired	string
queueId	string
scopeVerifiedrequired	boolean
serviceAccountConfiguredrequired	boolean
smtpHost	string
smtpPasswordConfiguredrequired	boolean
smtpPort	integer
smtpUseTlsrequired	boolean
smtpUsername	string
statusrequired	string
statusChangedAt	string (date-time) or null
statusReason	string
suspendedCountrequired	integer
tokenExpiresAt	string (date-time) or null
trustAllSenders	boolean or null
unknownSendersrequired	string
updatedAtrequired	string (date-time)
useTlsrequired	boolean
username	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mailboxes' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "address": "string",
  "authMode": "string",
  "defaultClientId": "string",
  "defaultPriority": "string",
  "defaultType": "string",
  "displayName": "string",
  "driver": "string",
  "enabled": false,
  "hideSubjectTag": false,
  "host": "string",
  "name": "string",
  "oauthClientId": "string",
  "oauthClientSecret": "string",
  "oauthRefreshToken": "string",
  "oauthTenantId": "string",
  "outboundDriver": "string",
  "password": "string",
  "pollIntervalSeconds": 0,
  "port": 0,
  "queueId": "string",
  "serviceAccountJson": "string",
  "smtpHost": "string",
  "smtpPassword": "string",
  "smtpPort": 0,
  "smtpUseTls": false,
  "smtpUsername": "string",
  "unknownSenders": "string",
  "useTls": false,
  "username": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "address": "string",
  "authMode": "string",
  "defaultClientId": "string",
  "defaultPriority": "string",
  "defaultType": "string",
  "displayName": "string",
  "driver": "string",
  "enabled": false,
  "hideSubjectTag": false,
  "host": "string",
  "name": "string",
  "oauthClientId": "string",
  "oauthClientSecret": "string",
  "oauthRefreshToken": "string",
  "oauthTenantId": "string",
  "outboundDriver": "string",
  "password": "string",
  "pollIntervalSeconds": 0,
  "port": 0,
  "queueId": "string",
  "serviceAccountJson": "string",
  "smtpHost": "string",
  "smtpPassword": "string",
  "smtpPort": 0,
  "smtpUseTls": false,
  "smtpUsername": "string",
  "unknownSenders": "string",
  "useTls": false,
  "username": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mailboxes' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/mailboxes"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "address": "string",
    "authMode": "string",
    "defaultClientId": "string",
    "defaultPriority": "string",
    "defaultType": "string",
    "displayName": "string",
    "driver": "string",
    "enabled": False,
    "hideSubjectTag": False,
    "host": "string",
    "name": "string",
    "oauthClientId": "string",
    "oauthClientSecret": "string",
    "oauthRefreshToken": "string",
    "oauthTenantId": "string",
    "outboundDriver": "string",
    "password": "string",
    "pollIntervalSeconds": 0,
    "port": 0,
    "queueId": "string",
    "serviceAccountJson": "string",
    "smtpHost": "string",
    "smtpPassword": "string",
    "smtpPort": 0,
    "smtpUseTls": False,
    "smtpUsername": "string",
    "unknownSenders": "string",
    "useTls": False,
    "username": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "address": "string",
  "authMode": "string",
  "defaultClientId": "string",
  "defaultPriority": "string",
  "defaultType": "string",
  "displayName": "string",
  "driver": "string",
  "enabled": false,
  "hideSubjectTag": false,
  "host": "string",
  "name": "string",
  "oauthClientId": "string",
  "oauthClientSecret": "string",
  "oauthRefreshToken": "string",
  "oauthTenantId": "string",
  "outboundDriver": "string",
  "password": "string",
  "pollIntervalSeconds": 0,
  "port": 0,
  "queueId": "string",
  "serviceAccountJson": "string",
  "smtpHost": "string",
  "smtpPassword": "string",
  "smtpPort": 0,
  "smtpUseTls": false,
  "smtpUsername": "string",
  "unknownSenders": "string",
  "useTls": false,
  "username": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mailboxes", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "address": "string",
    "authMode": "string",
    "defaultClientId": "string",
    "defaultPriority": "string",
    "defaultType": "string",
    "displayName": "string",
    "driver": "string",
    "enabled": false,
    "hideSubjectTag": false,
    "host": "string",
    "name": "string",
    "oauthClientId": "string",
    "oauthClientSecret": "string",
    "oauthRefreshToken": "string",
    "oauthTenantId": "string",
    "outboundDriver": "string",
    "password": "string",
    "pollIntervalSeconds": 0,
    "port": 0,
    "queueId": "string",
    "serviceAccountJson": "string",
    "smtpHost": "string",
    "smtpPassword": "string",
    "smtpPort": 0,
    "smtpUseTls": false,
    "smtpUsername": "string",
    "unknownSenders": "string",
    "useTls": false,
    "username": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "address": "string",
  "authMode": "string",
  "defaultClientId": "string",
  "defaultPriority": "string",
  "defaultType": "string",
  "displayName": "string",
  "driver": "string",
  "enabled": false,
  "hideSubjectTag": false,
  "host": "string",
  "name": "string",
  "oauthClientId": "string",
  "oauthClientSecret": "string",
  "oauthRefreshToken": "string",
  "oauthTenantId": "string",
  "outboundDriver": "string",
  "password": "string",
  "pollIntervalSeconds": 0,
  "port": 0,
  "queueId": "string",
  "serviceAccountJson": "string",
  "smtpHost": "string",
  "smtpPassword": "string",
  "smtpPort": 0,
  "smtpUseTls": false,
  "smtpUsername": "string",
  "unknownSenders": "string",
  "useTls": false,
  "username": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mailboxes");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/mailboxes/{mailboxID}

GETmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

getMailbox returns one mailbox, its health fields and its routing defaults.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, MailboxView	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

200 response body

Field	Type	Description
addressrequired	string
authModerequired	string
canaryLastSeenAt	string (date-time) or null
canaryLastSentAt	string (date-time) or null
connectedAccount	string
createdAtrequired	string (date-time)
defaultClientId	string
defaultClientName	string
defaultPriority	string
defaultType	string
displayName	string
driverrequired	string
enabledrequired	boolean
forwardAddress	string
hideSubjectTagrequired	boolean
host	string
lastError	string
lastPolledAt	string (date-time) or null
lastReceivedAt	string (date-time) or null
lastSyncAt	string (date-time) or null
namerequired	string
oauthClientId	string
oauthClientSecretConfiguredrequired	boolean
oauthRefreshTokenConfiguredrequired	boolean
oauthTenantId	string
outboundDriverrequired	string
outboundPathrequired	string
passwordConfiguredrequired	boolean
pollIntervalSecondsrequired	integer
port	integer
publicIdrequired	string
queueId	string
scopeVerifiedrequired	boolean
serviceAccountConfiguredrequired	boolean
smtpHost	string
smtpPasswordConfiguredrequired	boolean
smtpPort	integer
smtpUseTlsrequired	boolean
smtpUsername	string
statusrequired	string
statusChangedAt	string (date-time) or null
statusReason	string
suspendedCountrequired	integer
tokenExpiresAt	string (date-time) or null
trustAllSenders	boolean or null
unknownSendersrequired	string
updatedAtrequired	string (date-time)
useTlsrequired	boolean
username	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mailboxes/<mailboxID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mailboxes/<mailboxID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mailboxes/<mailboxID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/mailboxes/{mailboxID}

PATCHmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

patchMailbox edits a mailbox.

A change that would send a stored secret somewhere new must carry that secret again (E12).

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
address	string or null
authMode	string or null
defaultClientId	string or null
defaultPriority	string or null
defaultType	string or null
displayName	string or null
driver	string or null
enabled	boolean or null
hideSubjectTag	boolean or null
host	string or null
name	string or null
oauthClientId	string or null
oauthClientSecret	string or null
oauthRefreshToken	string or null
oauthTenantId	string or null
outboundDriver	string or null
password	string or null
pollIntervalSeconds	integer or null
port	integer or null
queueId	string or null
serviceAccountJson	string or null
smtpHost	string or null
smtpPassword	string or null
smtpPort	integer or null
smtpUseTls	boolean or null
smtpUsername	string or null
unknownSenders	string or null
useTls	boolean or null
username	string or null

Responses

Status	Body	Description
200	application/json, MailboxView	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

200 response body

Field	Type	Description
addressrequired	string
authModerequired	string
canaryLastSeenAt	string (date-time) or null
canaryLastSentAt	string (date-time) or null
connectedAccount	string
createdAtrequired	string (date-time)
defaultClientId	string
defaultClientName	string
defaultPriority	string
defaultType	string
displayName	string
driverrequired	string
enabledrequired	boolean
forwardAddress	string
hideSubjectTagrequired	boolean
host	string
lastError	string
lastPolledAt	string (date-time) or null
lastReceivedAt	string (date-time) or null
lastSyncAt	string (date-time) or null
namerequired	string
oauthClientId	string
oauthClientSecretConfiguredrequired	boolean
oauthRefreshTokenConfiguredrequired	boolean
oauthTenantId	string
outboundDriverrequired	string
outboundPathrequired	string
passwordConfiguredrequired	boolean
pollIntervalSecondsrequired	integer
port	integer
publicIdrequired	string
queueId	string
scopeVerifiedrequired	boolean
serviceAccountConfiguredrequired	boolean
smtpHost	string
smtpPasswordConfiguredrequired	boolean
smtpPort	integer
smtpUseTlsrequired	boolean
smtpUsername	string
statusrequired	string
statusChangedAt	string (date-time) or null
statusReason	string
suspendedCountrequired	integer
tokenExpiresAt	string (date-time) or null
trustAllSenders	boolean or null
unknownSendersrequired	string
updatedAtrequired	string (date-time)
useTlsrequired	boolean
username	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/mailboxes/<mailboxID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "address": "string",
  "authMode": "string",
  "defaultClientId": "string",
  "defaultPriority": "string",
  "defaultType": "string",
  "displayName": "string",
  "driver": "string",
  "enabled": false,
  "hideSubjectTag": false,
  "host": "string",
  "name": "string",
  "oauthClientId": "string",
  "oauthClientSecret": "string",
  "oauthRefreshToken": "string",
  "oauthTenantId": "string",
  "outboundDriver": "string",
  "password": "string",
  "pollIntervalSeconds": 0,
  "port": 0,
  "queueId": "string",
  "serviceAccountJson": "string",
  "smtpHost": "string",
  "smtpPassword": "string",
  "smtpPort": 0,
  "smtpUseTls": false,
  "smtpUsername": "string",
  "unknownSenders": "string",
  "useTls": false,
  "username": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "address": "string",
  "authMode": "string",
  "defaultClientId": "string",
  "defaultPriority": "string",
  "defaultType": "string",
  "displayName": "string",
  "driver": "string",
  "enabled": false,
  "hideSubjectTag": false,
  "host": "string",
  "name": "string",
  "oauthClientId": "string",
  "oauthClientSecret": "string",
  "oauthRefreshToken": "string",
  "oauthTenantId": "string",
  "outboundDriver": "string",
  "password": "string",
  "pollIntervalSeconds": 0,
  "port": 0,
  "queueId": "string",
  "serviceAccountJson": "string",
  "smtpHost": "string",
  "smtpPassword": "string",
  "smtpPort": 0,
  "smtpUseTls": false,
  "smtpUsername": "string",
  "unknownSenders": "string",
  "useTls": false,
  "username": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "address": "string",
    "authMode": "string",
    "defaultClientId": "string",
    "defaultPriority": "string",
    "defaultType": "string",
    "displayName": "string",
    "driver": "string",
    "enabled": False,
    "hideSubjectTag": False,
    "host": "string",
    "name": "string",
    "oauthClientId": "string",
    "oauthClientSecret": "string",
    "oauthRefreshToken": "string",
    "oauthTenantId": "string",
    "outboundDriver": "string",
    "password": "string",
    "pollIntervalSeconds": 0,
    "port": 0,
    "queueId": "string",
    "serviceAccountJson": "string",
    "smtpHost": "string",
    "smtpPassword": "string",
    "smtpPort": 0,
    "smtpUseTls": False,
    "smtpUsername": "string",
    "unknownSenders": "string",
    "useTls": False,
    "username": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "address": "string",
  "authMode": "string",
  "defaultClientId": "string",
  "defaultPriority": "string",
  "defaultType": "string",
  "displayName": "string",
  "driver": "string",
  "enabled": false,
  "hideSubjectTag": false,
  "host": "string",
  "name": "string",
  "oauthClientId": "string",
  "oauthClientSecret": "string",
  "oauthRefreshToken": "string",
  "oauthTenantId": "string",
  "outboundDriver": "string",
  "password": "string",
  "pollIntervalSeconds": 0,
  "port": 0,
  "queueId": "string",
  "serviceAccountJson": "string",
  "smtpHost": "string",
  "smtpPassword": "string",
  "smtpPort": 0,
  "smtpUseTls": false,
  "smtpUsername": "string",
  "unknownSenders": "string",
  "useTls": false,
  "username": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/mailboxes/<mailboxID>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "address": "string",
    "authMode": "string",
    "defaultClientId": "string",
    "defaultPriority": "string",
    "defaultType": "string",
    "displayName": "string",
    "driver": "string",
    "enabled": false,
    "hideSubjectTag": false,
    "host": "string",
    "name": "string",
    "oauthClientId": "string",
    "oauthClientSecret": "string",
    "oauthRefreshToken": "string",
    "oauthTenantId": "string",
    "outboundDriver": "string",
    "password": "string",
    "pollIntervalSeconds": 0,
    "port": 0,
    "queueId": "string",
    "serviceAccountJson": "string",
    "smtpHost": "string",
    "smtpPassword": "string",
    "smtpPort": 0,
    "smtpUseTls": false,
    "smtpUsername": "string",
    "unknownSenders": "string",
    "useTls": false,
    "username": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "address": "string",
  "authMode": "string",
  "defaultClientId": "string",
  "defaultPriority": "string",
  "defaultType": "string",
  "displayName": "string",
  "driver": "string",
  "enabled": false,
  "hideSubjectTag": false,
  "host": "string",
  "name": "string",
  "oauthClientId": "string",
  "oauthClientSecret": "string",
  "oauthRefreshToken": "string",
  "oauthTenantId": "string",
  "outboundDriver": "string",
  "password": "string",
  "pollIntervalSeconds": 0,
  "port": 0,
  "queueId": "string",
  "serviceAccountJson": "string",
  "smtpHost": "string",
  "smtpPassword": "string",
  "smtpPort": 0,
  "smtpUseTls": false,
  "smtpUsername": "string",
  "unknownSenders": "string",
  "useTls": false,
  "username": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/mailboxes/<mailboxID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/mailboxes/{mailboxID}

DELETEmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

deleteMailbox soft deletes.

A forward mailbox’s address is retired at Core too, best effort: a failure there is logged and the delete still happens.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/mailboxes/<mailboxID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/mailboxes/<mailboxID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/mailboxes/<mailboxID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mailboxes/{mailboxID}/connect/complete

POSTmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

connectComplete redeems the code Microsoft’s redirect carried back and binds the mailbox to the consented tenant.

Reconnecting this way never clears the cursor or IngestSince (E8.4): the backlog arrives through the normal fetch.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
coderequired	string

Responses

Status	Body	Description
200	application/json, MailboxView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	Cloud mailbox connections are not available on this Depot.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

200 response body

Field	Type	Description
addressrequired	string
authModerequired	string
canaryLastSeenAt	string (date-time) or null
canaryLastSentAt	string (date-time) or null
connectedAccount	string
createdAtrequired	string (date-time)
defaultClientId	string
defaultClientName	string
defaultPriority	string
defaultType	string
displayName	string
driverrequired	string
enabledrequired	boolean
forwardAddress	string
hideSubjectTagrequired	boolean
host	string
lastError	string
lastPolledAt	string (date-time) or null
lastReceivedAt	string (date-time) or null
lastSyncAt	string (date-time) or null
namerequired	string
oauthClientId	string
oauthClientSecretConfiguredrequired	boolean
oauthRefreshTokenConfiguredrequired	boolean
oauthTenantId	string
outboundDriverrequired	string
outboundPathrequired	string
passwordConfiguredrequired	boolean
pollIntervalSecondsrequired	integer
port	integer
publicIdrequired	string
queueId	string
scopeVerifiedrequired	boolean
serviceAccountConfiguredrequired	boolean
smtpHost	string
smtpPasswordConfiguredrequired	boolean
smtpPort	integer
smtpUseTlsrequired	boolean
smtpUsername	string
statusrequired	string
statusChangedAt	string (date-time) or null
statusReason	string
suspendedCountrequired	integer
tokenExpiresAt	string (date-time) or null
trustAllSenders	boolean or null
unknownSendersrequired	string
updatedAtrequired	string (date-time)
useTlsrequired	boolean
username	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/complete' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "code": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "code": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/complete' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/complete"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "code": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "code": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/complete", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/complete";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "code": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "code": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/complete");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mailboxes/{mailboxID}/connect/consent

POSTmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

connectConsent starts Microsoft admin consent (app) or a delegated sign-in.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
moderequired	string
returnPathrequired	string

Responses

Status	Body	Description
200	application/json, ConsentStart	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	Cloud mailbox connections are not available on this Depot.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

200 response body

Field	Type	Description
expiresAtrequired	string (date-time)
redirectUrlrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/consent' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "mode": "string",
  "returnPath": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "mode": "string",
  "returnPath": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/consent' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/consent"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "mode": "string",
    "returnPath": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "mode": "string",
  "returnPath": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/consent", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/consent";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "mode": "string",
    "returnPath": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "mode": "string",
  "returnPath": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/consent");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mailboxes/{mailboxID}/connect/forward

POSTmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

connectForward returns the forwarding address, minting it on the first call.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, MailboxForwardView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	Cloud mailbox connections are not available on this Depot.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

200 response body

Field	Type	Description
addressrequired	string
verification	MailboxForwardVerification	MailboxForwardVerification is the code and link Gmail mails to a new forwarding address; the owner confirms forwarding with either.
verification.coderequired	string
verification.urlrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/forward' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/forward' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/forward"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/forward", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/forward";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/forward");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/mailboxes/{mailboxID}/connect/google

GETmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

connectGoogle returns what a Google Workspace admin enters for domain-wide delegation, and the DNS proof Core needs first (R7).

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	Cloud mailbox connections are not available on this Depot.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mailboxes/{mailboxID}/connect/google/oauth/complete

POSTmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

connectGoogleOAuthComplete redeems the code Core’s redirect carried back and binds the mailbox to the Google account that signed in.

Core has already refused any account but the mailbox’s; the check is repeated here because the code is all the Depot is handed. Reconnecting this way never clears the cursor or IngestSince (E8.4).

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
coderequired	string

Responses

Status	Body	Description
200	application/json, MailboxView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	Cloud mailbox connections are not available on this Depot.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	The request failed.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

200 response body

Field	Type	Description
addressrequired	string
authModerequired	string
canaryLastSeenAt	string (date-time) or null
canaryLastSentAt	string (date-time) or null
connectedAccount	string
createdAtrequired	string (date-time)
defaultClientId	string
defaultClientName	string
defaultPriority	string
defaultType	string
displayName	string
driverrequired	string
enabledrequired	boolean
forwardAddress	string
hideSubjectTagrequired	boolean
host	string
lastError	string
lastPolledAt	string (date-time) or null
lastReceivedAt	string (date-time) or null
lastSyncAt	string (date-time) or null
namerequired	string
oauthClientId	string
oauthClientSecretConfiguredrequired	boolean
oauthRefreshTokenConfiguredrequired	boolean
oauthTenantId	string
outboundDriverrequired	string
outboundPathrequired	string
passwordConfiguredrequired	boolean
pollIntervalSecondsrequired	integer
port	integer
publicIdrequired	string
queueId	string
scopeVerifiedrequired	boolean
serviceAccountConfiguredrequired	boolean
smtpHost	string
smtpPasswordConfiguredrequired	boolean
smtpPort	integer
smtpUseTlsrequired	boolean
smtpUsername	string
statusrequired	string
statusChangedAt	string (date-time) or null
statusReason	string
suspendedCountrequired	integer
tokenExpiresAt	string (date-time) or null
trustAllSenders	boolean or null
unknownSendersrequired	string
updatedAtrequired	string (date-time)
useTlsrequired	boolean
username	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/complete' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "code": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "code": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/complete' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/complete"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "code": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "code": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/complete", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/complete";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "code": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "code": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/complete");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mailboxes/{mailboxID}/connect/google/oauth/start

POSTmailbox:manageshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

connectGoogleOAuthStart starts a Google sign-in for a Workspace mailbox.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
returnPathrequired	string

Responses

Status	Body	Description
200	application/json, ConsentStart	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	Cloud mailbox connections are not available on this Depot.
500	application/problem+json, ProblemDetails	The request failed.

200 response body

Field	Type	Description
expiresAtrequired	string (date-time)
redirectUrlrequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/start' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "returnPath": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "returnPath": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/start' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/start"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "returnPath": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "returnPath": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/start", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/start";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "returnPath": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "returnPath": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/oauth/start");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mailboxes/{mailboxID}/connect/google/verify-domain

POSTmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

connectGoogleVerify asks Core to look the domain’s TXT record up now.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	Cloud mailbox connections are not available on this Depot.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/verify-domain' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/verify-domain' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/verify-domain"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/verify-domain", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/verify-domain";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/google/verify-domain");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/mailboxes/{mailboxID}/connect/rbac-script

GETmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

connectRBACScript returns the PowerShell that scopes the Outpost Mail app to this one mailbox (R6).

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	Cloud mailbox connections are not available on this Depot.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/rbac-script' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/rbac-script' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/rbac-script"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/rbac-script", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/rbac-script";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/connect/rbac-script");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/mailboxes/{mailboxID}/health

GETmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

mailboxHealth is the health card: status, timings, the suspended backlog and the mailbox’s open alerts.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, object	Success.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

200 response body

Field	Type	Description
alertsrequired	array of MailboxAlertView
alerts[].kindrequired	string
alerts[].severityrequired	string
alerts[].sincerequired	string (date-time)
canaryLastSeenAt	string (date-time) or null
canaryLastSentAt	string (date-time) or null
consecutiveFailuresrequired	integer
lastReceivedAt	string (date-time) or null
lastSyncAt	string (date-time) or null
statusrequired	string
statusChangedAt	string (date-time) or null
statusReasonrequired	string
suspendedCountrequired	integer
tokenExpiresAt	string (date-time) or null

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/health' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/health' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/health"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/health", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/health";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/health");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/mailboxes/{mailboxID}/sender-rules

GETmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

listSenderRules returns a mailbox’s allow and block entries, oldest first.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mailboxes/{mailboxID}/sender-rules

POSTmailbox:manageshared facehosteditmspremote

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

createSenderRule allows or blocks one address or domain on a mailbox.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
kindrequired	string
matchTyperequired	string
valuerequired	string

Responses

Status	Body	Description
201	application/json, SenderRuleView	Created.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

201 response body

Field	Type	Description
createdAtrequired	string (date-time)
idrequired	string
kindrequired	string
matchTyperequired	string
valuerequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
curl -X POST 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "kind": "string",
  "matchType": "string",
  "value": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "kind": "string",
  "matchType": "string",
  "value": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "kind": "string",
    "matchType": "string",
    "value": "string",
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "kind": "string",
  "matchType": "string",
  "value": "string"
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "kind": "string",
    "matchType": "string",
    "value": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "kind": "string",
  "matchType": "string",
  "value": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

DELETE /api/v1/mailboxes/{mailboxID}/sender-rules/{ruleID}

DELETEmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

deleteSenderRule removes one rule.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.
ruleID	path	string	Yes	A uuid.

Responses

Status	Body	Description
204	None	Success, with no body.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X DELETE 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules/<ruleID>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Delete `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules/<ruleID>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules/<ruleID>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.delete(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodDelete, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules/<ruleID>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules/<ruleID>";

const response = await fetch(url, {
  method: "DELETE",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/sender-rules/<ruleID>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/mailboxes/{mailboxID}/test

POSTmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

testMailbox runs the connection test against the SAVED configuration.

Against the saved row and not against a request body, deliberately: a probe that took credentials inline would be an outbound connection to any host the caller names with any credentials they supply, which is a request forgery primitive dressed as a settings button.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
sendTest	boolean or null

Responses

Status	Body	Description
200	application/json, ProbeResult	Success.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
503	application/problem+json, ProblemDetails	Mail is not configured on this Depot, so a mailbox cannot be tested.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

200 response body

Field	Type	Description
okrequired	boolean
stepsrequired	array of ProbeStep
steps[].detail	string
steps[].messageKeyrequired	string
steps[].resultrequired	string
steps[].steprequired	string
testToken	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/test' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "sendTest": false
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "sendTest": false
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/test' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/test"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "sendTest": False,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "sendTest": false
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/test", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/test";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "sendTest": false
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "sendTest": false
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/test");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/mailboxes/{mailboxID}/test/{token}

GETmailbox:manageshared facehosteditmspremoteIdempotentToken in the path

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

testReceipt answers whether the send test’s message has arrived back.

Parameters

Name	In	Type	Required	Description
mailboxID	path	string	Yes	A uuid.
token	path	string	Yes

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	No client store in request context.
503	application/problem+json, ProblemDetails	Mail is not configured on this Depot.
507	application/problem+json, ProblemDetails	The storage profile for this client is over its configured quota. Raise the quota or remove attachments.

200 response body

Field	Type	Description
receivedrequired	boolean
receivedAt	string (date-time) or null

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/test/<token>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mailboxes/<mailboxID>/test/<token>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/test/<token>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/test/<token>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/mailboxes/<mailboxID>/test/<token>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mailboxes/<mailboxID>/test/<token>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/mailboxes/detect

GETmailbox:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

detectMailbox works out how an address can be connected.

Parameters

Name	In	Type	Required	Description
address	query	string	No

Responses

Status	Body	Description
200	application/json, DetectView	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold mailbox:manage.

200 response body

Field	Type	Description
consumerrequired	boolean
gatewayrequired	string
guidancerequired	array of string
methodsrequired	array of DetectMethodView
methods[].authModerequired	string
methods[].availablerequired	boolean
methods[].driverrequired	string
methods[].guidancerequired	array of string
methods[].recommendedrequired	boolean
methods[].unavailableReasonrequired	string
providerrequired	string
tenantFoundrequired	boolean

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/mailboxes/detect?address=<address>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/mailboxes/detect?address=<address>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/mailboxes/detect"
params = {
    "address": "<address>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/mailboxes/detect?address=<address>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/mailboxes/detect");
url.searchParams.set("address", "<address>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/mailboxes/detect?address=<address>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());