Botmail Webhooks API

openapi: 3.2.0
info:
  title: Botmail Webhooks API
  version: 1.0.0
  summary: Gmail for AI agents.
  description: 'Real email mailboxes for AI agents. Agents claim an address with

    `POST /v1/claim`, a human claims it in the browser, then the same API key

    reads, sends and manages mail.


    **Errors** always look like `{"error": {"code", "message", "hint?", "details?"}}`.

    `code` is stable and machine-readable; `hint` says what to do next.

    429 responses carry `Retry-After` (seconds).


    **IDs** are prefixed strings: `acct_`, `mbx_`, `thr_`, `msg_`, `key_`, `clm_`.

    Times are RFC 3339 UTC.


    **Scopes**: `read`, `send`, `manage`. Pending claim keys (`bm_pending_…`)

    have `read` + `invite` until a human claims the mailbox, then they gain

    full access in place. `send` is dropped while the account is not `active`.

    Each operation lists its required scope.'
servers:
- url: https://botmail.pro
security:
- bearerAuth: []
- cookieAuth: []
tags:
- name: Webhooks
  description: 'Push events to your HTTPS endpoint.


    **Delivery**: `POST` with a JSON `WebhookEvent` body

    (`{id: "evt_", type, mailbox_id, thread_id, message_id, created_at, data}`).


    **Headers**:

    - `Botmail-Event-Id`: the event id (`evt_`); use it to de-duplicate.

    - `Botmail-Signature: t=,v1=` where

    `v1 = hex(HMAC-SHA256(secret, t + "." + raw_body))`. Verify against the

    raw request bytes and reject stale `t`.


    **Success** is any 2xx within 10 seconds. Failures are retried with

    exponential backoff (5 s, doubling, max 1 h). Events are delivered in

    order per webhook, so one failing event blocks later ones. After 20

    consecutive failures the webhook is disabled (`active: false`,

    `disabled_reason` set); re-enable with `PATCH {active: true}`.'
paths:
  /v1/webhooks:
    post:
      tags:
      - Webhooks
      operationId: createWebhook
      summary: Create a webhook
      description: 'Scope: manage. Not for pending keys. `url` must be https

        (`http://localhost` only in development). The response includes

        `secret` once; store it to verify signatures.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - url
              additionalProperties: false
              properties:
                url:
                  type: string
                  format: uri
                mailbox_id:
                  type: string
                  description: Only this mailbox. Omit for every mailbox the credential can access.
                events:
                  type: array
                  description: Default `["message.received"]`.
                  items:
                    $ref: '#/components/schemas/EventType'
      responses:
        '201':
          description: Created.
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/Webhook'
                - type: object
                  required:
                  - secret
                  properties:
                    secret:
                      type: string
                      description: '`whsec_…`. Shown only once.'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/Unprocessable'
    get:
      tags:
      - Webhooks
      operationId: listWebhooks
      summary: List webhooks
      description: 'Scope: manage. Not for pending keys.'
      responses:
        '200':
          description: Webhooks (no secrets).
          content:
            application/json:
              schema:
                type: object
                required:
                - webhooks
                properties:
                  webhooks:
                    type: array
                    items:
                      $ref: '#/components/schemas/Webhook'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /v1/webhooks/{id}:
    parameters:
    - $ref: '#/components/parameters/IdPath'
    patch:
      tags:
      - Webhooks
      operationId: updateWebhook
      summary: Update a webhook
      description: 'Scope: manage. Setting `active: true` re-enables a disabled webhook and resets `failures`.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties:
                active:
                  type: boolean
                events:
                  type: array
                  items:
                    $ref: '#/components/schemas/EventType'
      responses:
        '200':
          description: The updated webhook.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Webhook'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/Unprocessable'
    delete:
      tags:
      - Webhooks
      operationId: deleteWebhook
      summary: Delete a webhook
      description: 'Scope: manage.'
      responses:
        '200':
          description: Deleted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Deleted'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /v1/webhooks/{id}/test:
    post:
      tags:
      - Webhooks
      operationId: testWebhook
      summary: Send a test event
      description: 'Scope: manage. Sends one signed test delivery now and reports the result.'
      parameters:
      - $ref: '#/components/parameters/IdPath'
      responses:
        '200':
          description: Delivery result (also 200 when the endpoint failed; check `delivered`).
          content:
            application/json:
              schema:
                type: object
                required:
                - delivered
                - status_code
                - duration_ms
                properties:
                  delivered:
                    type: boolean
                  status_code:
                    type: integer
                    description: 0 if no HTTP response.
                  error:
                    type: string
                  duration_ms:
                    type: integer
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/RateLimited'
  /v1/webhooks/{id}/deliveries:
    get:
      tags:
      - Webhooks
      operationId: listWebhookDeliveries
      summary: Recent delivery attempts
      description: 'Scope: manage. Newest first.'
      parameters:
      - $ref: '#/components/parameters/IdPath'
      responses:
        '200':
          description: Delivery attempts.
          content:
            application/json:
              schema:
                type: object
                required:
                - deliveries
                properties:
                  deliveries:
                    type: array
                    items:
                      $ref: '#/components/schemas/WebhookDelivery'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
webhooks:
  mailboxEvent:
    post:
      tags:
      - Webhooks
      summary: Event delivered to your webhook URL
      description: 'Verify `Botmail-Signature` before trusting the body:

        `hex(HMAC-SHA256(secret, t + "." + raw_body)) == v1`. Respond 2xx

        within 10 seconds; anything else is retried (5 s doubling, max 1 h).

        De-duplicate on `Botmail-Event-Id`.'
      parameters:
      - name: Botmail-Signature
        in: header
        required: true
        schema:
          type: string
        example: t=1791590400,v1=5f2b…
      - name: Botmail-Event-Id
        in: header
        required: true
        schema:
          type: string
        example: evt_1234
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookEvent'
      responses:
        2XX:
          description: Accepted. Any 2xx marks the event delivered.
        default:
          description: Treated as a failure and retried.
components:
  responses:
    BadRequest:
      description: Invalid request (`bad_request` or a more specific code).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid credentials (`unauthorized`, `invalid_token`).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    RateLimited:
      description: Too many requests (`rate_limited`, `invite_limit`). Wait `Retry-After` seconds.
      headers:
        Retry-After:
          description: Seconds to wait.
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: 'The credential can''t do this (`forbidden`, `csrf`, `account_inactive`, …).

        Missing scopes are listed in `details.required_scope`; pending keys get

        a hint to wait for the claim.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: Not found or not accessible with this credential.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unprocessable:
      description: Well-formed but rejected; see `code` and `hint`.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    EventType:
      type: string
      enum:
      - message.received
      - message.sent
      - message.status
      - thread.updated
      - mailbox.claimed
    Webhook:
      type: object
      required:
      - id
      - url
      - mailbox_id
      - events
      - active
      - failures
      - last_seq
      - disabled_reason
      - created_at
      - last_delivery_at
      properties:
        id:
          type: string
        url:
          type: string
          format: uri
        mailbox_id:
          type:
          - string
          - 'null'
          description: Null = every mailbox.
        events:
          type: array
          items:
            $ref: '#/components/schemas/EventType'
        active:
          type: boolean
        failures:
          type: integer
          description: Consecutive failures; disabled at 20.
        last_seq:
          type: integer
          format: int64
          description: Last event delivered.
        disabled_reason:
          type:
          - string
          - 'null'
        created_at:
          type: string
          format: date-time
        last_delivery_at:
          type:
          - string
          - 'null'
          format: date-time
    WebhookDelivery:
      type: object
      required:
      - id
      - event_id
      - type
      - attempt
      - status_code
      - error
      - duration_ms
      - created_at
      properties:
        id:
          type: string
        event_id:
          type: string
        type:
          type: string
        attempt:
          type: integer
        status_code:
          type: integer
          description: 0 if no HTTP response.
        error:
          type:
          - string
          - 'null'
        duration_ms:
          type: integer
        created_at:
          type: string
          format: date-time
    Deleted:
      type: object
      required:
      - id
      - deleted
      properties:
        id:
          type: string
        deleted:
          type: boolean
          const: true
    Error:
      type: object
      required:
      - code
      - message
      properties:
        code:
          type: string
          description: Stable machine-readable code, e.g. `not_found`, `name_taken`, `rate_limited`.
        message:
          type: string
        hint:
          type: string
          description: What to do next.
        details:
          type: object
          additionalProperties: true
    ErrorResponse:
      type: object
      required:
      - error
      properties:
        error:
          $ref: '#/components/schemas/Error'
    WebhookEvent:
      type: object
      required:
      - id
      - type
      - mailbox_id
      - created_at
      - data
      properties:
        id:
          type: string
          description: '`evt_<seq>`; same as the Botmail-Event-Id header.'
        type:
          $ref: '#/components/schemas/EventType'
        mailbox_id:
          type: string
        thread_id:
          type:
          - string
          - 'null'
        message_id:
          type:
          - string
          - 'null'
        created_at:
          type: string
          format: date-time
        data:
          type: object
          additionalProperties: true
  parameters:
    IdPath:
      name: id
      in: path
      required: true
      schema:
        type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: '`Authorization: Bearer <key>` with an API key (`bm_live_…`) or a

        pending claim key (`bm_pending_…`). OAuth 2.1 access tokens

        (`bm_oat_…`) are audience-bound to the MCP endpoint `/mcp` and are

        rejected on `/v1`; MCP clients discover OAuth via

        `/.well-known/oauth-protected-resource/mcp`.

        '
    cookieAuth:
      type: apiKey
      in: cookie
      name: bm_session
      description: 'Web session for signed-in humans. Non-GET requests must send a JSON

        `Content-Type` or `X-Botmail-CSRF: 1` (403 csrf otherwise).

        '