InboxGuard Alerts API

openapi: 3.2.0
info:
  title: InboxGuard Alerts API
  version: 1.2.0
  summary: Email deliverability monitoring, DMARC reporting, and DNS authentication scanning.
  description: 'The InboxGuard REST API lets developers and AI agents run on-demand deliverability scans (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, and DNS blocklists), re-verify raw email headers, manage monitored domains, read DMARC aggregate reports, list alerts, and manage API keys.


    ## Authentication

    Authenticated endpoints accept an InboxGuard API key as a bearer token:


    ```

    Authorization: Bearer ig_live_xxxxxxxxxxxxxxxxxxxxxxxx

    ```


    Mint keys in the dashboard (Settings → API keys) or via `POST /api-keys`. Keys carry scopes: `read` (GET only) or `full` (all methods). See https://inboxguard.io/auth.md.


    ## Errors

    Every error returns the same structured envelope (`#/components/schemas/Error`): `{ "error": { "code": "RATE_LIMIT", "message": "...", "requestId": "..." } }`.


    ## Rate limits

    The anonymous `POST /scan-domain` endpoint allows 5 requests/hour per IP; authenticated callers get their plan''s hourly limit. `POST /scan-domain` responses carry `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` (and `X-RateLimit-*` equivalents); 429 responses add `Retry-After`.


    ## Idempotency

    `POST /scan-domain` accepts an optional `Idempotency-Key` header with real replay semantics: a retry with the same key from the same caller within 1 hour returns the stored response instead of re-running the scan, marked with an `Idempotency-Replayed: true` response header.


    ## Versioning

    The API uses unversioned, stable URLs (one surface — no `/v1` path prefix). The current API version is echoed on every response in the `API-Version` header. Additive, backward-compatible changes (new endpoints, new optional fields) ship continuously without a version bump. Breaking changes — when they are ever needed — ship under a NEW version that you opt into by sending an optional `Accept-Version` request header; the existing behaviour remains the default so unversioned callers are never broken. Omit `Accept-Version` to always get the current stable version. Upcoming breaking changes are announced in these docs and at https://inboxguard.io/llms-full.txt in advance.


    ## Pagination

    Only `GET /scans` is paginated: pass `?before=` (from the previous response''s `nextCursor`) to walk older scans. `GET /domains`, `GET /alerts`, and `GET /api-keys` return the full (limit-capped) list in one response — there are no `cursor` parameters.'
  termsOfService: https://inboxguard.io/terms
  contact:
    name: InboxGuard Support
    email: support@inboxguard.io
    url: https://inboxguard.io/contact
  license:
    name: Proprietary
    url: https://inboxguard.io/terms
  x-deprecation-policy: 'Unversioned, stable URLs. When an endpoint or field is ever deprecated, responses carry a ''Deprecation: true'' header and a ''Sunset: <HTTP-date>'' header marking the removal date — at least 6 months out — plus a ''Link: <url>; rel="deprecation"'' pointer to migration notes. Opt into a future breaking version with the optional ''Accept-Version'' request header. Nothing is deprecated today.'
servers:
- url: https://api.inboxguard.io
  description: Production
security:
- ApiKeyBearer: []
tags:
- name: Alerts
  description: Posture-change alerts.
paths:
  /notification-channels:
    get:
      tags:
      - Alerts
      summary: List notification channels
      operationId: listNotificationChannels
      security:
      - ApiKeyBearer: []
      responses:
        '200':
          description: Channels.
          content:
            application/json:
              schema:
                type: object
                properties:
                  channels:
                    type: array
                    items:
                      $ref: '#/components/schemas/NotificationChannel'
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      tags:
      - Alerts
      summary: Create a notification channel
      operationId: createNotificationChannel
      description: Create a channel that alerts are delivered to (webhook, Slack, Teams, PagerDuty, SMS, email). Webhook deliveries are HMAC-signed — the response includes the `signing_secret` (see /webhooks.md). Requires an owner/admin key with write or full scope.
      security:
      - ApiKeyBearer: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NotificationChannelRequest'
            example:
              kind: webhook
              target: https://hooks.example.com/ig
              severity_filter:
              - critical
              - warn
      responses:
        '201':
          description: Created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationChannel'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /alerts:
    get:
      operationId: listAlerts
      tags:
      - Alerts
      summary: List alerts
      description: Returns the organization's alerts, newest first. Defaults to OPEN alerts only (`resolved=false`). Rows are snake_case and use `kind` (e.g. `score_drop`, `blocklist_listed`) plus `resolved_at` (null = open).
      parameters:
      - name: resolved
        in: query
        required: false
        description: '''false'' = open only (default), ''true'' = resolved only, ''all'' = both.'
        schema:
          type: string
          enum:
          - 'true'
          - 'false'
          - all
          default: 'false'
      - name: severity
        in: query
        required: false
        description: Filter by severity (default 'all').
        schema:
          type: string
          enum:
          - critical
          - warn
          - info
          - all
          default: all
      - name: entityType
        in: query
        required: false
        description: Filter by the entity the alert is about (default 'all').
        schema:
          type: string
          enum:
          - domain
          - org
          - user
          - all
          default: all
      - name: limit
        in: query
        required: false
        description: Max alerts to return (default 50, max 200).
        schema:
          type: integer
          minimum: 1
          maximum: 200
          default: 50
      - $ref: '#/components/parameters/AcceptVersion'
      responses:
        '200':
          description: Alert list
          headers:
            API-Version:
              $ref: '#/components/headers/ApiVersion'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertList'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /alerts/{id}:
    parameters:
    - name: id
      in: path
      required: true
      description: Alert id (UUID).
      schema:
        type: string
        format: uuid
    patch:
      operationId: resolveAlert
      tags:
      - Alerts
      summary: Resolve or reopen an alert
      description: 'Body `{ "resolved": true }` marks the alert resolved (preserving an earlier auto-resolve timestamp if present); `{ "resolved": false }` reopens it. Requires an owner/admin credential with the `full` scope.'
      parameters:
      - $ref: '#/components/parameters/AcceptVersion'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResolveAlertRequest'
            example:
              resolved: true
      responses:
        '200':
          description: Updated alert
          headers:
            API-Version:
              $ref: '#/components/headers/ApiVersion'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alert'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  headers:
    ApiVersion:
      description: The API version that served this response. The URL surface is unversioned and stable; this header reports the current version so clients can detect breaking-change rollouts. Send the optional `Accept-Version` request header to pin a version once a future breaking version is published.
      schema:
        type: string
  parameters:
    AcceptVersion:
      name: Accept-Version
      in: header
      required: false
      description: Optional API version opt-in. Omit to receive the current stable version (recommended). Send a specific version string only to opt into a future breaking-change version once one is published; unknown values fall back to the current stable version. The version actually served is echoed in the `API-Version` response header.
      schema:
        type: string
  responses:
    NotFound:
      description: Resource not found. Returns the structured error envelope with code `NOT_FOUND`.
      headers:
        API-Version:
          $ref: '#/components/headers/ApiVersion'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: Invalid request. Returns the structured error envelope with code `BAD_REQUEST`.
      headers:
        API-Version:
          $ref: '#/components/headers/ApiVersion'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    InternalServerError:
      description: Unexpected server error. Any unhandled failure is normalised by the root middleware into the structured error envelope with code `INTERNAL_ERROR` and a `requestId` for support.
      headers:
        API-Version:
          $ref: '#/components/headers/ApiVersion'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: INTERNAL_ERROR
              message: Internal server error
              requestId: 9f8c1b2a-3d4e-4f5a-8b6c-7d8e9f0a1b2c
    Forbidden:
      description: Authenticated but missing required scope or role. Returns the structured error envelope with code `FORBIDDEN`.
      headers:
        API-Version:
          $ref: '#/components/headers/ApiVersion'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Missing or invalid credentials. Returns the structured error envelope with code `UNAUTHORIZED`.
      headers:
        API-Version:
          $ref: '#/components/headers/ApiVersion'
        WWW-Authenticate:
          schema:
            type: string
          description: Bearer resource_metadata="https://api.inboxguard.io/.well-known/oauth-protected-resource"
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    ResolveAlertRequest:
      type: object
      properties:
        resolved:
          type: boolean
          description: true = mark resolved; false = reopen.
      required:
      - resolved
    AlertList:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Alert'
        total:
          type: integer
      required:
      - items
      - total
    NotificationChannelRequest:
      type: object
      required:
      - kind
      - target
      properties:
        kind:
          type: string
          enum:
          - email
          - slack
          - teams
          - webhook
          - pagerduty
          - sms
        target:
          type: string
          description: 'Destination matching `kind`: the webhook/Slack/Teams URL, PagerDuty integration key, phone number (E.164), or email address.'
        display_name:
          type: string
        severity_filter:
          type: array
          items:
            type: string
            enum:
            - info
            - warn
            - critical
          description: Which alert severities to deliver (default ["critical","warn"]).
        active:
          type: boolean
          default: true
    Alert:
      type: object
      description: One alert row (snake_case fields). An alert is open when resolved_at is null.
      properties:
        id:
          type: string
          format: uuid
        kind:
          type: string
          description: Alert category, e.g. score_drop, check_failed, blocklist_listed.
        severity:
          type: string
          enum:
          - critical
          - warn
          - info
        message:
          type: string
        details:
          type:
          - object
          - 'null'
          description: Structured context for the alert (returned by GET /alerts; omitted from the PATCH response).
        entity_type:
          type: string
          enum:
          - domain
          - org
          - user
        entity_id:
          type: string
          description: Id of the entity the alert is about (e.g. the domain UUID).
        created_at:
          type: string
          format: date-time
        resolved_at:
          type:
          - string
          - 'null'
          format: date-time
        escalated_at:
          type:
          - string
          - 'null'
          format: date-time
          description: Returned by GET /alerts; omitted from the PATCH response.
      required:
      - id
      - kind
      - severity
      - message
      - entity_type
      - entity_id
      - created_at
      - resolved_at
    Error:
      type: object
      description: Structured error envelope returned by every non-2xx response.
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: Stable machine-readable code.
              enum:
              - BAD_REQUEST
              - UNAUTHORIZED
              - FORBIDDEN
              - NOT_FOUND
              - CONFLICT
              - RATE_LIMIT
              - UPSTREAM_ERROR
              - INTERNAL_ERROR
              - SERVICE_UNAVAILABLE
              - DNS_TEMPORARY_FAILURE
            message:
              type: string
              description: Human-readable description.
            requestId:
              type: string
              description: Correlation id for support.
            details:
              description: Optional structured validation detail (e.g. zod field errors).
            retryAfterSeconds:
              type: integer
              description: Present on RATE_LIMIT responses.
          required:
          - code
          - message
      required:
      - error
    NotificationChannel:
      type: object
      required:
      - id
      - kind
      - target
      properties:
        id:
          type: string
          format: uuid
        kind:
          type: string
          enum:
          - email
          - slack
          - teams
          - webhook
          - pagerduty
          - sms
        target:
          type: string
        display_name:
          type:
          - string
          - 'null'
        severity_filter:
          type: array
          items:
            type: string
            enum:
            - info
            - warn
            - critical
        active:
          type: boolean
        created_at:
          type: string
          format: date-time
        signing_secret:
          type:
          - string
          - 'null'
          description: HMAC secret to verify webhook deliveries (kind=webhook only). See https://inboxguard.io/webhooks.md.
  securitySchemes:
    ApiKeyBearer:
      type: http
      scheme: bearer
      bearerFormat: InboxGuard API key (ig_live_… / ig_test_…)
      description: 'PRIMARY auth: send an InboxGuard API key as a bearer token (`Authorization: Bearer ig_live_…`). Scopes: `read` (GET) and `full` (all methods). Mint a key at https://inboxguard.io/settings or per https://inboxguard.io/auth.md.'
    OAuth2:
      type: oauth2
      description: 'OAuth-shaped wrapper around the same API key. The ONLY grant is client_credentials at POST https://api.inboxguard.io/oauth/token, where the client_secret IS an InboxGuard API key (HTTP Basic or body); the returned access_token is that same key. There is NO authorization_code flow, NO PKCE, and NO /oauth/authorize endpoint. Discovery: /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource on api.inboxguard.io. See https://inboxguard.io/auth.md.'
      flows:
        clientCredentials:
          tokenUrl: https://api.inboxguard.io/oauth/token
          scopes:
            read: Read-only access (GET).
            full: Full read/write access (all methods).
externalDocs:
  description: API quickstart and guides
  url: https://inboxguard.io/guides/api-quickstart