InboxGuard Portfolio API

openapi: 3.2.0
info:
  title: InboxGuard Portfolio API
  version: 1.2.0
  summary: Email deliverability monitoring, DMARC reporting, and DNS authentication scanning.
  description: 'The InboxGuard REST API lets developers and AI agents run on-demand deliverability scans (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, and DNS blocklists), re-verify raw email headers, manage monitored domains, read DMARC aggregate reports, list alerts, and manage API keys.


    ## Authentication

    Authenticated endpoints accept an InboxGuard API key as a bearer token:


    ```

    Authorization: Bearer ig_live_xxxxxxxxxxxxxxxxxxxxxxxx

    ```


    Mint keys in the dashboard (Settings → API keys) or via `POST /api-keys`. Keys carry scopes: `read` (GET only) or `full` (all methods). See https://inboxguard.io/auth.md.


    ## Errors

    Every error returns the same structured envelope (`#/components/schemas/Error`): `{ "error": { "code": "RATE_LIMIT", "message": "...", "requestId": "..." } }`.


    ## Rate limits

    The anonymous `POST /scan-domain` endpoint allows 5 requests/hour per IP; authenticated callers get their plan''s hourly limit. `POST /scan-domain` responses carry `RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset` (and `X-RateLimit-*` equivalents); 429 responses add `Retry-After`.


    ## Idempotency

    `POST /scan-domain` accepts an optional `Idempotency-Key` header with real replay semantics: a retry with the same key from the same caller within 1 hour returns the stored response instead of re-running the scan, marked with an `Idempotency-Replayed: true` response header.


    ## Versioning

    The API uses unversioned, stable URLs (one surface — no `/v1` path prefix). The current API version is echoed on every response in the `API-Version` header. Additive, backward-compatible changes (new endpoints, new optional fields) ship continuously without a version bump. Breaking changes — when they are ever needed — ship under a NEW version that you opt into by sending an optional `Accept-Version` request header; the existing behaviour remains the default so unversioned callers are never broken. Omit `Accept-Version` to always get the current stable version. Upcoming breaking changes are announced in these docs and at https://inboxguard.io/llms-full.txt in advance.


    ## Pagination

    Only `GET /scans` is paginated: pass `?before=` (from the previous response''s `nextCursor`) to walk older scans. `GET /domains`, `GET /alerts`, and `GET /api-keys` return the full (limit-capped) list in one response — there are no `cursor` parameters.'
  termsOfService: https://inboxguard.io/terms
  contact:
    name: InboxGuard Support
    email: support@inboxguard.io
    url: https://inboxguard.io/contact
  license:
    name: Proprietary
    url: https://inboxguard.io/terms
  x-deprecation-policy: 'Unversioned, stable URLs. When an endpoint or field is ever deprecated, responses carry a ''Deprecation: true'' header and a ''Sunset: <HTTP-date>'' header marking the removal date — at least 6 months out — plus a ''Link: <url>; rel="deprecation"'' pointer to migration notes. Opt into a future breaking version with the optional ''Accept-Version'' request header. Nothing is deprecated today.'
servers:
- url: https://api.inboxguard.io
  description: Production
security:
- ApiKeyBearer: []
tags:
- name: Portfolio
  description: 'Agency portfolio: org-wide multi-domain rollup and client grouping.'
paths:
  /portfolio:
    get:
      tags:
      - Portfolio
      summary: Org-wide portfolio rollup
      operationId: getPortfolio
      description: 'Aggregate deliverability health across every monitored domain in the org: total/scored domain counts, average score, overall letter grade, grade distribution (A/B/C/D/F/unscored), total open alerts, the domains needing attention (lowest score / open alerts first), and a per-client-group breakdown. Readable by any org member.'
      security:
      - ApiKeyBearer: []
      responses:
        '200':
          description: Portfolio rollup.
          headers:
            API-Version:
              $ref: '#/components/headers/ApiVersion'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PortfolioRollup'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /portfolio/client-groups:
    get:
      tags:
      - Portfolio
      summary: List client groups
      operationId: listClientGroups
      description: List the org's client groups, each with a per-group rollup (domain count, average score, grade). Readable by any org member.
      security:
      - ApiKeyBearer: []
      responses:
        '200':
          description: Client groups.
          headers:
            API-Version:
              $ref: '#/components/headers/ApiVersion'
          content:
            application/json:
              schema:
                type: object
                required:
                - groups
                properties:
                  groups:
                    type: array
                    items:
                      $ref: '#/components/schemas/ClientGroup'
        '401':
          $ref: '#/components/responses/Unauthorized'
    post:
      tags:
      - Portfolio
      summary: Create a client group
      operationId: createClientGroup
      description: Create a client group to organize domains for an agency portfolio. Requires an owner/admin key with write or full scope.
      security:
      - ApiKeyBearer: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ClientGroupRequest'
            example:
              name: Acme Corp
              color: '#3366ff'
      responses:
        '201':
          description: Created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientGroup'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
  /portfolio/client-groups/{id}:
    parameters:
    - name: id
      in: path
      required: true
      description: Client group id (UUID).
      schema:
        type: string
        format: uuid
    delete:
      tags:
      - Portfolio
      summary: Delete a client group
      operationId: deleteClientGroup
      description: Delete a client group; its domains are ungrouped (not deleted). Requires an owner/admin key with write or full scope.
      security:
      - ApiKeyBearer: []
      responses:
        '200':
          description: Deleted.
          content:
            application/json:
              schema:
                type: object
                required:
                - deleted
                properties:
                  deleted:
                    type: boolean
                    enum:
                    - true
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
  /portfolio/domains/{id}/group:
    parameters:
    - name: id
      in: path
      required: true
      description: Monitored domain id (UUID, from GET /domains).
      schema:
        type: string
        format: uuid
    post:
      tags:
      - Portfolio
      summary: Assign or clear a domain's client group
      operationId: assignDomainClientGroup
      description: Assign a monitored domain to a client group, or clear it by passing `null`. The group must belong to the same org. Requires an owner/admin key with write or full scope.
      security:
      - ApiKeyBearer: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - clientGroupId
              properties:
                clientGroupId:
                  type:
                  - string
                  - 'null'
                  format: uuid
                  description: Target client group UUID, or null to ungroup.
            example:
              clientGroupId: 7c9e6679-7425-40de-944b-e07fc1f90ae7
      responses:
        '200':
          description: Assignment updated.
          content:
            application/json:
              schema:
                type: object
                required:
                - domainId
                - clientGroupId
                properties:
                  domainId:
                    type: string
                    format: uuid
                  clientGroupId:
                    type:
                    - string
                    - 'null'
                    format: uuid
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  schemas:
    ClientGroup:
      type: object
      description: A client group with its per-group rollup.
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
        color:
          type:
          - string
          - 'null'
          description: '#RRGGBB hex, or null.'
        createdAt:
          type: string
          format: date-time
        domainCount:
          type: integer
        avgScore:
          type:
          - integer
          - 'null'
          minimum: 0
          maximum: 100
        grade:
          type:
          - string
          - 'null'
          enum:
          - A
          - B
          - C
          - D
          - F
          - null
      required:
      - id
      - name
      - color
      - domainCount
    PortfolioGroupRollup:
      type: object
      description: Per-client-group rollup within the portfolio (the implicit 'Ungrouped' bucket has a null id).
      properties:
        id:
          type:
          - string
          - 'null'
          format: uuid
          description: Client group id, or null for the Ungrouped bucket.
        name:
          type: string
          description: Group name ('Ungrouped' for the implicit bucket).
        color:
          type:
          - string
          - 'null'
          description: '#RRGGBB hex, or null.'
        domainCount:
          type: integer
        avgScore:
          type:
          - integer
          - 'null'
          minimum: 0
          maximum: 100
        grade:
          type:
          - string
          - 'null'
          enum:
          - A
          - B
          - C
          - D
          - F
          - null
      required:
      - id
      - name
      - color
      - domainCount
      - avgScore
      - grade
    PortfolioRollup:
      type: object
      description: Org-wide deliverability rollup across every monitored domain (the JSON form of GET /portfolio).
      properties:
        domainCount:
          type: integer
          description: Total monitored domains in the org.
        scoredCount:
          type: integer
          description: How many of those domains have a score.
        avgScore:
          type:
          - integer
          - 'null'
          minimum: 0
          maximum: 100
          description: Average score across scored domains (null if none scored).
        overallGrade:
          type:
          - string
          - 'null'
          enum:
          - A
          - B
          - C
          - D
          - F
          - null
          description: Letter grade for the average score.
        gradeDistribution:
          type: object
          description: How many domains fall into each grade bucket.
          properties:
            A:
              type: integer
            B:
              type: integer
            C:
              type: integer
            D:
              type: integer
            F:
              type: integer
            unscored:
              type: integer
          required:
          - A
          - B
          - C
          - D
          - F
          - unscored
        openAlertsTotal:
          type: integer
          description: Sum of open alerts across all domains.
        attention:
          type: array
          description: Domains needing attention (lowest score / open alerts first).
          items:
            $ref: '#/components/schemas/PortfolioAttentionDomain'
        groups:
          type: array
          description: Per-client-group rollup, worst average first (includes the Ungrouped bucket).
          items:
            $ref: '#/components/schemas/PortfolioGroupRollup'
      required:
      - domainCount
      - scoredCount
      - avgScore
      - overallGrade
      - gradeDistribution
      - openAlertsTotal
      - attention
      - groups
    PortfolioAttentionDomain:
      type: object
      description: A monitored domain surfaced in the portfolio's attention list (low score or open alerts).
      properties:
        id:
          type: string
          format: uuid
        domain:
          type: string
        score:
          type:
          - integer
          - 'null'
          minimum: 0
          maximum: 100
          description: Latest 0–100 score (null if not yet scored).
        grade:
          type:
          - string
          - 'null'
          enum:
          - A
          - B
          - C
          - D
          - F
          - null
        openAlerts:
          type: integer
          description: Count of currently-open alerts on the domain.
        lastScanAt:
          type:
          - string
          - 'null'
          format: date-time
        clientGroupId:
          type:
          - string
          - 'null'
          format: uuid
        clientGroup:
          type:
          - string
          - 'null'
          description: Client group name, or null if ungrouped.
      required:
      - id
      - domain
      - score
      - grade
      - openAlerts
      - lastScanAt
      - clientGroupId
      - clientGroup
    Error:
      type: object
      description: Structured error envelope returned by every non-2xx response.
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: Stable machine-readable code.
              enum:
              - BAD_REQUEST
              - UNAUTHORIZED
              - FORBIDDEN
              - NOT_FOUND
              - CONFLICT
              - RATE_LIMIT
              - UPSTREAM_ERROR
              - INTERNAL_ERROR
              - SERVICE_UNAVAILABLE
              - DNS_TEMPORARY_FAILURE
            message:
              type: string
              description: Human-readable description.
            requestId:
              type: string
              description: Correlation id for support.
            details:
              description: Optional structured validation detail (e.g. zod field errors).
            retryAfterSeconds:
              type: integer
              description: Present on RATE_LIMIT responses.
          required:
          - code
          - message
      required:
      - error
    ClientGroupRequest:
      type: object
      description: Body for creating a client group.
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 80
          description: Group name.
        color:
          type: string
          pattern: ^#[0-9a-fA-F]{6}$
          description: 'Optional #RRGGBB hex color.'
      required:
      - name
  headers:
    ApiVersion:
      description: The API version that served this response. The URL surface is unversioned and stable; this header reports the current version so clients can detect breaking-change rollouts. Send the optional `Accept-Version` request header to pin a version once a future breaking version is published.
      schema:
        type: string
  responses:
    NotFound:
      description: Resource not found. Returns the structured error envelope with code `NOT_FOUND`.
      headers:
        API-Version:
          $ref: '#/components/headers/ApiVersion'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: Invalid request. Returns the structured error envelope with code `BAD_REQUEST`.
      headers:
        API-Version:
          $ref: '#/components/headers/ApiVersion'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: Authenticated but missing required scope or role. Returns the structured error envelope with code `FORBIDDEN`.
      headers:
        API-Version:
          $ref: '#/components/headers/ApiVersion'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Conflict:
      description: The request conflicts with existing state (e.g. a client group with that name already exists). Returns the structured error envelope with code `CONFLICT`.
      headers:
        API-Version:
          $ref: '#/components/headers/ApiVersion'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Missing or invalid credentials. Returns the structured error envelope with code `UNAUTHORIZED`.
      headers:
        API-Version:
          $ref: '#/components/headers/ApiVersion'
        WWW-Authenticate:
          schema:
            type: string
          description: Bearer resource_metadata="https://api.inboxguard.io/.well-known/oauth-protected-resource"
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    ApiKeyBearer:
      type: http
      scheme: bearer
      bearerFormat: InboxGuard API key (ig_live_… / ig_test_…)
      description: 'PRIMARY auth: send an InboxGuard API key as a bearer token (`Authorization: Bearer ig_live_…`). Scopes: `read` (GET) and `full` (all methods). Mint a key at https://inboxguard.io/settings or per https://inboxguard.io/auth.md.'
    OAuth2:
      type: oauth2
      description: 'OAuth-shaped wrapper around the same API key. The ONLY grant is client_credentials at POST https://api.inboxguard.io/oauth/token, where the client_secret IS an InboxGuard API key (HTTP Basic or body); the returned access_token is that same key. There is NO authorization_code flow, NO PKCE, and NO /oauth/authorize endpoint. Discovery: /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource on api.inboxguard.io. See https://inboxguard.io/auth.md.'
      flows:
        clientCredentials:
          tokenUrl: https://api.inboxguard.io/oauth/token
          scopes:
            read: Read-only access (GET).
            full: Full read/write access (all methods).
externalDocs:
  description: API quickstart and guides
  url: https://inboxguard.io/guides/api-quickstart