mails-ai API Keys API

openapi: 3.2.0
info:
  title: Mails.ai API Keys API
  version: 0.2.0
  description: 'The Mails.ai API gives AI agents a real email identity: send and receive

    transactional email. Mail received within your plan''s limits is scanned for prompt injection and

    reaches you as a typed event. With classification turned on (a paid-plan feature), new mail can also

    be read for intent; a reply in a thread never is.


    ## Authentication

    All endpoints take a Bearer API key:


    ```

    Authorization: Bearer mk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

    ```


    Keys carry one or more scopes — `send`, `read`, `draft` (writes drafts, but can neither send nor

    schedule one) and `manage` — and a mode: **live** (`mk_live_…`) or **test** (`mk_test_…`).


    ## Test mode

    A `mk_test_` key exercises the entire API — real validation, persisted resources, real

    `message.sent`/`*.received` events and webhooks — without sending real email or incurring cost. Build and

    test your whole integration on a test key, then flip one character to `mk_live_` to go live.

    `POST /v1/test/inbound` (test key only) lets you simulate inbound mail end-to-end.


    ## Idempotency

    Send endpoints accept an `Idempotency-Key` header; a repeated key replays the stored response instead of

    sending twice, with an `Idempotent-Replay: true` header.


    ## Pagination

    List endpoints are cursor-paginated: pass `limit` (1–100) and the `next_cursor` from the previous page.


    ## Errors

    Errors use a stable envelope: `{ "error": { "type", "code", "message", "param", "request_id" } }`. Every

    response carries an `X-Request-Id` header for support correlation.'
  contact:
    name: Mails.ai Support
    url: https://mails.ai
    email: support@mails.ai
  license:
    name: Proprietary
    identifier: LicenseRef-Proprietary
servers:
- url: https://api.mails.ai
  description: Production
security:
- bearerAuth: []
tags:
- name: API Keys
  description: Create, list, and revoke API keys.
paths:
  /v1/api-keys:
    post:
      tags:
      - API Keys
      summary: Create an API key
      operationId: createApiKey
      description: '**Requires scope:** `manage`. Creates a new API key. The plaintext `key` is returned ONCE in this response and never again. Closed to apps connected by sign-in (403 `connected_app_not_allowed`): use the dashboard, an API key or the mails CLI.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateApiKeyRequest'
            example:
              name: Production server
              scopes:
              - send
              - read
              mode: live
      responses:
        '201':
          description: The created key, including the one-time plaintext value.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKeyCreated'
              example:
                id: key_01JZXD7R9T1V3X5Z7B9D1F3H5K
                key: mk_live_a1b2c3d4e5f60718293a4b5c6d7e8f90
                prefix: mk_live_a1b2
                mode: live
                scopes:
                - send
                - read
                agent_id: null
                name: Production server
                expires_at: null
                created_at: '2026-06-24T17:20:00.000Z'
        '400':
          description: Invalid request — malformed JSON or a field failed validation. Also `feature_not_enabled` when this server has a feature switched off (custom domains before they are available).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: The API key lacks the required scope (`insufficient_scope`), or the token belongs to an app connected by sign-in and this operation is closed to connected apps (`connected_app_not_allowed`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found in this workspace, or the agent a send names is archived (`agent_archived`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      x-required-scope: manage
    get:
      tags:
      - API Keys
      summary: List API keys
      operationId: listApiKeys
      description: '**Requires scope:** `read`. Lists the workspace''s API keys, newest first, without their plaintext. A key tied to one agent lists only the keys tied to that same agent.'
      parameters:
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          minimum: 1
          maximum: 100
          default: 25
        description: Page size (1–100).
      - name: cursor
        in: query
        required: false
        schema:
          type: string
        description: Opaque cursor from a previous page's `next_cursor`.
      responses:
        '200':
          description: A page of API keys (plaintext never included).
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApiKey'
                    description: The items on this page, at most `limit` of them.
                  has_more:
                    type: boolean
                    description: 'True when more items follow this page: pass `next_cursor` as `cursor` to get them.'
                  next_cursor:
                    type: string
                    description: Pass as `cursor` to fetch the next page. Absent on the last page.
                required:
                - data
                - has_more
        '400':
          description: Invalid request — malformed JSON or a field failed validation. Also `feature_not_enabled` when this server has a feature switched off (custom domains before they are available).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: The API key lacks the required scope (`insufficient_scope`), or the token belongs to an app connected by sign-in and this operation is closed to connected apps (`connected_app_not_allowed`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      x-required-scope: read
  /v1/api-keys/{id}:
    delete:
      tags:
      - API Keys
      summary: Revoke an API key
      operationId: revokeApiKey
      description: '**Requires scope:** `manage`. Revokes a key immediately. Idempotent — revoking an already-revoked key returns its existing `revoked_at`. A test key cannot revoke a live key (403 `live_mode_required`): revoke it with a live key or in the dashboard.'
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: API key id.
      responses:
        '200':
          description: The revoked key.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: 'Id of the revoked key (`key_…`): the id in the path.'
                  revoked_at:
                    type: string
                    format: date-time
                    description: When the key was revoked; for a key already revoked, the original time.
                required:
                - id
                - revoked_at
        '401':
          description: Missing or invalid API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: The API key lacks the required scope (`insufficient_scope`), or the token belongs to an app connected by sign-in and this operation is closed to connected apps (`connected_app_not_allowed`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found in this workspace, or the agent a send names is archived (`agent_archived`).
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      x-required-scope: manage
components:
  schemas:
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            type:
              type: string
              enum:
              - invalid_request_error
              - authentication_error
              - permission_error
              - rate_limit_error
              - resource_error
              - payment_error
              - abuse_error
              - api_error
              description: High-level error category.
            code:
              type: string
              enum:
              - invalid_field
              - missing_field
              - missing_param
              - invalid_param_value
              - method_not_allowed
              - invalid_idempotency_key
              - duplicate_resource
              - slug_invalid
              - slug_reserved
              - slug_taken
              - agent_name_conflict
              - body_too_large
              - missing_authorization
              - missing_api_key
              - invalid_api_key
              - expired_api_key
              - revoked_api_key
              - invalid_access_token
              - email_not_verified
              - insufficient_scope
              - connected_app_not_allowed
              - sso_required
              - workspace_mismatch
              - agent_not_owned
              - rate_limit_exceeded
              - daily_limit_exceeded
              - hourly_limit_exceeded
              - monthly_limit_exceeded
              - agent_not_found
              - agent_paused
              - agent_archived
              - resource_not_found
              - recipient_suppressed
              - recipient_not_allowed
              - domain_not_verified
              - ses_role_not_assumable
              - ses_role_external_id_not_required
              - ses_permission_denied
              - ses_setup_failed
              - ses_message_rejected
              - ses_events_not_confirmed
              - payment_required
              - payment_method_failed
              - subscription_canceled
              - billing_state_inconsistent
              - free_tier_exceeded
              - plan_limit_exceeded
              - cold_email_prohibited
              - agent_suspended
              - new_workspace_fanout_exceeded
              - resource_cap_exceeded
              - workspace_cap_exceeded
              - feature_not_enabled
              - test_mode_required
              - live_mode_required
              - unknown_test_address
              - workspace_not_approved
              - spam_pattern_detected
              - classifier_rejected
              - high_injection_score
              - complaint_threshold_exceeded
              - bounce_threshold_exceeded
              - internal_error
              - internal_server_error
              - upstream_error
              - upstream_unavailable
              - service_unavailable
              description: Stable machine-readable error code.
            message:
              type: string
              description: Human-readable explanation.
            param:
              type:
              - string
              - 'null'
              description: The offending request field, when applicable.
            request_id:
              type: string
              description: Echo of the X-Request-Id header for support correlation.
            errors:
              type: array
              items:
                $ref: '#/components/schemas/FieldError'
              description: On a validation failure, EVERY offending field (not just the first). The top-level code/message/param mirror errors[0] for backward compatibility.
            resets_at:
              type:
              - string
              - 'null'
              format: date-time
              description: 'On every 429: when the limit lets the request through again (UTC). Null when waiting will not help, for a cap that only an upgrade or a deletion lifts.'
            retry_after_seconds:
              type:
              - integer
              - 'null'
              description: 'On every 429: the seconds until `resets_at`, null when it is null. On any other error that says how long to wait, such as a 503 `upstream_unavailable`: the seconds its `Retry-After` header gives.'
            upgrade_url:
              type: string
              format: uri
              description: 'On every 402: the dashboard page where the plan can be changed, `https://app.mails.ai/billing`.'
          required:
          - type
          - code
          - message
          description: 'The error, as every error response carries it: `type`, `code`, `message`, `param` and `request_id`, plus `errors` on a validation failure, `resets_at` and `retry_after_seconds` on a 429, `retry_after_seconds` on any other error with a `Retry-After`, and `upgrade_url` on a 402. A failed item in a batch send is the same error, and `retry_after_seconds` is how it says how long to wait, since an item has no headers of its own.'
      required:
      - error
    CreateApiKeyRequest:
      type: object
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 80
          description: A label for the key, 1 to 80 characters, returned as `name` wherever the key is listed. It need not be unique; left out, `name` is null.
        agent_id:
          type: string
          maxLength: 48
          description: 'Tie the key to one agent. Such a key reads and acts on that agent''s mail only: another agent''s message, thread, draft, attachment or raw email answers 404, as if it did not exist; lists and search hold its own agent''s mail; naming another agent in a filter is a 403. Webhooks and labels belong to the whole workspace, so it cannot create, change, delete, test or replay a webhook, redeliver an event, or create, rename or delete a label (403). Nor can it create an agent, change its own agent''s domain lists or send limits, read the request log, the workspace''s usage or the send-anyway list, add or revoke a send-anyway entry, revoke an API key, open billing, or add, verify or remove a domain (403), and another agent answers 404 to a change; its reputation and suppressed-recipient reads hold its own agent. The keys it makes are tied to the same agent. Leave it out for a key that reaches every agent.'
        scopes:
          type: array
          items:
            type: string
            enum:
            - send
            - read
            - manage
            - draft
          minItems: 1
          default:
          - send
          - read
          description: '`send` sends mail, `read` reads it, and `draft` writes drafts but can neither send nor schedule one. `manage` changes the workspace: it creates, changes and archives agents; creates and revokes API keys; creates, changes, tests and deletes webhooks and rotates their secrets; replays webhook deliveries and redelivers events; creates, renames and deletes labels; adds, verifies and removes domains; adds and removes send-anyway entries; opens the billing portal; lists and revokes connected apps; changes and deletes threads and drafts; and cancels and reschedules scheduled messages (rescheduling needs `send` too).'
        mode:
          type: string
          enum:
          - live
          - test
          default: live
          description: '`live` makes an `mk_live_…` key that sends real mail, and `test` an `mk_test_…` key whose sends are stored and raise events but are never transmitted or billed. A test key can only make test keys.'
        expires_at:
          type: string
          format: date-time
          description: 'When the key stops working: an ISO 8601 UTC time ending in `Z`. From then on it answers 401 `expired_api_key`; left out, the key never expires. A key that expires can only make keys that expire no later than it does.'
      additionalProperties: false
    ApiKeyCreated:
      type: object
      properties:
        id:
          type: string
          description: API key id (`key_…`); `DELETE /v1/api-keys/{id}` revokes the key.
        key:
          type: string
          description: The full plaintext API key. SHOWN ONCE — store it now; it cannot be retrieved again.
        prefix:
          type: string
          description: 'The first 12 characters of `key`: how the key is shown in lists once `key` is gone.'
        mode:
          type: string
          enum:
          - live
          - test
          description: 'The key''s mode: `live` unless the request asked for `test`. A test key''s sends are never transmitted or billed.'
        scopes:
          type: array
          items:
            type: string
            enum:
            - send
            - read
            - manage
            - draft
            - '*'
          description: 'The scopes the key holds: those requested, or `send` and `read` when none were.'
        agent_id:
          type:
          - string
          - 'null'
          description: The agent the key is tied to, or null for a key that reaches every agent.
        name:
          type:
          - string
          - 'null'
          description: The name given in the request, or null.
        expires_at:
          type:
          - string
          - 'null'
          description: When the key stops working, as given in the request. Null for a key that never expires.
        created_at:
          type: string
          description: When the key was created.
      required:
      - id
      - key
      - prefix
      - mode
      - scopes
      - created_at
    ApiKey:
      type: object
      properties:
        id:
          type: string
          description: API key id (`key_…`); `DELETE /v1/api-keys/{id}` revokes the key.
        prefix:
          type: string
          description: 'The key''s first 12 characters (e.g. `mk_live_a1b2`): the only part ever shown after creation.'
        name:
          type:
          - string
          - 'null'
          description: The label given when the key was created, or null.
        mode:
          type: string
          enum:
          - live
          - test
          description: '`live` or `test`, set when the key was created. A test key''s sends are stored but never transmitted or billed.'
        scopes:
          type: array
          items:
            type: string
            enum:
            - send
            - read
            - manage
            - draft
            - '*'
          description: The scopes the key holds, set when it was created; `*` passes every scope check.
        agent_id:
          type:
          - string
          - 'null'
          description: The agent the key is tied to (`agt_…`), or null for a key that reaches every agent.
        last_used_at:
          type:
          - string
          - 'null'
          description: When the key last authenticated a request. Null until its first use.
        expires_at:
          type:
          - string
          - 'null'
          description: When the key stops working (401 `expired_api_key` after that). Null for a key that never expires; an expired key stays in the list.
        revoked_at:
          type:
          - string
          - 'null'
          description: When the key was revoked, or null. Revoked keys stay in the list.
        created_at:
          type: string
          description: When the key was created.
      required:
      - id
      - prefix
      - mode
      - scopes
      - created_at
    FieldError:
      type: object
      properties:
        code:
          type: string
          enum:
          - invalid_field
          - missing_field
          - missing_param
          - invalid_param_value
          - method_not_allowed
          - invalid_idempotency_key
          - duplicate_resource
          - slug_invalid
          - slug_reserved
          - slug_taken
          - agent_name_conflict
          - body_too_large
          - missing_authorization
          - missing_api_key
          - invalid_api_key
          - expired_api_key
          - revoked_api_key
          - invalid_access_token
          - email_not_verified
          - insufficient_scope
          - connected_app_not_allowed
          - sso_required
          - workspace_mismatch
          - agent_not_owned
          - rate_limit_exceeded
          - daily_limit_exceeded
          - hourly_limit_exceeded
          - monthly_limit_exceeded
          - agent_not_found
          - agent_paused
          - agent_archived
          - resource_not_found
          - recipient_suppressed
          - recipient_not_allowed
          - domain_not_verified
          - ses_role_not_assumable
          - ses_role_external_id_not_required
          - ses_permission_denied
          - ses_setup_failed
          - ses_message_rejected
          - ses_events_not_confirmed
          - payment_required
          - payment_method_failed
          - subscription_canceled
          - billing_state_inconsistent
          - free_tier_exceeded
          - plan_limit_exceeded
          - cold_email_prohibited
          - agent_suspended
          - new_workspace_fanout_exceeded
          - resource_cap_exceeded
          - workspace_cap_exceeded
          - feature_not_enabled
          - test_mode_required
          - live_mode_required
          - unknown_test_address
          - workspace_not_approved
          - spam_pattern_detected
          - classifier_rejected
          - high_injection_score
          - complaint_threshold_exceeded
          - bounce_threshold_exceeded
          - internal_error
          - internal_server_error
          - upstream_error
          - upstream_unavailable
          - service_unavailable
          description: Stable machine-readable code for this field.
        message:
          type: string
          description: Human-readable explanation for this field.
        param:
          type:
          - string
          - 'null'
          description: The offending request field (dot-path), or null.
      required:
      - code
      - message
      - param
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: mk_live_<32 hex>, mk_test_<32 hex>, or moa_<48 hex>
      description: 'A Mails.ai API key, or an OAuth access token (`moa_…`, valid for 1 hour) from signing in through an app such as the CLI, Claude or ChatGPT. OAuth discovery: https://api.mails.ai/.well-known/oauth-authorization-server and https://api.mails.ai/.well-known/oauth-protected-resource. An access token''s OAuth scope maps onto these API scopes: `full_access` = `send` + `read` + `manage` (not `draft`: the draft routes take those three too), `send` = `send` + `read`, `read` = `read`. Scopes (`send`/`read`/`manage`/`draft`) are noted per operation via `x-required-scope`; when more than one scope opens an operation (the draft routes also take `draft`), `x-accepted-scopes` lists them all. `inbox` appears there too, on the triage routes (changing and trashing threads, labels, cancelling a scheduled send): only a signed-in dashboard session holds it (a workspace Member''s), never an API key or OAuth token, and `x-session-scopes` names it.'