inbox

Create Thread

Start a new thread. Checks DM permission for every thread_type.

2026-09-17 audit fix: this gate used to run only if body.thread_type == "direct", but thread_type is a free client-supplied string with no server-side allow-list — POSTing any other value (e.g. "enquiry") skipped the block/age-safety check entirely while still creating the thread and inserting the first message. _can_dm's own permissive fallback paths (shared activity, vendor ownership, existing thread, company-DM consent) already cover the legitimate non-"direct" business contexts, so running the same gate unconditionally closes the bypass without blocking any genuine flow.

post/api/inbox

Request

  • Base URL: https://api.activitia.net (the document declares no server; this is the origin it was published from)
  • URL: https://api.activitia.net/api/inbox
  • Auth: none declared

Headers

authorizationstring

Request body

recipient_idstring required
subjectstring nullable
bodystring nullable
thread_typestring
reference_idstring nullable
reference_typestring nullable

Response

Successful Response

unknown required

Changes

No recorded changes to this operation across all 1 revision of this API.