---
title: "Finish connecting a Google Workspace mailbox"
method: POST
path: "/mailboxes/connect/google/callback/"
tags: ["senders"]
---

# Finish connecting a Google Workspace mailbox

`POST /mailboxes/connect/google/callback/`

## Request

- Base URL: `https://api.getoneprofile.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.getoneprofile.ai/mailboxes/connect/google/callback/`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Exchanges the OAuth code and creates (or reconnects) the mailbox.

## Request body

- GoogleConnectCallbackSchema
  - `code` string, required
  - `state` string, required

## Response `200`

Successful Response

- MailboxReadSchema
  - `bounce_rate` number, nullable: DSNs / accepted sends, lifetime.
  - `connection_status` 'connected' | 'disconnected', required: Whether the mailbox's grant currently authenticates.
  - `created_at` string, date-time, required
  - `daily_send_limit` integer, required
  - `disconnected_at` string, date-time, nullable, required
  - `disconnected_reason` string, nullable, required
  - `email_address` string, required
  - `id` string, uuid, required
  - `last_verified_at` string, date-time, nullable: When the grant last passed its check.
  - `provider` 'google_workspace' | 'google_workspace_dwd', required: Which email provider a mailbox connects through. Only Google Workspace ships so far; every provider is implemented behind ``providers.EmailProviderBase`` so Office 365 and IMAP/SMTP can be added later without touching callers. ``GOOGLE_WORKSPACE`` holds a per-mailbox OAuth grant (consent screen, refresh token). ``GOOGLE_WORKSPACE_DWD`` holds no grant at all: tokens are minted on demand via domain-wide delegation as the platform service account, so its rows carry an empty ``refresh_token`` forever. It is the path imported fleets (e.g. InboxKit) connect through.
  - `reply_rate` number, nullable: Genuine replies / accepted sends, lifetime.
  - `sender_profile_id` string, uuid, nullable, required
  - `updated_at` string, date-time, required
  - `usage` MailboxUsageReadSchema: Volume only; the ceiling it runs against is the mailbox's `daily_send_limit`.
    - `sent_today` integer, required
    - `sent_yesterday` integer, required

## Other responses

- `401`: Unauthorized
- `403`: The person did not grant send and read access.
- `422`: The OAuth state is invalid or expired.
- `500`: Internal server error.
- `502`: Google rejected the token exchange.
- `503`: Service unavailable.

---

[API](https://skmtc.dev/getoneprofile/apis/api-reference-oneprofile.md) · [All operations](https://skmtc.dev/getoneprofile/apis/api-reference-oneprofile/llms.txt) · [OpenAPI document](https://skmtc.dev/getoneprofile/apis/api-reference-oneprofile/revisions/4a6bd71e3f02?raw)