The one outbound door for a human, the AI SDR or an external agent: reply into a thread (conversation_sid) or start one (new_thread), exactly one of the two, else 422. channel picks the arm and kind must belong to it; a first email needs subject. A counterpart resolve that cannot ask gtm-api or playtables refuses the send whole (429 gtm_busy, 403 gtm_access_lost or gtm_scope_missing, 503 gtm_unavailable): try again later.

Guards: an agent-authored send whose reason is gone is refused first (409 message_superseded with context.cause: end the turn, a newer plan writes its own); a billing hold is 402; a live sender profile must hold an active account for the channel, else 409 sender_unavailable (a channel the thread has no account for is 422 on channel); an agent send is refused on a do_not_contact thread (409 stoplisted), past the per-thread auto-message cap (429 limit_exceeded) and where the agent is switched off (409 agent_disabled_on_thread). Mode gate: an agent-authored send on a copilot thread is stored as a pending_approval draft, a SUCCESS with result.gate = "pending_approval" (do not retry: a person approves it). A user-authored send always queues. The author is the JWT's, never the body's.

The answer is an accepted row, not a receipt: dispatch runs later (scheduled_at, the sender profile's pace) and re-checks the sender, a reply landed meanwhile and the stoplist. result.conversation is the thread, freshly created on the new_thread arm.

Contract:

• MCP tool send_message, registry package mcp.unibox/messages, mount unibox.inbox.
• Operation action, response envelope action.
• Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.