Read the workspace inbound-mail address

The inbound-mail address of the workspace this credential is bound to, and whether mail sent to it is actually routed.

This is half of the agent control plane: an agent that wants documents to arrive by email reads this endpoint to learn the address to publish, and reads status to learn whether publishing it is worth anything.

Reading deliberately does not provision. The dashboard mints an address on demand; this endpoint never does, because an agent polling it would otherwise create a live inbound attack surface for a workspace that never asked for one. A workspace without an inbox answers status: "not_provisioned" and address: null; ask a human to open the inbox page once to create it.

status has three values and they are not interchangeable:

• active: an address exists and this deployment routes inbound mail to it.
• not_provisioned: inbound mail is configured, but this workspace has no address yet.
• unavailable: the deployment has no inbound mail domain configured. This outranks the other two: an address could still be formatted, but nothing would ever be delivered to it, so a caller that only checked for a non-null address would wait forever for mail that never routes.

The address format is inkseal-<10 lowercase alphanumerics>@<inbound domain>. Resolution of incoming mail is full-address only, so the domain matters as much as the local part.