---
title: "Create a mailbox"
method: POST
path: "/api/mailboxes"
tags: ["Mailboxes"]
---

# Create a mailbox

`POST /api/mailboxes`

## Request

- Base URL: `https://api.sendly.now`
- URL: `https://api.sendly.now/api/mailboxes`
- Auth: one of:
  - API key in cookie `better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://app.sendly.now/api/auth/oauth2/authorize`, token URL `https://app.sendly.now/api/auth/oauth2/token`, scopes: `mailboxes:write`)

Provision a real receiving mailbox — `support@yourdomain.com` — on a domain you have already verified.

Three consequences worth knowing before you call it:

- **It changes how your domain's mail is routed.** The first mailbox on a domain turns receiving on for that domain, so mail addressed there starts arriving at Sendly instead of wherever it went before.
- **The domain must be verified.** An unverified domain answers 409; creating a mailbox is not a way to skip DNS.
- **Ten per project.** The eleventh answers 409. Deleted mailboxes free their slot; failed ones never consumed one.

Retrying a failed provision with the same address reclaims the failed row rather than answering 409 — but only for the same project and the same domain.

`quotaBytes` is accepted by the schema and REFUSED with a 400. Quotas are not implemented, and the field is still parsed so that asking for one is an error rather than a silently dropped key.

Requires the `mailboxes:write` scope — Create and delete mailboxes on your verified domains.

## Request body

- CreateMailboxBody
  - `displayName` string
  - `domainId` string, uuid, required: A VERIFIED domain belonging to this project.
  - `localPart` string, required: The part before the `@`, e.g. `support`. Lowercased server-side.
  - `projectId` string, uuid: Defaults to the project the credential resolves to. Naming a different one is refused.
  - `quotaBytes` integer: NOT IMPLEMENTED — sending any value answers 400.

## Response `201`

Mailbox provisioned

- object
  - `data` Mailbox, required: A receiving mailbox on one of the project's verified domains.
    - `address` string, email, required: The full mailbox address, e.g. `support@superbooks.io`.
    - `createdAt` string, date-time, required
    - `displayName` string, nullable, required
    - `domainId` string, uuid, required: The verified domain this mailbox lives on.
    - `id` string, uuid, required
    - `quotaBytes` number, nullable, required: Always null. Mailbox quotas are not implemented — the value was never applied to the mail account — so this field reports the absence rather than a number nothing enforces.
    - `status` 'PROVISIONING' | 'ACTIVE' | 'SUSPENDED' | 'FAILED', required: `PROVISIONING` while the mail account is being created, `ACTIVE` once it can receive, `SUSPENDED` when receiving is paused, `FAILED` when provisioning did not complete. A `FAILED` mailbox can be re-created with the same address — the retry reclaims the row.
  - `success` true, required

## Other responses

- `400`: Validation error
- `401`: Unauthorized — missing or invalid auth
- `403`: Forbidden — insufficient permissions or project disabled
- `404`: Resource not found
- `409`: The address already exists, the domain is not verified, or the project is at its 10-mailbox limit.
- `429`: Rate limit or billing limit exceeded
- `500`: Internal server error
- `502`: Provisioning failed in the mail server. The mailbox row is left `FAILED` and can be retried.

---

[API](https://skmtc.dev/sendly/apis/sendly-api.md) · [All operations](https://skmtc.dev/sendly/apis/sendly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendly/apis/sendly-api/revisions/ce7cfb7f7c7e?raw)