---
title: "List mailbox app passwords"
method: GET
path: "/mailboxes/{id}/app-passwords"
tags: ["Mailboxes"]
---

# List mailbox app passwords

`GET /mailboxes/{id}/app-passwords`

## Request

- Base URL: `https://shipmail.to/api/v1`
- URL: `https://shipmail.to/api/v1/mailboxes/{id}/app-passwords`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://shipmail.to/api/auth/oauth2/authorize`, token URL `https://shipmail.to/api/auth/oauth2/token`)

List revocable app-password metadata for one mailbox. Secret values are never returned.

## Headers

- `X-Shipmail-Organization` string

## Response `200`

Active and recoverable app-password metadata.

- object
  - `object` 'list', required
  - `data` MailboxAppPassword[], required
    - `object` 'mailbox_app_password', required
    - `id` string, required
    - `mailbox_id` string, required
    - `name` string, required
    - `state` 'pending_create' | 'active' | 'pending_revoke' | 'revoked' | 'failed', required
    - `purpose` 'operator_client', required
    - `expires_at` string, date-time, nullable, required
    - `allowed_cidrs` string[], required
    - `last_used_at` string, date-time, nullable, required
    - `created_at` string, date-time, required
    - `revoked_at` string, date-time, nullable, required

## Other responses

- `403`: Insufficient permissions.
- `404`: Resource not found.
- `409`: Resource conflict.
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/shipmail/apis/shipmail-api.md) · [All operations](https://skmtc.dev/shipmail/apis/shipmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shipmail/apis/shipmail-api/revisions/2c23e59d7e30?raw)