Mailboxes

Create a mailbox app password

Create a revocable IMAP, SMTP, and JMAP credential. A mailbox can have at most five active app passwords. The secret is returned once in the 201 response and is never stored by Shipmail. Expiration defaults to 90 days and cannot exceed one year. Idempotency-Key is rejected because replaying a cached plaintext secret would violate the one-time-secret guarantee.

post/mailboxes/{id}/app-passwords

Request

  • Base URL: https://shipmail.to/api/v1
  • URL: https://shipmail.to/api/v1/mailboxes/{id}/app-passwords
  • Auth: one of:
    • HTTP bearer
    • OAuth 2 (authorization code, authorization URL https://shipmail.to/api/auth/oauth2/authorize, token URL https://shipmail.to/api/auth/oauth2/token)

Headers

X-Shipmail-Organizationstring

OAuth access tokens only. The organization ID this request acts on. Required when the OAuth connection was approved for several organizations (400 validation_error without it); optional with one. An organization the connection was not approved for returns 403 authorization_error. Ignored for API keys, which belong to one organization.

Request body

namestring required
expires_atstring date-time

Optional expiry. Defaults to 90 days and cannot exceed one year.

allowed_cidrsstring[]

Response

App password created. Save the secret now.

object'mailbox_app_password' required
idstring required
mailbox_idstring required
namestring required
state'pending_create' | 'active' | 'pending_revoke' | 'revoked' | 'failed' required
purpose'operator_client' required
expires_atstring date-time nullable required
allowed_cidrsstring[] required
last_used_atstring date-time nullable required
created_atstring date-time required
revoked_atstring date-time nullable required
secretstring required

One-time plaintext secret. Shipmail does not store or return it again.

Changes

No recorded changes to this operation across all 1 revision of this API.