---
title: "Create a mailbox"
method: POST
path: "/mailboxes"
tags: ["Mailboxes"]
---

# Create a mailbox

`POST /mailboxes`

## Request

- Base URL: `https://shipmail.to/api/v1`
- URL: `https://shipmail.to/api/v1/mailboxes`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://shipmail.to/api/auth/oauth2/authorize`, token URL `https://shipmail.to/api/auth/oauth2/token`)

Create a new mailbox on a verified domain. Setting `password` also requires `mailbox_credentials:write`; `generate_password` needs only `mailboxes:write`. API keys created before 2026-09-29 may still set `password` with `mailboxes:write` alone; that exception is deprecated and will be removed.

## Headers

- `X-Shipmail-Organization` string

## Request body

- union
  - object
    - `domain_id` string, required: ID of the domain for this mailbox.
    - `address` string, required: Local part of the email address (e.g. hello for hello@example.com).
    - `password` string, password, required: Initial mailbox password. Must include lowercase, uppercase, and numeric characters; common passwords are rejected. It is never returned by the API.
    - `generate_password` true: Generate a strong primary password on the server and never return it. The operator can later set their own password.
    - `display_name` string: Display name for the mailbox.
  - object
    - `domain_id` string, required: ID of the domain for this mailbox.
    - `address` string, required: Local part of the email address (e.g. hello for hello@example.com).
    - `password` string, password: Initial mailbox password. Must include lowercase, uppercase, and numeric characters; common passwords are rejected. It is never returned by the API.
    - `generate_password` true, required: Generate a strong primary password on the server and never return it. The operator can later set their own password.
    - `display_name` string: Display name for the mailbox.

## Response `201`

Mailbox created.

- Mailbox
  - `object` 'mailbox', required
  - `id` string, required
  - `domain_id` string, required
  - `address` string, required
  - `display_name` string, nullable, required
  - `suspended_at` string, date-time, nullable, required: When the mailbox was suspended. Null if active.
  - `suspension_reasons` string[], required: Independent reasons currently keeping the mailbox suspended.
  - `auto_reply` object, required
    - `enabled` boolean, required
    - `subject` string, nullable, required
    - `body` string, nullable, required
    - `from_date` string, date-time, nullable, required
    - `to_date` string, date-time, nullable, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `403`: Plan quota exceeded.
- `422`: Validation failed.
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/shipmail/apis/shipmail-api.md) · [All operations](https://skmtc.dev/shipmail/apis/shipmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shipmail/apis/shipmail-api/revisions/2c23e59d7e30?raw)