{"openapi":"3.0.0","info":{"version":"1.0.8","title":"mailsac API Specification","x-logo":{"url":"/img/mailsac-logo-v2.png","altText":"mailsac logo"},"description":"## About the API\n\nThe Mailsac API allows for interacting with Mailsac services, including checking email,\nemail validations, setting up forwarding addresses, receiving web socket email messages,\nand sending outbound mail.\n\n[**Get a free API key**](https://mailsac.com/api-keys)\n\nTest the Mailsac API online:\n\n* [**Swagger UI Explorer** →](https://mailsac.com/docs/swagger)\n\n**Base API Endpoint**:\n\n* `https://mailsac.com/api/`\n* _All API documentation is relative to this endpoint._\n\n**OpenAPI Spec**:\n\n* [Download JSON](https://mailsac.com/openapi.json)\n* [Download YAML](https://mailsac.com/openapi.yml)\n\n\n### Support and Resources\n\n* [npm Node.js and Browser library - @mailsac/api](https://www.npmjs.com/package/@mailsac/api)\n* [Full Documentation and Guides](https://docs.mailsac.com)\n* [Community Support and Discussion Forums](https://forum.mailsac.com/forums/)\n* [Web socket example in Node.js - ruffrey](https://github.com/ruffrey/mailsac-node-websocket-example)\n\nPaid Email Support, Pre-Sales\n > [email protected]\n\n[Terms of Service](https://docs.mailsac.com/en/latest/about/terms_of_service.html)\n\n[Privacy Policy](https://docs.mailsac.com/en/latest/about/privacy_policy.html)\n"},"servers":[{"url":"https://mailsac.com/api"}],"tags":[{"name":"Authentication Guide","description":"[API keys](https://mailsac.com/api-keys) are used to establish your identity with the Mailsac API.\n\nKeys can be passed as a header, querystring parameter, or request body json field.\n\n### API Key Format\n\nExample Key:\n\n> `k_eoj1mn7x5y61w0egs25j6xrv`\n\nAPI keys are alphanumeric, cryptographically-random tokens.\n\n\n## Get an API Key\n\n[All subscription levels, including free accounts, may create API keys.](https://mailsac.com/v2/credentials/keys)\nAPI keys cannot be managed by other API keys.\n\nGo to the [Credentials > API Keys & Users](https://mailsac.com/v2/credentials/keys) from the Dashboard to manage your account's API keys.\n\n### Multiple Keys\n\nThe Free and Indie tiers allow just one API key. That works fine for an individual developer or QA tester.\n\n[Some subscription tiers](https://mailasc.com/pricing) can create multiple API keys, and name each one - useful for managing many apps, users, and deployment environments.\n\nThere's no limit on the number of API credentials which can be generated for the tiers allowing more than one to be created.\n\n### API Website Logins\n\n[Some subscription tiers](https://mailasc.com/pricing) also allow API credentials to be used to log into the website user interface.\n\n\n## Auth Option 1: HTTP Header\n\nUse the API key as a request header named `Mailsac-Key`.\n\n```\nHTTP/1.x 200 OK\nGET /api/addresses/[email protected]/messages\nHost: mailsac.com\nMailsac-Key: k_eoj1mn7x5y61w0egs25j6xrv\n```\n\nCheck that your API key is working:\n\n```bash\ncurl --header \"Mailsac-Key: k_eoj1mn7x5y61w0egs25j6xrv\" https://mailsac.com/api/me\n```\n\nwhich will return a JSON object with your account details.\n\n```json\n{\n \"_id\": \"myaccount_name_here\",\n \"email\": \"[email protected]\"\n\n /* more props */\n}\n```\n\n## Auth Option 2: Query String Parameter\n\nIn the query section of the URL (after `?`) add a parameter for `_mailsacKey`.\n\n```bash\ncurl https://mailsac.com/api/addresses/[email protected]/messages?_mailsacKey=k_eoj1mn7x5y61w0egs25j6xrv\n```\n\nNote: this is the least secure option. We recommend using Option 1: HTTP Header.\n\n## Auth Option 3: Request JSON Body\n\nDuring a POST, PATCH, or PUT request, add a JSON field for `_mailsacKey`.\n\n```json\n{\n \"_mailsacKey\": \"k_eoj1mn7x5y61w0egs25j6xrv\",\n\n /* more POST, PUT props etc. */\n}\n```\n"},{"x-displayName":"Email Messages API","name":"Messages","description":"This section of the API deals with email messages. Mailsac parses messages into many formats,\nand can return various bits of metadata, like the sender, recipients, subject, headers, and\neven all the external links.\n\n#### Permissions and Disposability\n\nBy default, all emails sent to Mailsac are accepted and public. They are recycled regularly unless starred.\n\nSetting up a _custom domain_ or _private forwarding address_ means only you can see messages sent to it.\n\nAnyone can make API requests to view messages on a public (non-owned) inbox. Anyone can also delete messages from public inboxes.\n\nThrottling is frequently an issue on public inboxes. We strongly recommend using a custom domain or private forwarding address.\n"},{"x-displayName":"Email Addresses API","name":"Addresses","description":"This section contains APIs for creating and deleting enhanced private addresses, and configuring\nmessage routing.\n\nIt is not always necessary to create an email address\nusing these APIs. Mailsac will accept nearly any email. Creating an email address allows it to\nkept private. Its mail can be automatally routed to another email address, web sockets, webhooks,\nand Slack.\n"},{"x-displayName":"Email Validations API","name":"emailValidation","description":"This setion contains APIs to help determine is an email address is a valid format, whether\nit is a disposable address, and the domains or IP addresses it is associated with (in case\nyou want to do your own additional lookups or restrictions).\n\nThere are two routes for validating email addresses.\n\nThe GET route is for quickly testing in a web browser, or for testing one email address at a\ntime. The GET route will return a JSON object.\n\nThe POST route accepts an array of up to 50 email addresses and will return an array.\n"},{"x-displayName":"Domains API","name":"Domains","description":"This section contains APIs for managing custom domains. It is not complete and will be updated\nwith more endpoints soon.\n"},{"x-displayName":"Email Message Attachments","name":"Attachments","description":"This section contains APIs for finding and downloading email message attachments.\n"},{"x-displayName":"User Account API","name":"Account","description":"This section contains APIs related to the current user and account.\n"},{"x-displayName":"Email Stats API","name":"messageStats","description":"This section contains APIs for researching public disposable email. It may be most relevant for\nemail security researchers.\n"}],"paths":{"/addresses":{"get":{"operationId":"ListAddresses","tags":["Addresses"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"List all enhanced email addresses","description":"Get an array of enhanced private inbox address objects for the account.\n\nThese addresses must be setup (\"reserved\") using `POST /api/addresses/:email`, or\n[on the Add Email Address page](https://mailsac.com/private-address).\n","responses":{"200":{"description":"List of enhanced address objects","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailAddressList"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"}}}},"/addresses/{email}":{"parameters":[{"$ref":"#/components/parameters/EmailString"}],"get":{"operationId":"GetAddress","tags":["Addresses"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Fetch an address or check if it is reserved","responses":{"200":{"description":"Returns an object if owned by the current account, OR is not owned. Includes the `encryptedInbox` field. If not owned, will omit the `owner` key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailAddress"}}}},"401":{"description":"Returns 401 if owned by another account.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseBody"}}}}}},"post":{"operationId":"CreateAddress","tags":["Addresses"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Reserve (create/own) a private email address","description":"Sets the email address private and \"owned\" by the account. All messages which already exist,\nand any future messages which are received, will be private to this account only.\n\nAn email address must be reserved to be able to forward messages to another email address,\nSlack, web sockets, or webhooks. Public email addresses, and private email addresses under\na custom domain, are not routeable.\n","requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdatePrivateAddressForwarding"}}}},"responses":{"200":{"description":"Returns the newly created email address","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailAddress"}}}},"400":{"description":"Already reserved by the current user","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseBody"}}}},"401":{"description":"Owned by another account","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseBody"}}}}}},"put":{"operationId":"UpdateAddress","tags":["Addresses"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Update private email address forwarding and metadata","description":"For a private email address, set it to forward to another place.\n\nIt can be forwarded to another email (with `via mailsac` indicator), to a websocket, to a webhook,\nor to a Slack channel.\n","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdatePrivateAddressForwarding"}}}},"responses":{"200":{"description":"email forwarding successfully configured"},"401":{"$ref":"#/components/responses/UnauthorizedError"}}},"delete":{"operationId":"DeleteAddress","tags":["Addresses"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"parameters":[{"$ref":"#/components/parameters/DeleteAddressMessagesFlag"}],"summary":"Release an enhanced email address","description":"Removes this enhanced private address from ownership by the account. Any email received to the\naddress's inbox will be public in the future, unless the address was under a custom domain\nwhich is set private.\n","responses":{"200":{"description":"successfully released address"},"400":{"description":"Not currently owned by the current account, or already deleted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseBody"}}}},"401":{"description":"Owned by another account.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseBody"}}}}}}},"/addresses/{email}/availability":{"parameters":[{"$ref":"#/components/parameters/EmailString"}],"get":{"operationId":"CheckAvailability","tags":["Addresses"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Check address ownership","responses":{"200":{"$ref":"#/components/responses/EmailAddressAvailability"}}}},"/private-addresses-bulk":{"post":{"operationId":"CreateAddresses","tags":["Addresses"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Reserve multiple enhanced addresses","description":"Reserves multiple enhanced private addresses. The max addresses per request is 100.\n\nIt is not necessary to create enhanced addresses before receiving email. Enhanced addresses\nare only necessary to forward messages to another email address, Slack, web sockets, webhooks,\nor fetch messages over POP3.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"addresses":{"$ref":"#/components/schemas/EmailStringList"}}}}}},"responses":{"200":{"description":"Returns the newly created email addresses","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailAddressList"}}}},"400":{"description":"Not enough enhanced address credits","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponseBody"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"}}}},"/validations/addresses/{email}":{"parameters":[{"$ref":"#/components/parameters/EmailString"}],"get":{"operationId":"ValidateAddress","tags":["emailValidation"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Validate an email address and if it is disposable","description":"Determine whether an email address is a valid format, whether it is a disposable address,\nand the domains or IP addresses it is associated with.\n","responses":{"200":{"description":"EmailAddressIntegrity object","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailAddressIntegrity"}}}}}}},"/validations/addresses":{"post":{"operationId":"ValidateAddressesBulk","tags":["emailValidation"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Validate up to 50 email addresses","description":"Determine whether an email address is a valid format, whether it is a disposable address,\nand the domains or IP addresses it is associated with.\n","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"emails":{"$ref":"#/components/schemas/EmailStringList"}}}}}},"responses":{"200":{"description":"Array of EmailAddressIntegrity objects","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailAddressIntegrityList"}}}}}}},"/addresses/{email}/message-count":{"parameters":[{"$ref":"#/components/parameters/EmailString"}],"get":{"operationId":"CountMessages","tags":["Messages"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Count messages for an email inbox","description":"Get the number of messages for an email inbox address.\n**It is NOT necessary to reserve the address** before using this route. Whether it is an address on a custom domain, or a public domain, or mailsac.com, the mail can be counted as long as nobody else owns it.","responses":{"200":{"description":"Email messages","content":{"application/json":{"schema":{"properties":{"count":{"type":"number","example":3},"inbox":{"type":"string","example":"[email protected]"}}}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/OwnedByAnotherUser"}}}},"/addresses/{email}/messages":{"parameters":[{"$ref":"#/components/parameters/EmailString"},{"$ref":"#/components/parameters/Until"},{"$ref":"#/components/parameters/limit"}],"get":{"operationId":"ListMessages","tags":["Messages"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"List messages for an email inbox","description":"Get a list of messages for the email address. Messages are always **sorted in decending order by when they were received**, with the newest message always in the first position of the array.\n\nThe email message objects are abbreviated to provide basic meta data. To get more information about a specific message, use `GET /api/addresses/{email}/messages/{messageId}`.\n\n**It is NOT necessary to reserve the address** before checking mail! Whether it is an address on a custom domain, or a public domain, or mailsac.com, the mail can be checked with this route.","responses":{"200":{"description":"Email messages","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailMessageList"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"},"403":{"$ref":"#/components/responses/OwnedByAnotherUser"}}},"delete":{"operationId":"DeleteAllMessages","tags":["Messages"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Delete all messages for an email inbox","description":"This deletes all messages for a specific email address.\n\nThe address must be an owned address or an address in a owned domain.\nStarred messages will not be deleted. Use `DELETE /addresses/{email}/messages/{messageId}`\nto remove starred messages or unstar the messages before calling this route.\n","responses":{"204":{"description":"All non-starred messages deleted"},"401":{"$ref":"#/components/responses/UnauthorizedError"}}}},"/addresses/starred/messages":{"get":{"operationId":"ListStarredMessages","tags":["Messages"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"List starred (saved) messages on the account","description":"Get a list of messages that have been saved and made private for the entire account using the \"star message\" feature.\n\nMessages recieved via the Capture Service will also show up as starred IF the `capturePrivate` flag on the account is enabled.","responses":{"200":{"description":"List of email messages","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailMessageList"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"}}}},"/addresses/{email}/messages/{messageId}":{"parameters":[{"$ref":"#/components/parameters/EmailString"},{"$ref":"#/components/parameters/messageId"}],"get":{"operationId":"GetMessageMetadata","tags":["Messages"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Get email message metadata","description":"Retrieves metadata about a single email message. This route includes additional metadata\nnot available when listing messages, such as parsed links from the text or HTML body, and\nattachment md5sums.\n\nTo get even more information about message attachments, like filenames, see the\nAttachments API.\n\nTo get the entire original SMTP message, see the \"raw\" message route.\n","responses":{"200":{"description":"Email message full object","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EmailMessage"}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"},"404":{"$ref":"#/components/responses/MessageNotFound"}}},"delete":{"operationId":"DeleteMessage","tags":["Messages"],"security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"summary":"Delete an email message","description":"Deletes an individual email message. There is no trash or undo.","responses":{"200":{"description":"deletes an email message","content":{"application/json":{"schema":{"type":"object","properties":{"_id":{"$ref":"#/components/schemas/MessageId"},"inbox":{"$ref":"#/components/schemas/EmailString"},"message":{"type":"string","example":"Message was deleted."}}}}}},"401":{"$ref":"#/components/responses/UnauthorizedError"},"404":{"$ref":"#/components/responses/MessageNotFound"}}}},"/raw/{email}/{messageId}":{"parameters":[{"$ref":"#/components/parameters/EmailString"},{"$ref":"#/components/parameters/messageId"},{"$ref":"#/components/parameters/BrowserDownload"}],"get":{"operationId":"GetFullRawMessage","tags":["Messages"],"summary":"Get original SMTP message","description":"Gets the entire original SMTP message transport - everything that was sent over the network\nto Mailsac's inbound servers, plus any Mailsac-generated `Received` headers, and\nspecial `x-mailsac-*` headers.\n","security":[{"APIKeyQueryParam":[]},{"APIKeyHeader":[]}],"responses":{"200":{"description":"OK","content":{"text/plain":{"schema":{"type":"string","example":"Received: from 107.174.77.77 by frontend1-172-31-29-224 via 172.31.99.99 with\n HTTP id 1xyuM9Oexample for