REST endpoints

All routes below are relative to /api/v1. Path identifiers are opaque.

Tool and resource routes

Method	Path
GET	/identity
GET	/mailboxes/{mbx_id}/messages
POST	/mailboxes/{mbx_id}/monitor_inbox
POST	/mailboxes/{mbx_id}/{wants_to_move|wants_to_copy|wants_to_expunge}
POST	/mailboxes/{mbx_id}/{move|copy|trash|spam|archive|set_flags}
POST	/mailboxes/{mbx_id}/{start_draft|reply_to_thread}
GET	/mailboxes/{mbx_id}/folders/list
GET	/mailboxes/{mbx_id}/attachments/{attachment_id}
GET	/drafts; /drafts/{drf_id}; /drafts/{drf_id}/content
POST	/drafts/{drf_id}/{edit_draft|patch_draft|discard_draft|wants_to_send_draft|send_draft}
DELETE	/drafts/{drf_id}
GET	/approvals; /approvals/{chk_id}; /approvals/{chk_id}/preview
POST	/approvals/monitor_approval; /approvals/{chk_id}/{cancel_approval|approval_commit}
POST	/mailboxes/{mbx_id}/{email.query|email.act|email.await}
POST	/approvals/email.requests

Account and organization routes

Authentication routes cover signup, login, logout, the current session, short-lived session tokens, organization switching, password reset and verification, and session revocation under /auth/*. There are no implemented /auth/mfa/* routes.

CRUD routes are available for /users/me, /org, /members, /invites, /agents, /tokens, and /mailboxes. Mailbox subresources cover credentials, provider authorization, connection tests, folder-role mapping, and grants. Organization OAuth clients and connected applications live below /org. Audit reads use /audit, /audit/export, and /audit/{evt_id}.

Webhook routes

Method	Path
GET, POST	/webhook-endpoints
GET, PATCH, DELETE	/webhook-endpoints/{whk_id}
POST	/webhook-endpoints/{whk_id}/rotate-secret
POST	/webhook-endpoints/{whk_id}/test
GET	/deliveries; /deliveries/{obx_id}
POST	/deliveries/{obx_id}/replay

This inventory is derived from the running route registry. Planned OpenAPI shapes are not included until a handler is registered.