> ## Documentation Index > Fetch the complete documentation index at: https://aisa.one/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > - Base URLs: models `https://api.aisa.one/v1` (Gemini GenerateContent: `https://api.aisa.one/v1beta`); data APIs `https://api.aisa.one/apis/v1`. The `servers` of each operation in https://aisa.one/openapi.yaml is authoritative. > - Auth: `Authorization: Bearer $AISA_API_KEY`. Never print, log, or commit the key. > - MCP (preferred for agents): `https://mcp.aisa.one/mcp`, signed in with OAuth, so there is no key to paste. > - Agent Skill: `npx skills add AIsa-team/agent-skills --skill aisa`. Fallback with the AIsa CLI: `aisa skills install aisa`. > - Spending: docs, https://aisa.one/models, https://aisa.one/api, `/v1/models`, and MCP `search`, `list_categories`, `get_details`, `batch_quote`, and the `account` operation are free. Quote the exact calls before running them (MCP `batch_quote`, CLI `aisa quote --json`). If the quote reports `auto_execute_eligible: true`, run it unless the user set a tighter limit or asked only for a quote. Otherwise, tell the user in one message the planned calls, the quoted price, and a total USD budget for the task, then wait for approval. Direct HTTP calls follow the stricter rule at https://aisa.one/docs/get-started/cli.md#direct-http-fallback. Do not make paid calls to test availability. Full rule: https://aisa.one/llms.txt # List And Create Inbox API Keys > Retrieve a list of API keys for a specific inbox or create a new API key with optional permissions and name. Published reference price: $0.012 USD per successful request. Account-specific pricing and final settlement may differ. ## Request contract * **Method and path:** POST /apis/v1/agentmail/inboxes/\{inbox\_id}/api-keys * **Availability:** enabled * **Request URL template:** [https://api.aisa.one/apis/v1/agentmail/inboxes/\{inbox\_id\}/api-keys](https://api.aisa.one/apis/v1/agentmail/inboxes/\{inbox\_id\}/api-keys) * **inbox\_id:** path; required * **Runtime facts:** 18a04e28941fae19674c11246b677373368b6bd927b7c146220cec1f168f4639 [Complete OpenAPI definition](https://aisa.one/docs/openapi/agentmail.json) Effective request and pricing declaration (including authentication and referenced schemas): ```json theme={null} { "operationId": "post_any_agentmail_apis_v1_agentmail_inboxes_inbo_5d0d22", "method": "POST", "path": "/apis/v1/agentmail/inboxes/{inbox_id}/api-keys", "servers": [ { "url": "https://api.aisa.one" } ], "parameters": [ { "in": "path", "name": "inbox_id", "required": true, "schema": { "description": "The ID of the inbox.", "title": "InboxId", "type": "string" } } ], "security": [ { "bearerAuth": [] } ], "requestBody": { "content": { "application/json": { "schema": { "description": "A body with `public_key` registers a public-key credential; any other\nbody mints a bearer key.", "oneOf": [ { "description": "`expires_at` must be in the future and is immutable once the key exists.\nOmitted, the new key inherits the authenticating key's expiry, and never\nexpires only when that key never does. A key cannot create one that\noutlives it: an `expires_at` later than the authenticating key's own\nreturns `403`.", "properties": { "expires_at": { "description": "Time at which api key expires. Omitted when it does not expire.", "format": "date-time", "title": "ExpiresAt", "type": "string" }, "name": { "description": "Name of api key.", "title": "Name", "type": "string" }, "permissions": { "description": "Granular permissions for the API key. When ommitted all permissions are granted. Otherwise, only permissions set to true are granted.", "properties": { "account_update": { "description": "Update accounts: disable or re-enable an inbox's sign-in at an app. Reading accounts\nneeds only `inbox_read`.", "type": "boolean" }, "api_key_create": { "description": "Create API keys.", "type": "boolean" }, "api_key_delete": { "description": "Delete API keys.", "type": "boolean" }, "api_key_read": { "description": "Read API keys.", "type": "boolean" }, "api_key_update": { "description": "Update API keys.", "type": "boolean" }, "app_connect": { "description": "Sign in to apps as an inbox: connect an app, authorize an inbox, and mint the\nsign-in keys. Omitted on a new bearer key means false, whatever else the key holds.", "type": "boolean" }, "app_share_owner": { "description": "Share the organization owner's name and email with apps at sign-in. One permission\nfor both values.", "type": "boolean" }, "calendar_event_create": { "description": "Create calendar events.", "type": "boolean" }, "calendar_event_delete": { "description": "Delete calendar events.", "type": "boolean" }, "calendar_event_read": { "description": "Read calendar events, and receive `calendar.event.*` webhook and WebSocket events.", "type": "boolean" }, "calendar_event_update": { "description": "Update calendar events and respond to invitations.", "type": "boolean" }, "calendar_read": { "description": "Read inbox calendar settings.", "type": "boolean" }, "calendar_update": { "description": "Update inbox calendar settings.", "type": "boolean" }, "domain_create": { "description": "Create domains.", "type": "boolean" }, "domain_delete": { "description": "Delete domains.", "type": "boolean" }, "domain_read": { "description": "Read domain details.", "type": "boolean" }, "domain_update": { "description": "Update domains.", "type": "boolean" }, "draft_create": { "description": "Create drafts.", "type": "boolean" }, "draft_delete": { "description": "Delete drafts.", "type": "boolean" }, "draft_read": { "description": "Read drafts.", "type": "boolean" }, "draft_send": { "description": "Send drafts.", "type": "boolean" }, "draft_update": { "description": "Update drafts.", "type": "boolean" }, "inbox_create": { "description": "Create new inboxes.", "type": "boolean" }, "inbox_delete": { "description": "Delete inboxes.", "type": "boolean" }, "inbox_read": { "description": "Read inbox details.", "type": "boolean" }, "inbox_update": { "description": "Update inbox settings.", "type": "boolean" }, "label_blocked_read": { "description": "Access messages labeled blocked.", "type": "boolean" }, "label_spam_read": { "description": "Access messages labeled spam.", "type": "boolean" }, "label_trash_read": { "description": "Access messages labeled trash.", "type": "boolean" }, "label_unauthenticated_read": { "description": "Access messages labeled unauthenticated.", "type": "boolean" }, "list_entry_create": { "description": "Create list entries.", "type": "boolean" }, "list_entry_delete": { "description": "Delete list entries.", "type": "boolean" }, "list_entry_read": { "description": "Read list entries.", "type": "boolean" }, "message_delete": { "description": "Delete messages. Also required to delete threads.", "type": "boolean" }, "message_read": { "description": "Read messages. Also required to read threads.", "type": "boolean" }, "message_reply": { "description": "Reply and reply-all when the request is signed with a registered public key. Bearer keys reply with `message_send`.", "type": "boolean" }, "message_send": { "description": "Send messages.", "type": "boolean" }, "message_update": { "description": "Update message labels. Also required to update threads.", "type": "boolean" }, "metrics_read": { "description": "Read metrics.", "type": "boolean" }, "pod_create": { "description": "Create pods.", "type": "boolean" }, "pod_delete": { "description": "Delete pods.", "type": "boolean" }, "pod_read": { "description": "Read pods.", "type": "boolean" }, "pod_update": { "description": "Update pods.", "type": "boolean" }, "webhook_create": { "description": "Create webhooks.", "type": "boolean" }, "webhook_delete": { "description": "Delete webhooks.", "type": "boolean" }, "webhook_read": { "description": "Read webhook configurations.", "type": "boolean" }, "webhook_update": { "description": "Update webhooks.", "type": "boolean" } }, "title": "ApiKeyPermissions", "type": "object" } }, "title": "CreateBearerApiKeyRequest", "type": "object" }, { "description": "Registers a public P-256 JWK at the route's scope. `type` and\n`api_key_id` are server-owned. `name` defaults to\n`AgentID key {first eight fingerprint characters}`; `permissions`\ndefaults to the registering key's, and only grants it holds may be\ntrue; `expires_at` defaults to the registering key's expiry and is\nindependent of that key afterward.", "properties": { "client_id": { "description": "Caller-chosen alias for a public key, unique within the organization and\nreusable after deletion. Accepted in place of `api_key_id` on get, update,\nand delete. Registration is idempotent on it: the same alias returns the\nexisting key, a conflicting one returns `409`. URL-safe; no slash or `@`.", "title": "PublicKeyClientId", "type": "string" }, "expires_at": { "description": "Time at which api key expires. Omitted when it does not expire.", "format": "date-time", "title": "ExpiresAt", "type": "string" }, "name": { "description": "Name of api key.", "title": "Name", "type": "string" }, "permissions": { "description": "Granular permissions for the API key. When ommitted all permissions are granted. Otherwise, only permissions set to true are granted.", "properties": { "account_update": { "description": "Update accounts: disable or re-enable an inbox's sign-in at an app. Reading accounts\nneeds only `inbox_read`.", "type": "boolean" }, "api_key_create": { "description": "Create API keys.", "type": "boolean" }, "api_key_delete": { "description": "Delete API keys.", "type": "boolean" }, "api_key_read": { "description": "Read API keys.", "type": "boolean" }, "api_key_update": { "description": "Update API keys.", "type": "boolean" }, "app_connect": { "description": "Sign in to apps as an inbox: connect an app, authorize an inbox, and mint the\nsign-in keys. Omitted on a new bearer key means false, whatever else the key holds.", "type": "boolean" }, "app_share_owner": { "description": "Share the organization owner's name and email with apps at sign-in. One permission\nfor both values.", "type": "boolean" }, "calendar_event_create": { "description": "Create calendar events.", "type": "boolean" }, "calendar_event_delete": { "description": "Delete calendar events.", "type": "boolean" }, "calendar_event_read": { "description": "Read calendar events, and receive `calendar.event.*` webhook and WebSocket events.", "type": "boolean" }, "calendar_event_update": { "description": "Update calendar events and respond to invitations.", "type": "boolean" }, "calendar_read": { "description": "Read inbox calendar settings.", "type": "boolean" }, "calendar_update": { "description": "Update inbox calendar settings.", "type": "boolean" }, "domain_create": { "description": "Create domains.", "type": "boolean" }, "domain_delete": { "description": "Delete domains.", "type": "boolean" }, "domain_read": { "description": "Read domain details.", "type": "boolean" }, "domain_update": { "description": "Update domains.", "type": "boolean" }, "draft_create": { "description": "Create drafts.", "type": "boolean" }, "draft_delete": { "description": "Delete drafts.", "type": "boolean" }, "draft_read": { "description": "Read drafts.", "type": "boolean" }, "draft_send": { "description": "Send drafts.", "type": "boolean" }, "draft_update": { "description": "Update drafts.", "type": "boolean" }, "inbox_create": { "description": "Create new inboxes.", "type": "boolean" }, "inbox_delete": { "description": "Delete inboxes.", "type": "boolean" }, "inbox_read": { "description": "Read inbox details.", "type": "boolean" }, "inbox_update": { "description": "Update inbox settings.", "type": "boolean" }, "label_blocked_read": { "description": "Access messages labeled blocked.", "type": "boolean" }, "label_spam_read": { "description": "Access messages labeled spam.", "type": "boolean" }, "label_trash_read": { "description": "Access messages labeled trash.", "type": "boolean" }, "label_unauthenticated_read": { "description": "Access messages labeled unauthenticated.", "type": "boolean" }, "list_entry_create": { "description": "Create list entries.", "type": "boolean" }, "list_entry_delete": { "description": "Delete list entries.", "type": "boolean" }, "list_entry_read": { "description": "Read list entries.", "type": "boolean" }, "message_delete": { "description": "Delete messages. Also required to delete threads.", "type": "boolean" }, "message_read": { "description": "Read messages. Also required to read threads.", "type": "boolean" }, "message_reply": { "description": "Reply and reply-all when the request is signed with a registered public key. Bearer keys reply with `message_send`.", "type": "boolean" }, "message_send": { "description": "Send messages.", "type": "boolean" }, "message_update": { "description": "Update message labels. Also required to update threads.", "type": "boolean" }, "metrics_read": { "description": "Read metrics.", "type": "boolean" }, "pod_create": { "description": "Create pods.", "type": "boolean" }, "pod_delete": { "description": "Delete pods.", "type": "boolean" }, "pod_read": { "description": "Read pods.", "type": "boolean" }, "pod_update": { "description": "Update pods.", "type": "boolean" }, "webhook_create": { "description": "Create webhooks.", "type": "boolean" }, "webhook_delete": { "description": "Delete webhooks.", "type": "boolean" }, "webhook_read": { "description": "Read webhook configurations.", "type": "boolean" }, "webhook_update": { "description": "Update webhooks.", "type": "boolean" } }, "title": "ApiKeyPermissions", "type": "object" }, "public_key": { "description": "A public P-256 JWK. The object accepts exactly `kty`, `crv`, `x`, and `y`.\nPrivate key material such as `d`, embedded key IDs, and all other members\nare rejected. The server also rejects coordinates that are not a point on\nP-256.", "properties": { "crv": { "enum": [ "P-256" ], "type": "string" }, "kty": { "enum": [ "EC" ], "type": "string" }, "x": { "description": "A 32-byte P-256 coordinate encoded as unpadded base64url.", "maxLength": 43, "minLength": 43, "pattern": "^[A-Za-z0-9_-]{43}$", "title": "PublicJwkCoordinate", "type": "string" }, "y": { "description": "A 32-byte P-256 coordinate encoded as unpadded base64url.", "maxLength": 43, "minLength": 43, "pattern": "^[A-Za-z0-9_-]{43}$", "title": "PublicJwkCoordinate", "type": "string" } }, "required": [ "kty", "crv", "x", "y" ], "title": "PublicJwk", "type": "object" } }, "required": [ "public_key" ], "title": "CreatePublicKeyRequest", "type": "object" } ], "title": "CreateApiKeyRequest" } } } }, "x-aisa-status": "enabled", "x-aisa-pricing": { "cost_contract": "explicit_zero", "customer_pricing": "fixed_success", "default_request_estimate_usd": 0.012, "estimate_source": "profile_seed", "evidence_source": "request_snapshot" }, "components": { "securitySchemes": { "bearerAuth": { "scheme": "bearer", "type": "http" } } } } ``` ## Cost and request rules Published reference price: \$0.012 USD per successful request. Account-specific pricing and final settlement may differ. Published reference values are not an account-specific quote or a settled charge. For endpoints supporting X-AISA-Cost-Mode: quote, obtain a free quote for your exact request before execution; reconcile the settled cost with response metadata and Usage Logs. USD amounts use 1,000,000 integer micro-USD per dollar. * **Default request reference estimate (USD):** 0.012 * **Cost contract:** explicit\_zero * **Settlement evidence source:** request\_snapshot ## OpenAPI ````yaml openapi/agentmail.json POST /apis/v1/agentmail/inboxes/{inbox_id}/api-keys openapi: 3.1.0 info: description: '' title: AgentMail API version: '1' x-aisa-capabilities: idempotency: Idempotency-Key max_price: X-AISA-Max-Price-USD quote: header: X-AISA-Cost-Mode value: quote x-aisa-catalogs: agentmail: description: '' title: AgentMail API x-aisa-capabilities: idempotency: Idempotency-Key max_price: X-AISA-Max-Price-USD quote: header: X-AISA-Cost-Mode value: quote x-aisa-document: facts_hash: 18a04e28941fae19674c11246b677373368b6bd927b7c146220cec1f168f4639 generator_version: '3' protocol_version: '1' schema_version: '1' x-aisa-plans: builder: 1 display_plan: payg payg: 1 similarweb_payg: 1 team: 1 version: e70a0959cd1b93b84ae16dffd7a538273ddb9c1d46277b82823c37ff1b6bc0fb x-aisa-configured-paths: - /apis/v1/agentmail/api-keys - /apis/v1/agentmail/api-keys/{api_key_id} - /apis/v1/agentmail/domains - /apis/v1/agentmail/domains/{domain_id} - /apis/v1/agentmail/domains/{domain_id}/verify - /apis/v1/agentmail/domains/{domain_id}/zone-file - /apis/v1/agentmail/drafts - /apis/v1/agentmail/drafts/{draft_id} - /apis/v1/agentmail/drafts/{draft_id}/attachments/{attachment_id} - /apis/v1/agentmail/inboxes - /apis/v1/agentmail/inboxes/{inbox_id} - /apis/v1/agentmail/inboxes/{inbox_id}/api-keys - /apis/v1/agentmail/inboxes/{inbox_id}/api-keys/{api_key_id} - /apis/v1/agentmail/inboxes/{inbox_id}/drafts - /apis/v1/agentmail/inboxes/{inbox_id}/drafts/{draft_id} - >- /apis/v1/agentmail/inboxes/{inbox_id}/drafts/{draft_id}/attachments/{attachment_id} - /apis/v1/agentmail/inboxes/{inbox_id}/drafts/{draft_id}/send - /apis/v1/agentmail/inboxes/{inbox_id}/events - /apis/v1/agentmail/inboxes/{inbox_id}/lists/{direction}/{type} - /apis/v1/agentmail/inboxes/{inbox_id}/lists/{direction}/{type}/{entry} - /apis/v1/agentmail/inboxes/{inbox_id}/messages - /apis/v1/agentmail/inboxes/{inbox_id}/messages/send - /apis/v1/agentmail/inboxes/{inbox_id}/messages/{message_id} - >- /apis/v1/agentmail/inboxes/{inbox_id}/messages/{message_id}/attachments/{attachment_id} - /apis/v1/agentmail/inboxes/{inbox_id}/messages/{message_id}/forward - /apis/v1/agentmail/inboxes/{inbox_id}/messages/{message_id}/raw - /apis/v1/agentmail/inboxes/{inbox_id}/messages/{message_id}/reply - /apis/v1/agentmail/inboxes/{inbox_id}/messages/{message_id}/reply-all - /apis/v1/agentmail/inboxes/{inbox_id}/metrics - /apis/v1/agentmail/inboxes/{inbox_id}/threads - /apis/v1/agentmail/inboxes/{inbox_id}/threads/{thread_id} - >- /apis/v1/agentmail/inboxes/{inbox_id}/threads/{thread_id}/attachments/{attachment_id} - /apis/v1/agentmail/lists/{direction}/{type} - /apis/v1/agentmail/lists/{direction}/{type}/{entry} - /apis/v1/agentmail/metrics - /apis/v1/agentmail/threads - /apis/v1/agentmail/threads/{thread_id} - /apis/v1/agentmail/threads/{thread_id}/attachments/{attachment_id} x-aisa-document: composer_version: '26' document_hash: sha256:cc7bbc22d6f57ece7bbb56529b01d9eda2bc52e979a788ffbd60352930970089 facts_hash: 18a04e28941fae19674c11246b677373368b6bd927b7c146220cec1f168f4639 generator_version: '3' protocol_version: '1' response_pending: [] schema_version: '1' x-aisa-plans: builder: 1 display_plan: payg payg: 1 similarweb_payg: 1 team: 1 version: e70a0959cd1b93b84ae16dffd7a538273ddb9c1d46277b82823c37ff1b6bc0fb x-aisa-provider: agentmail servers: - url: https://api.aisa.one security: - bearerAuth: [] paths: /apis/v1/agentmail/inboxes/{inbox_id}/api-keys: post: tags: - default summary: List And Create Inbox API Keys description: >- Retrieve a list of API keys for a specific inbox or create a new API key with optional permissions and name. Published reference price: $0.012 USD per successful request. Account-specific pricing and final settlement may differ. operationId: post_any_agentmail_apis_v1_agentmail_inboxes_inbo_5d0d22 parameters: - in: path name: inbox_id required: true schema: description: The ID of the inbox. title: InboxId type: string requestBody: content: application/json: schema: description: >- A body with `public_key` registers a public-key credential; any other body mints a bearer key. oneOf: - description: >- `expires_at` must be in the future and is immutable once the key exists. Omitted, the new key inherits the authenticating key's expiry, and never expires only when that key never does. A key cannot create one that outlives it: an `expires_at` later than the authenticating key's own returns `403`. properties: expires_at: description: >- Time at which api key expires. Omitted when it does not expire. format: date-time title: ExpiresAt type: string name: description: Name of api key. title: Name type: string permissions: description: >- Granular permissions for the API key. When ommitted all permissions are granted. Otherwise, only permissions set to true are granted. properties: account_update: description: >- Update accounts: disable or re-enable an inbox's sign-in at an app. Reading accounts needs only `inbox_read`. type: boolean api_key_create: description: Create API keys. type: boolean api_key_delete: description: Delete API keys. type: boolean api_key_read: description: Read API keys. type: boolean api_key_update: description: Update API keys. type: boolean app_connect: description: >- Sign in to apps as an inbox: connect an app, authorize an inbox, and mint the sign-in keys. Omitted on a new bearer key means false, whatever else the key holds. type: boolean app_share_owner: description: >- Share the organization owner's name and email with apps at sign-in. One permission for both values. type: boolean calendar_event_create: description: Create calendar events. type: boolean calendar_event_delete: description: Delete calendar events. type: boolean calendar_event_read: description: >- Read calendar events, and receive `calendar.event.*` webhook and WebSocket events. type: boolean calendar_event_update: description: Update calendar events and respond to invitations. type: boolean calendar_read: description: Read inbox calendar settings. type: boolean calendar_update: description: Update inbox calendar settings. type: boolean domain_create: description: Create domains. type: boolean domain_delete: description: Delete domains. type: boolean domain_read: description: Read domain details. type: boolean domain_update: description: Update domains. type: boolean draft_create: description: Create drafts. type: boolean draft_delete: description: Delete drafts. type: boolean draft_read: description: Read drafts. type: boolean draft_send: description: Send drafts. type: boolean draft_update: description: Update drafts. type: boolean inbox_create: description: Create new inboxes. type: boolean inbox_delete: description: Delete inboxes. type: boolean inbox_read: description: Read inbox details. type: boolean inbox_update: description: Update inbox settings. type: boolean label_blocked_read: description: Access messages labeled blocked. type: boolean label_spam_read: description: Access messages labeled spam. type: boolean label_trash_read: description: Access messages labeled trash. type: boolean label_unauthenticated_read: description: Access messages labeled unauthenticated. type: boolean list_entry_create: description: Create list entries. type: boolean list_entry_delete: description: Delete list entries. type: boolean list_entry_read: description: Read list entries. type: boolean message_delete: description: Delete messages. Also required to delete threads. type: boolean message_read: description: Read messages. Also required to read threads. type: boolean message_reply: description: >- Reply and reply-all when the request is signed with a registered public key. Bearer keys reply with `message_send`. type: boolean message_send: description: Send messages. type: boolean message_update: description: >- Update message labels. Also required to update threads. type: boolean metrics_read: description: Read metrics. type: boolean pod_create: description: Create pods. type: boolean pod_delete: description: Delete pods. type: boolean pod_read: description: Read pods. type: boolean pod_update: description: Update pods. type: boolean webhook_create: description: Create webhooks. type: boolean webhook_delete: description: Delete webhooks. type: boolean webhook_read: description: Read webhook configurations. type: boolean webhook_update: description: Update webhooks. type: boolean title: ApiKeyPermissions type: object title: CreateBearerApiKeyRequest type: object - description: >- Registers a public P-256 JWK at the route's scope. `type` and `api_key_id` are server-owned. `name` defaults to `AgentID key {first eight fingerprint characters}`; `permissions` defaults to the registering key's, and only grants it holds may be true; `expires_at` defaults to the registering key's expiry and is independent of that key afterward. properties: client_id: description: >- Caller-chosen alias for a public key, unique within the organization and reusable after deletion. Accepted in place of `api_key_id` on get, update, and delete. Registration is idempotent on it: the same alias returns the existing key, a conflicting one returns `409`. URL-safe; no slash or `@`. title: PublicKeyClientId type: string expires_at: description: >- Time at which api key expires. Omitted when it does not expire. format: date-time title: ExpiresAt type: string name: description: Name of api key. title: Name type: string permissions: description: >- Granular permissions for the API key. When ommitted all permissions are granted. Otherwise, only permissions set to true are granted. properties: account_update: description: >- Update accounts: disable or re-enable an inbox's sign-in at an app. Reading accounts needs only `inbox_read`. type: boolean api_key_create: description: Create API keys. type: boolean api_key_delete: description: Delete API keys. type: boolean api_key_read: description: Read API keys. type: boolean api_key_update: description: Update API keys. type: boolean app_connect: description: >- Sign in to apps as an inbox: connect an app, authorize an inbox, and mint the sign-in keys. Omitted on a new bearer key means false, whatever else the key holds. type: boolean app_share_owner: description: >- Share the organization owner's name and email with apps at sign-in. One permission for both values. type: boolean calendar_event_create: description: Create calendar events. type: boolean calendar_event_delete: description: Delete calendar events. type: boolean calendar_event_read: description: >- Read calendar events, and receive `calendar.event.*` webhook and WebSocket events. type: boolean calendar_event_update: description: Update calendar events and respond to invitations. type: boolean calendar_read: description: Read inbox calendar settings. type: boolean calendar_update: description: Update inbox calendar settings. type: boolean domain_create: description: Create domains. type: boolean domain_delete: description: Delete domains. type: boolean domain_read: description: Read domain details. type: boolean domain_update: description: Update domains. type: boolean draft_create: description: Create drafts. type: boolean draft_delete: description: Delete drafts. type: boolean draft_read: description: Read drafts. type: boolean draft_send: description: Send drafts. type: boolean draft_update: description: Update drafts. type: boolean inbox_create: description: Create new inboxes. type: boolean inbox_delete: description: Delete inboxes. type: boolean inbox_read: description: Read inbox details. type: boolean inbox_update: description: Update inbox settings. type: boolean label_blocked_read: description: Access messages labeled blocked. type: boolean label_spam_read: description: Access messages labeled spam. type: boolean label_trash_read: description: Access messages labeled trash. type: boolean label_unauthenticated_read: description: Access messages labeled unauthenticated. type: boolean list_entry_create: description: Create list entries. type: boolean list_entry_delete: description: Delete list entries. type: boolean list_entry_read: description: Read list entries. type: boolean message_delete: description: Delete messages. Also required to delete threads. type: boolean message_read: description: Read messages. Also required to read threads. type: boolean message_reply: description: >- Reply and reply-all when the request is signed with a registered public key. Bearer keys reply with `message_send`. type: boolean message_send: description: Send messages. type: boolean message_update: description: >- Update message labels. Also required to update threads. type: boolean metrics_read: description: Read metrics. type: boolean pod_create: description: Create pods. type: boolean pod_delete: description: Delete pods. type: boolean pod_read: description: Read pods. type: boolean pod_update: description: Update pods. type: boolean webhook_create: description: Create webhooks. type: boolean webhook_delete: description: Delete webhooks. type: boolean webhook_read: description: Read webhook configurations. type: boolean webhook_update: description: Update webhooks. type: boolean title: ApiKeyPermissions type: object public_key: description: >- A public P-256 JWK. The object accepts exactly `kty`, `crv`, `x`, and `y`. Private key material such as `d`, embedded key IDs, and all other members are rejected. The server also rejects coordinates that are not a point on P-256. properties: crv: enum: - P-256 type: string kty: enum: - EC type: string x: description: >- A 32-byte P-256 coordinate encoded as unpadded base64url. maxLength: 43 minLength: 43 pattern: ^[A-Za-z0-9_-]{43}$ title: PublicJwkCoordinate type: string 'y': description: >- A 32-byte P-256 coordinate encoded as unpadded base64url. maxLength: 43 minLength: 43 pattern: ^[A-Za-z0-9_-]{43}$ title: PublicJwkCoordinate type: string required: - kty - crv - x - 'y' title: PublicJwk type: object required: - public_key title: CreatePublicKeyRequest type: object title: CreateApiKeyRequest responses: '200': content: application/json: schema: $ref: >- #/components/schemas/ResponseD09F9471A0E8_apiKeys_CreateApiKeyResult description: Response with status 200 default: content: application/json: schema: {} description: >- Error response; upstream passthrough responses may use provider formats components: schemas: ResponseD09F9471A0E8_apiKeys_CreateApiKeyResult: description: >- The secret-bearing bearer key, or the registered public key without any secret. oneOf: - $ref: >- #/components/schemas/ResponseD09F9471A0E8_apiKeys_CreateApiKeyResponse - $ref: >- #/components/schemas/ResponseD09F9471A0E8_apiKeys_PublicKeyCredential title: CreateApiKeyResult ResponseD09F9471A0E8_apiKeys_CreateApiKeyResponse: properties: api_key: description: API key. type: string api_key_id: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_ApiKeyId' created_at: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_CreatedAt' expires_at: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_ExpiresAt' inbox_id: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_InboxScopeId' name: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_Name' permissions: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_ApiKeyPermissions' pod_id: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_PodScopeId' prefix: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_Prefix' required: - api_key_id - api_key - prefix - name - created_at title: CreateApiKeyResponse type: object ResponseD09F9471A0E8_apiKeys_PublicKeyCredential: description: |- An AgentID sign-in credential, scoped like a bearer key; `api_key_id` is the JWS `kid`. A sign-in key carries `status`, gains `public_key` once the client has proved it, expires 30 days after activation, and carries exactly `app_connect` and `app_share_owner`, snapshotted from the bearer key that created it and enforced from the key itself. properties: api_key_id: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_ApiKeyId' client_id: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_PublicKeyClientId' created_at: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_CreatedAt' created_by: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_ApiKeyCreator' expires_at: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_ExpiresAt' inbox_id: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_InboxScopeId' name: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_Name' permissions: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_ApiKeyPermissions' pod_id: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_PodScopeId' public_key: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_PublicKeyMaterial' status: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_PublicKeyStatus' type: enum: - public_key type: string updated_at: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_UpdatedAt' used_at: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_UsedAt' required: - type - api_key_id - name - permissions - created_by - created_at - updated_at title: PublicKeyCredential type: object ResponseD09F9471A0E8_apiKeys_ApiKeyId: description: ID of api key. title: ApiKeyId type: string ResponseD09F9471A0E8_apiKeys_CreatedAt: description: Time at which api key was created. format: date-time title: CreatedAt type: string ResponseD09F9471A0E8_apiKeys_ExpiresAt: description: Time at which api key expires. Omitted when it does not expire. format: date-time title: ExpiresAt type: string ResponseD09F9471A0E8_apiKeys_InboxScopeId: description: >- Inbox ID the api key is scoped to. If set, the key can only access resources within this inbox. title: InboxScopeId type: string ResponseD09F9471A0E8_apiKeys_Name: description: Name of api key. title: Name type: string ResponseD09F9471A0E8_apiKeys_ApiKeyPermissions: description: >- Granular permissions for the API key. When ommitted all permissions are granted. Otherwise, only permissions set to true are granted. properties: account_update: description: >- Update accounts: disable or re-enable an inbox's sign-in at an app. Reading accounts needs only `inbox_read`. type: boolean api_key_create: description: Create API keys. type: boolean api_key_delete: description: Delete API keys. type: boolean api_key_read: description: Read API keys. type: boolean api_key_update: description: Update API keys. type: boolean app_connect: description: >- Sign in to apps as an inbox: connect an app, authorize an inbox, and mint the sign-in keys. Omitted on a new bearer key means false, whatever else the key holds. type: boolean app_share_owner: description: >- Share the organization owner's name and email with apps at sign-in. One permission for both values. type: boolean calendar_event_create: description: Create calendar events. type: boolean calendar_event_delete: description: Delete calendar events. type: boolean calendar_event_read: description: >- Read calendar events, and receive `calendar.event.*` webhook and WebSocket events. type: boolean calendar_event_update: description: Update calendar events and respond to invitations. type: boolean calendar_read: description: Read inbox calendar settings. type: boolean calendar_update: description: Update inbox calendar settings. type: boolean domain_create: description: Create domains. type: boolean domain_delete: description: Delete domains. type: boolean domain_read: description: Read domain details. type: boolean domain_update: description: Update domains. type: boolean draft_create: description: Create drafts. type: boolean draft_delete: description: Delete drafts. type: boolean draft_read: description: Read drafts. type: boolean draft_send: description: Send drafts. type: boolean draft_update: description: Update drafts. type: boolean inbox_create: description: Create new inboxes. type: boolean inbox_delete: description: Delete inboxes. type: boolean inbox_read: description: Read inbox details. type: boolean inbox_update: description: Update inbox settings. type: boolean label_blocked_read: description: Access messages labeled blocked. type: boolean label_spam_read: description: Access messages labeled spam. type: boolean label_trash_read: description: Access messages labeled trash. type: boolean label_unauthenticated_read: description: Access messages labeled unauthenticated. type: boolean list_entry_create: description: Create list entries. type: boolean list_entry_delete: description: Delete list entries. type: boolean list_entry_read: description: Read list entries. type: boolean message_delete: description: Delete messages. Also required to delete threads. type: boolean message_read: description: Read messages. Also required to read threads. type: boolean message_reply: description: >- Reply and reply-all when the request is signed with a registered public key. Bearer keys reply with `message_send`. type: boolean message_send: description: Send messages. type: boolean message_update: description: Update message labels. Also required to update threads. type: boolean metrics_read: description: Read metrics. type: boolean pod_create: description: Create pods. type: boolean pod_delete: description: Delete pods. type: boolean pod_read: description: Read pods. type: boolean pod_update: description: Update pods. type: boolean webhook_create: description: Create webhooks. type: boolean webhook_delete: description: Delete webhooks. type: boolean webhook_read: description: Read webhook configurations. type: boolean webhook_update: description: Update webhooks. type: boolean title: ApiKeyPermissions type: object ResponseD09F9471A0E8_apiKeys_PodScopeId: description: >- Pod ID the api key is scoped to. If set, the key can only access resources within this pod. title: PodScopeId type: string ResponseD09F9471A0E8_apiKeys_Prefix: description: Prefix of api key. title: Prefix type: string ResponseD09F9471A0E8_apiKeys_PublicKeyClientId: description: >- Caller-chosen alias for a public key, unique within the organization and reusable after deletion. Accepted in place of `api_key_id` on get, update, and delete. Registration is idempotent on it: the same alias returns the existing key, a conflicting one returns `409`. URL-safe; no slash or `@`. title: PublicKeyClientId type: string ResponseD09F9471A0E8_apiKeys_ApiKeyCreator: description: >- The bearer API key that created the credential. Provenance only; the credential outlives it. properties: api_key_id: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_ApiKeyId' required: - api_key_id title: ApiKeyCreator type: object ResponseD09F9471A0E8_apiKeys_PublicKeyMaterial: description: >- Registered public key material and its server-computed RFC 7638 thumbprint. properties: fingerprint: description: RFC 7638 SHA-256 JWK thumbprint encoded as unpadded base64url. maxLength: 43 minLength: 43 pattern: ^[A-Za-z0-9_-]{43}$ type: string jwk: $ref: '#/components/schemas/ResponseD09F9471A0E8_apiKeys_PublicJwk' required: - jwk - fingerprint title: PublicKeyMaterial type: object ResponseD09F9471A0E8_apiKeys_PublicKeyStatus: description: |- Lifecycle of a sign-in key: `pending` until the client finishes creating it on the AgentID page, `active` once it can sign in as the inbox. Absent on a registered key. enum: - pending - active title: PublicKeyStatus type: string ResponseD09F9471A0E8_apiKeys_UpdatedAt: description: Time at which api key was last updated. format: date-time title: UpdatedAt type: string ResponseD09F9471A0E8_apiKeys_UsedAt: description: Time at which api key was last used. format: date-time title: UsedAt type: string ResponseD09F9471A0E8_apiKeys_PublicJwk: description: >- A public P-256 JWK. The object accepts exactly `kty`, `crv`, `x`, and `y`. Private key material such as `d`, embedded key IDs, and all other members are rejected. The server also rejects coordinates that are not a point on P-256. properties: crv: enum: - P-256 type: string kty: enum: - EC type: string x: $ref: >- #/components/schemas/ResponseD09F9471A0E8_apiKeys_PublicJwkCoordinate 'y': $ref: >- #/components/schemas/ResponseD09F9471A0E8_apiKeys_PublicJwkCoordinate required: - kty - crv - x - 'y' title: PublicJwk type: object ResponseD09F9471A0E8_apiKeys_PublicJwkCoordinate: description: A 32-byte P-256 coordinate encoded as unpadded base64url. maxLength: 43 minLength: 43 pattern: ^[A-Za-z0-9_-]{43}$ title: PublicJwkCoordinate type: string securitySchemes: bearerAuth: scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.