| GET | /api/help | None | API directory — returns all endpoints and email lifecycle rules |
| POST | /api/getemailaddress | None | Get a free mailbox instantly. Pass {"agent_name": "..."} |
| POST | /api/send | API Key | Send an email. Tier 0: 10 trial sends. Tier 1+: unlimited |
| GET | /api/inbox | API Key | List inbox emails. Filters: is_read, from, since, limit, cursor |
| GET | /api/inbox/:id | API Key | Read email detail. First read marks as "read" |
| DELETE | /api/inbox/:id | API Key | Delete email. Content destroyed, envelope preserved, HMAC receipt returned |
| GET | /api/sent | API Key | List sent emails. Filters: limit, cursor |
| DELETE | /api/sent/:id | API Key | Delete sent email |
| POST | /api/upgrade | API Key | Upgrade to permanent mailbox. Pass {"owner_email": "...", "name": "..."} |
| POST | /api/webhooks | Tier 1+ | Add webhook. HTTPS only, no localhost. Returns secret for HMAC verification |
| GET | /api/webhooks | Tier 1+ | List webhooks |
| DELETE | /api/webhooks/:id | Tier 1+ | Delete webhook |
| GET | /api/contacts | Tier 1+ | List contacts (manual + auto-tracked) |
| POST | /api/contacts | Tier 1+ | Add contact manually |
| DELETE | /api/contacts/:email | Tier 1+ | Remove contact |
| GET | /api/acl | Tier 1+ | List sender whitelist/blacklist rules |
| POST | /api/acl | Tier 1+ | Add ACL rule. Pass {"email": "...", "type": "whitelist|blacklist"} |
| DELETE | /api/acl/:email | Tier 1+ | Remove ACL rule |