Mailboxes

Manage individual Google Workspace / Microsoft / Azure mailboxes: buy new ones on a domain you already own, list and filter them, update profile info, rotate passwords, and cancel/reactivate.

List mailboxes

curl -X POST https://api.infrabox.software/v1/api/mailboxes/list \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Workspace-Id: YOUR_WORKSPACE_UID" \
  -H "Content-Type: application/json" \
  -d '{ "domain": "yourdomain.com", "page": 1, "limit": 50 }'

Filter with keyword, domain, domain_uid, platform (GOOGLE/MICROSOFT/AZURE), status, or a specific list of uids. Each row includes status, sequencers (what it’s connected to — see Sequencers), tags, and renewal fields.

Buy mailboxes on an existing domain

curl -X POST https://api.infrabox.software/v1/api/mailboxes/buy \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Workspace-Id: YOUR_WORKSPACE_UID" \
  -H "Content-Type: application/json" \
  -d '{
    "uids": ["<domain_uid>"],
    "mailboxes": [
      { "first_name": "Jane", "last_name": "Smith", "username": "jane.smith", "platform": "GOOGLE" }
    ]
  }'

username is the local part only — the full address is derived from it plus the domain the mailbox is bought on.

Reveal console credentials

curl "https://api.infrabox.software/v1/api/mailboxes/show-credentials?uid=<mailbox_uid>" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Workspace-Id: YOUR_WORKSPACE_UID"

Returns the mailbox’s own Google console sign-in password (and TOTP secret, for 2FA). This is not a sending credential — Google requires 2-step verification plus an app password to send over SMTP directly, and this endpoint does not produce that. To actually send mail from the mailbox, use SMTP relay credentials below instead.

SMTP relay credentials (for sending)

Every mailbox sends through the Infrabox SMTP relay, not directly against Google — the relay authenticates to Gmail on the mailbox’s behalf via domain-wide delegation, so nothing here ever touches a Google password or 2FA. This is the credential an external sending tool (Instantly/Smartlead/Lemlist/your own code) actually needs.

Check status

curl -X POST https://api.infrabox.software/v1/api/mailboxes/smtp-credentials/status \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Workspace-Id: YOUR_WORKSPACE_UID" \
  -H "Content-Type: application/json" \
  -d '{ "uids": ["mb_111", "mb_222"] }'

Up to 100 uids per call. Reports password_set per mailbox — never the password itself, which is bcrypt-hashed at issue time and cannot be returned again by any endpoint.

Issue a credential

curl -X POST https://api.infrabox.software/v1/api/mailboxes/smtp-credentials/issue \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Workspace-Id: YOUR_WORKSPACE_UID" \
  -H "Content-Type: application/json" \
  -d '{ "uids": ["mb_111"] }'

{
  "error": false,
  "results": [
    {
      "uid": "mb_111",
      "success": true,
      "host": "smtp.infrabox.software",
      "port": 2587,
      "security": "STARTTLS",
      "username": "[email protected]",
      "password": "generated-once-password",
      "rotated": false,
      "warning": "shown once"
    }
  ]
}

Only active (or scheduled_for_cancellation) GOOGLE mailboxes can receive a credential — anything else comes back as a per-uid error (not_sendable / unsupported_platform) rather than failing the whole batch. Rate limited to 20 requests / 5 minutes per team.

Read inbox messages (reply detection)

Polls a mailbox’s INBOX for new mail — same domain-wide-delegation grant as sending, no separate setup. Built for reply detection: point a sending tool at this on an interval instead of asking for IMAP (Google’s basic IMAP auth is closed for these mailboxes the same way SMTP AUTH is).

curl -X POST https://api.infrabox.software/v1/api/mailboxes/messages/list \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Workspace-Id: YOUR_WORKSPACE_UID" \
  -H "Content-Type: application/json" \
  -d '{ "uids": ["mb_111", "mb_222"], "limit": 20 }'

{
  "error": false,
  "results": [
    {
      "uid": "mb_111",
      "messages": [
        {
          "id": "19abc0123def4567",
          "thread_id": "19abc0123def4567",
          "label_ids": ["UNREAD", "CATEGORY_UPDATES", "INBOX"],
          "snippet": "This confirms the Infrabox SMTP relay delivers via Gmail API...",
          "body_text": "This confirms the Infrabox SMTP relay delivers via Gmail API + domain-wide delegation.",
          "from": "[email protected]",
          "to": "[email protected]",
          "subject": "Re: Quick question",
          "date": "Sat, 12 Sep 2026 06:53:16 -0400",
          "message_id": "<[email protected]>",
          "in_reply_to": null,
          "references": null
        }
      ],
      "next_cursor": "19abc0123def4567"
    }
  ]
}

Scope is INBOX only (no Sent/Drafts/other labels), and body_text is a plain-text extract capped at 5,000 characters — not the raw MIME. Up to 20 uids per call (lower than the credential endpoints’ 100, since each uid costs one Gmail list call plus up to limit get calls); limit defaults to 20, capped at 50. Only active (or scheduled_for_cancellation) GOOGLE mailboxes are supported — others come back as a per-uid error (not_found / not_sendable / unsupported_platform / temporary_error / permanent_error) rather than failing the whole batch. Rate limited to 30 requests / 5 minutes per team.

Errors