Skip to main content

​
Account ownership

Every email belongs to the authenticated account that created it. Messages, raw source, and attachments inherit that ownership. Missing, expired, and foreign private resources all return the same 404 shape.

​
Opaque resource identifiers

Use the returned eml_*, msg_*, and att_* identifiers in API paths. An email address, filename, or storage key is never a resource identifier.

​
Receive-only operation

The API creates receiving addresses and exposes finite REST reads. It does not send email, deliver webhooks, stream events, or poll automatically.

​
Independent lifecycle

An API reservation receives without an open dashboard or website session. Reservations last 30 days; message content lasts 15 minutes after arrival. Logical expiry is enforced on every read even if asynchronous cleanup is still running.

​
Untrusted content

All inbound mail is hostile input. The service sanitizes parsed HTML and download filenames, but clients must still isolate rendering and treat raw source and attachments as untrusted bytes.

​
Request accounting

Commercial request allowance, short-window HTTP protection, email creation limits, and inbound mail safety admission are separate controls. A rejection in one system does not imply usage in another.
Last modified on August 2, 2026