Your mailbox, as an API your AI agent can use.
Connect a Gmail, Yahoo, or Namecheap Private Email account. Your agent can then search, read, send, and reply through one API. Your server gets a signed webhook when new mail reaches the inbox.
Email us to join the private beta We are preparing a private beta for people who build AI agents. Invited? Sign in to create your API key.
POST https://your-agent.example/incoming
x-mail-event-id: evt_8f3a61
x-mail-timestamp: 1794247200
x-mail-signature: v1=9f2c41d07be6
What your agent can do
- Search and read mail, including attachments
GET /v1/accounts/:id/messages- Send new mail and replies. A retry with the same key does not send twice.
POST /v1/accounts/:id/messages/send- Save drafts in your mailbox
POST /v1/accounts/:id/drafts- Mark mail as read or starred, move it, or put it in Trash
PATCH /v1/accounts/:id/messages/:messageId- Subscribe to new mail
POST /v1/webhooks
What your server receives
Every webhook has an HMAC-SHA256 signature, so your server can confirm that it came from us. If your server does not accept a webhook, we try again, up to 12 attempts.
The webhook describes the message. Your agent calls the API when it needs the full text or an attachment.
{
"id": "evt_8f3a61",
"type": "email.received",
"createdAt": "2026-11-09T18:00:00.000Z",
"account": {
"id": "account-uuid",
"provider": "gmail",
"email": "you@yourdomain.com"
},
"message": {
"id": "opaque-message-id",
"folder": "INBOX",
"subject": "New inquiry",
"from": [{ "address": "sender@example.com" }],
"to": [{ "address": "you@yourdomain.com" }],
"cc": [],
"receivedAt": "2026-11-09T18:00:00.000Z",
"read": false,
"starred": false,
"snippet": "Hello, I have a question about..."
}
}How we handle your mail
- We fetch message bodies and attachments when your agent asks for them. We do not store them.
- We encrypt mailbox passwords and Google tokens with AES-256-GCM.
- We keep a record of each new inbox message for up to 90 days. It holds the subject, addresses, dates, and status. For Gmail, it also holds a short text preview.
- We do not sell your data, use it for ads, or use it to train AI models.
- You can disconnect a mailbox at any time. This deletes its stored credentials and message records.
Why we ask for Gmail access
You connect Gmail through Google's consent screen, in a step apart from signing in. We request the gmail.modify permission
because your agent needs it to read, send, label, and trash your mail. This permission does not
allow permanent deletion.
The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.