inletops-api

name

inletops-api

description

Create and manage InletOps inbound-email resources and send mail via the InletOps REST API or hosted MCP server — throwaway inboxes, wait-for-email + verification-code/OTP extraction, domains, addresses (aliases), inbound messages, automations, webhooks, and forwarding. Use whenever the user wants to programmatically set up or operate InletOps, or needs an email address to receive a signup/verification code (e.g. "get me a temp email in InletOps", "wait for the verification email and give me the code", "add a domain in InletOps", "send an email via InletOps", "connect InletOps over MCP").

InletOps API

InletOps is an inbound-email platform: domains route mail into the app, where it can be read, tagged, forwarded, sent to webhooks, and processed by automation rules. This skill lets you create and manage all of it over a REST API.

For AI agents: inbox → wait → extract

The fastest path for automating a signup/verification flow:

# 1 — make an inbox on a verified domain (omit local_part for a random one)
curl -X POST https://app.inletops.com/api/v1/inboxes \
  -H "Authorization: Bearer $INLETOPS_TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" \
  -d '{"expires_in":3600}'          # → {"data":{"address":"[e-mail]", ...}}

# 2 — paste that address into the target signup, then block for the email
curl "https://app.inletops.com/api/v1/messages/wait?address=[e-mail]&timeout=20&extract=1" \
  -H "Authorization: Bearer $INLETOPS_TOKEN" -H "Accept: application/json"
#   → the message, plus {"codes":["483920"],"verification_links":["https://…"]}
#   → 204 No Content if nothing arrived before the timeout (call again with ?after=<received_at>)

# 3 — or extract from a specific message later (add ?ai=1 for the AI extractor, BYOK)
curl "https://app.inletops.com/api/v1/messages/4821/extract" \
  -H "Authorization: Bearer $INLETOPS_TOKEN" -H "Accept: application/json"

wait is a bounded long-poll (timeout 1–25s). extract returns codes, links, and verification_links. Discard an inbox with DELETE /inboxes/{id}.

Connect via MCP (no REST plumbing)

InletOps hosts an MCP server at https://app.inletops.com/mcp exposing create_inbox, wait_for_email, extract_code, list_messages, get_message, send_email, reply, list_domains, list_inboxes, delete_inbox, whoami.

claude mcp add --transport http inletops https://app.inletops.com/mcp \
  --header "Authorization: Bearer $INLETOPS_TOKEN"

Config snippets for Cursor / Windsurf / VS Code / Codex / any stdio client are in reference/api.md and at https://app.inletops.com/developers.

Anonymous (no signup)

Without a token you can still create a throwaway inbox on the shared domain and read its mail — create_inbox returns an inbox_token; pass it to wait_for_email / get_message / extract_code. Sending/replying requires an account (returns a "register" message). Via REST, these live under /api/v1/public/inboxes.

Setup (one time)

1. The user creates a token at https://app.inletops.com/user/api-tokens, selecting the scopes it needs, and exports it:

   export INLETOPS_TOKEN="paste-token-here"
   

2. Every request:
   • Base URL: https://app.inletops.com/api/v1
   • Headers: Authorization: Bearer $INLETOPS_TOKEN and Accept: application/json
   • Send Content-Type: application/json with a JSON body on POST/PATCH.

If INLETOPS_TOKEN is not set, ask the user to create one and tell them which scopes the task needs (see below). A request acts on the token owner's current workspace.

Scopes (least privilege)

messages:read · messages:write · mail:send · domains:read|write · aliases:read|write · automations:read|write · webhooks:read|write · forwarding:read|write · logs:read. :write implies :read. Request only what the task needs.

Response & error conventions

• Single → { "data": { … } }; list → { "data": [ … ], "meta": { current_page, per_page, total, last_page } }.
• Pagination: ?page= / ?per_page= (max 200). IDs are strings; timestamps ISO-8601 UTC.
• Errors: 401 no/invalid token · 403 missing scope or insufficient team role · 404 not in your workspace · 422 validation ({message, errors}) · 429 rate limit (120/min).
• On 403, check the token has the right scope AND the user's workspace role allows it.

Common workflows

Onboard a domain → start receiving mail

curl -X POST https://app.inletops.com/api/v1/domains \
  -H "Authorization: Bearer $INLETOPS_TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" \
  -d '{"domain":"acme.com","catch_all":true}'
# Returns verification_token + DNS statuses. After the user publishes the MX record:
curl -X POST https://app.inletops.com/api/v1/domains/10/recheck -H "Authorization: Bearer $INLETOPS_TOKEN" -H "Accept: application/json"

Triage inbound mail

curl "https://app.inletops.com/api/v1/messages?status=received&per_page=20" -H "Authorization: Bearer $INLETOPS_TOKEN" -H "Accept: application/json"
curl -X POST https://app.inletops.com/api/v1/messages/4821/tag -H "Authorization: Bearer $INLETOPS_TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" -d '{"tag":"invoice"}'

Send an email (from a domain the workspace owns)

curl -X POST https://app.inletops.com/api/v1/messages/send \
  -H "Authorization: Bearer $INLETOPS_TOKEN" -H "Content-Type: application/json" -H "Accept: application/json" \
  -d '{"from_email":"[e-mail]","to":["[e-mail]"],"subject":"Hi","body":"Hello"}'

Automate (rule: tag invoices and forward to accounting), webhooks, forwarding — full request/response details for every endpoint are in reference/api.md (read it before composing non-trivial calls).

Guidance

• Prefer the smallest scope; tell the user exactly which scopes to enable on their token.
• Never hardcode or log the token; always read it from $INLETOPS_TOKEN.
• Inspect a resource (GET) before mutating it; confirm destructive actions (DELETE) with the user.
• For the complete endpoint list, request bodies, and response shapes, read reference/api.md.