REST API

Overview

Production base: https://api.mailraft.com. GET /health is public. Authenticated /v1 routes require a scoped MailRaft bearer key. Provider secrets never appear in read responses. The dashboard uses a same-origin session backend on app.mailraft.com.

Setup & requirements

Integration routes: GET/POST /v1/integrations; GET/PATCH/DELETE /v1/integrations/:id; POST /v1/integrations/:id/test; GET /v1/integrations/:id/calls; POST /v1/integrations/:id/execute. Execute accepts action and params. Actions must match the integration, tenant, membership, plan and key scopes. Revoke is immediate. Obtain keys only through authenticated Developer settings.

Usage & verification

GET and audit routes require integrations:read; tests and execute require integrations:execute; create, patch and revoke require integrations:manage. API-key scopes do not override integration action scopes, current membership, tenant status or plan limits. Browser mutation requests also require the session CSRF token.

Create returns status untested and credential-free metadata. DELETE revokes immediately. Execute accepts action and params; do not include provider credentials in execute. Foreign objects return not-found, scope denial fails closed, and overlapping execution returns integration_busy. Inspect call history after failure; do not blindly retry a potentially accepted send.

Example

{"action":"gmail.read","params":{"limit":1}}

Project code examples

Browse MailRaft source references and HTTP examples in Node.js, Python, Ruby, PHP, Go, Rust, Java, .NET, Elixir and cURL.