Your Saasie sends from its own address on saasie.email, assigned by the platform — and receives at the same one. Sending is one endpoint; the inbox is polled, holds 200 messages, and keeps a body but never an attachment.
Every call below goes to the address in your
SAASIE_MAIL_URL
environment variable, with
Authorization: Bearer <token>. Read both from
the environment — they are injected, and hardcoding either is how
an app breaks when the platform moves.
See getting the credential.
GET
/v1/mail/inbox
What has arrived
Newest first, without bodies. Fetch one message to read it. Spam is flagged rather than withheld, so an app decides what to do with it.
200 — The messages waiting
| Field | Type | |
|---|---|---|
messages* |
object[] | — |
address* |
string | null | — |
When it does not work
401 | Missing or invalid service token |
403 | The Saasie is stopped |
GET
/v1/mail/inbox/{id}
Read one message
With its body. truncated says the body stops short of what was sent — act on it rather than parsing a message that may end mid-sentence.
200 — The message
| Field | Type | |
|---|---|---|
id* |
string | — |
from* |
string | — |
fromName* |
string | null | — |
subject* |
string | — |
spam* |
boolean | — |
spamReasons* |
string[] | — |
attachments* |
object[] | — |
messageId* |
string | null | — |
receivedAt* |
integer | -9007199254740991–9007199254740991 |
body* |
string | — |
truncated* |
boolean | — |
When it does not work
401 | Missing or invalid service token |
403 | The Saasie is stopped |
404 | No such message |
DELETE
/v1/mail/inbox/{id}
Delete a message
Gone, and not recoverable. A preview deployment may not call this — it deletes something production still has (REQ-PREV-007).
When it does not work
401 | Missing or invalid service token |
403 | The Saasie is stopped, or this is a preview |
404 | No such message |
POST
/v1/mail/send
Send an email
From this Saasie's own address, to anybody, capped per day. The address is assigned by the platform — a tenant choosing its own local part is a tenant choosing security@.
Request body
| Field | Type | |
|---|---|---|
to* |
string | |
subject* |
string | length 1–200 |
text* |
string | length 1–100000 |
200 — It was accepted by the provider
| Field | Type | |
|---|---|---|
sent* |
boolean | always true |
from* |
string | — |
remainingToday* |
number | — |
When it does not work
400 | A malformed address, or an empty subject or body |
401 | Missing or invalid service token |
403 | The Saasie is stopped |
429 | The daily cap is spent |
501 | This Saasie has no address yet |
502 | The mail provider refused it |
Generated from
openapi.json, which the
service renders from its own routes. * marks
a required field. Every error body is
{ "error": { "code", "message", "details"? } }.