REST API
Authenticate, make your first request, and use the GoodInboxes v1 reference.
The API base URL is https://www.goodinboxes.com/api/v1. Create your token in the same environment as the API.
Create a token
Open API access as an active workspace owner or admin. Create a named token with only the scopes you need, then copy its full value once. Token rotation immediately revokes the previous key. Every request rechecks the issuer's active owner/admin membership. Dashboard session JWTs are not external API tokens.
Make a request
curl --fail-with-body 'https://www.goodinboxes.com/api/v1/inboxes?limit=20' \
-H "Authorization: Bearer $GOODINBOXES_API_TOKEN"List responses contain data.items and data.nextCursor. Pass the opaque cursor to the same resource until it is null. limit accepts 1–100 and defaults to 20. Cursors are bound to the token, organization, and resource.
Responses and errors
Successful responses contain data and a request ID. Errors contain a safe code in error. 400 indicates an invalid request, 401 missing or invalid authentication, 403 insufficient access, 404 a missing or private resource, 429 quota exhaustion, and 503 an unavailable capability or dependency. Never interpret an unknown purchase state or a transport failure as payment success or failure.
API reference
The endpoint reference lists every currently documented public v1 operation, its required scope, parameters, and response envelope. The reference is generated from the app's existing public endpoint catalog. It intentionally excludes internal admin, billing, and provider routes.
Wallet top-ups, credential disclosure, and destructive account actions are unavailable through the external API. Sequencer tag commands and domain web forwarding require explicit write scopes, approval of the exact targets, and a separate operator flag.
Place an order
With explicit orders:write permission and financial writes enabled, quote an order before placing it. Supported carts include inventory bundles, domain registration, BYOD, inbox additions to owned domains, and mixed preorder carts. Inventory options and owned-domain options provide the IDs to use.
Approve the returned selections, upfront amount, monthly renewal cost, both policy versions, and any BYOD DNS takeover. Quotes expire after ten minutes. Initial card top-ups are disabled. Retry the same confirmation and quote ID; read the original command after a pending or dropped response. A paid order does not establish live provider fulfillment.