mail

POST `/v1/mail/mailboxes/{mailboxId}/password`

Set or reset a mailbox password.

Authentication

Send an API key as a bearer token. The key must carry the mail.manage permission; a key without it is refused with 403, not 404.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X POST https://api.zinndigital.com/v1/mail/mailboxes/{mailboxId}/password \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{  }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

Sets the password the person chose ({"password": "…"}), or, with an empty body, generates a strong one and returns it once. A chosen password must be 12–128 characters, must not contain the address or its domain name, and must not appear in a known data breach (checked with k-anonymity: only five characters of its hash leave our systems); a refused one is a 422 and changes nothing. A chosen password is never echoed back (password: null, chosen: true). Always a reset, never a read: there is no column holding the old one. Audited (how it was set, never what to); at most 10 per mailbox per hour (429). Requires mail.manage.

Parameters

Name	Type	Required	What it is
`mailboxId (path)`	`Uuid`	Yes	Mailbox ID (UUIDv7).

Request body

Name	Type	Required	What it is
`password`	`string`	No	—

Response

Name	Type	Required	What it is
`mailbox`	`Mailbox`	Yes	One mailbox. Never carries a password — see `MailboxCreated`.
`password`	`object`	Yes	The password, shown once. `null` when the person chose it (`chosen: true` — a password somebody typed is never sent back), or when the backend reconciled to a mailbox that already…
`chosen`	`boolean`	No	`true` when the password set is the one sent in the request.

Errors this endpoint can return

401 · 403 · 404 · 422 · 429 · 503

POST /v1/mail/mailboxes/{mailboxId}/password