Skip to main content

agent-postbox

Base: https://<ref>.firebaseapp.com/functions/v1/agent-postbox

POST /ingest​

Auth: bridge key. Called by the MTA.

{
  "to": "agent-hello@example.test",
  "from": "alice@vendor.com",
  "subject": "hello",
  "body": "text body",
  "headers": { "message-id": "<abc@vendor.com>" },
  "mime_ref": "postbox-mime/2026/04/20/<abc>.eml"
}

Returns { id, agent_id, injection_score, quarantined }.

POST /alloc​

Auth: device key.

{ "agent_id": "agent-hello", "local_part": "hello" }

Returns { address }.

POST /send​

Auth: device key.

{
  "agent_id": "agent-hello",
  "from": "hello@example.test",
  "to": "alice@vendor.com",
  "subject": "Re: hello",
  "body": "thanks"
}

Returns { id, status: "queued" } or 429 on quota exhaustion.

POST /list​

{ "agent_id": "agent-hello", "direction": "in", "limit": 20, "since": null }

POST /mark_read​

{ "agent_id": "agent-hello", "ids": ["msg_..."] }

POST /rule/put​

{
  "agent_id": "agent-hello",
  "name": "move-newsletters",
  "match": { "from_like": "%@news.example" },
  "actions": [{ "move_to": "newsletters" }]
}

POST /webhook/register​

{
  "agent_id": "agent-hello",
  "url": "https://agent.example.com/hooks/inbound",
  "secret": "whsec_..."
}

Deliveries include x-agentpack-webhook-timestamp and an HMAC in x-agentpack-webhook-signature.

POST /webhook/rotate​

Issues a second active secret, then retires the first after a grace window.