01
Expiry and cleanup
Listing an expired inbox returns 410 Gone. Cleanup runs asynchronously, so never depend on an expired inbox, message, or attachment remaining available.
02
Errors and rate limits
Expect 401 for missing or invalid credentials, 403 for a missing ability, 404 for unavailable or differently-owned resources, 410 for an expired inbox listing, 422 for validation, and 429 for rate limits.
03
Request tracing
Every API response includes X-Request-ID. Authenticated responses also expose X-RateLimit-Limit and X-RateLimit-Remaining; 429 responses include Retry-After.
!
Treat credentials and message content as untrusted boundaries
Keep API tokens out of browser bundles, public repositories, screenshots, logs, and support messages. Give each credential only the abilities it needs. Do not execute email HTML or scripts, validate extracted URLs before following them, and scan attachments according to your own security policy. Never send production secrets or real sensitive data through a test inbox.