Account Management API

Quick start

Create a token in Account settings → API tokens. Choose a preset, the required resources and an expiration date. The secret is displayed once. Save it in your integration’s secret store.

# MAILCORE_MANAGEMENT_TOKEN is supplied by your secret store.
curl --fail-with-body https://mailcore.uz/api/management/v1/token/verify \
  --header "Authorization: Bearer $MAILCORE_MANAGEMENT_TOKEN" \
  --header 'Accept: application/json'

curl --fail-with-body https://mailcore.uz/api/management/v1 \
  --header "Authorization: Bearer $MAILCORE_MANAGEMENT_TOKEN"

Management credentials start with mcm_. Sending credentials starting with mck_ authenticate the separate Email API. To send email, create a sending key for the project and stream with email_keys.write.

Give your AI agent the OpenAPI URL and the environment variable name MAILCORE_MANAGEMENT_TOKEN. The agent first verifies its token and available resources, then performs the changes you authorize. Keep the credential out of the task prompt.

Access and resources

• Account: all organizations and resources currently accessible to the token creator.
• Organizations: only the selected organizations and permitted operations within them.
• Domains: only selected domains, their mail and related Email API projects.
• Projects: only selected Email API projects, identified by public eaw_… IDs.

A token is always limited by its creator’s current access. Membership removal, role downgrade, revocation and expiration remove the corresponding access. Billing, team, sending keys and webhooks have separate permissions. Domain and project tokens do not grant organization-wide finance access.

Action permissions

Read grants resource and list access. Write includes read and supported creation or update operations. Each endpoint lists its required permission; domain access alone does not grant mailbox or sending-key access.

account · organizations · team · domains · mailboxes · aliases
email_projects · email_activity · email_keys · webhooks · billing · audit

<group>.read / <group>.write

The audit log is read-only: audit.read. A token cannot edit or delete audit events.

Connect a domain and mail

• Create or select an organization and add a domain. The response includes domain and onboarding order IDs.
• Retrieve the order with explicit organization, domain and order IDs. Add the supplied ownership TXT record at your DNS provider and verify ownership.
• Choose the plan and storage configuration, retrieve a payment URL and check payment status. Financial operations require billing.write.
• Start mail provisioning and poll the operation and order status. Add the required MX/SPF/DKIM/DMARC records and run the final DNS check.

The API provides required DNS records and checks them. Record changes happen at your DNS provider. Bank card authorization and bank OTP remain on the secure payment page; the API returns the required action and URL.

Email API projects

Create a project on a verified organization domain. Enable marketing separately, configure DNS, request verification and create sending keys and webhooks. Message history, batches and queue activity require email_activity.read, separately for transactional and marketing streams.

Retrieve packages, prices and remaining credits with GET /organizations/{organization_id}/email-api/billing and billing.read. This endpoint returns financial information only. Purchasing a package requires billing.write.

Retries and background operations

Every POST requires an Idempotency-Key. Use a new value for a new intentional operation; after a network failure, retry the same request with the same value. Different data with the same key causes a conflict. Check the result before retrying secret creation: a lost secret cannot be retrieved again.

Mail and resource changes run through a bounded queue. A successful HTTP response may mean accepted rather than completed. Poll the returned operation status. Before an unstarted operation executes, the server rechecks the token and its creator’s access. Revocation does not undo completed changes.

Respect Retry-After, retry transient failures with increasing delay and avoid multiple frequent polling loops. Default limits are up to 120 requests per minute per token and 600 per account. Email sending has separate limits and queues.

Poll a specific mailbox or alias operation with GET /organizations/{organization_id}/domains/{domain_id}/operations/{operation_id}. Intermediate states are queued, leased and retry; completion is done, terminal failure is dead. Retry only when the response allows canRetry; a password operation may require a new password.

Errors and audit

Responses contain requestId; the X-Request-Id header helps support identify a request. 401 means an invalid credential; 403 means denied action or resource; 409 means a state or version conflict; 422 means invalid fields; 429 means a request limit. Temporary dependency failures are reported separately. Read the current resource version before modifying it.

Organization audit events require audit.read. Give support the request ID, error code and time. Do not send tokens, passwords, bank codes or request bodies containing secrets.

Endpoint reference

Base URL: https://mailcore.uz/api/management/v1. All resource IDs are explicit; the API does not change your browser’s organization selection. The table lists current endpoints and required permissions. Request fields and enums are defined in OpenAPI.