Mint a grant token

POST

/v1/grants/{id}/token

curl --request POST \
  --url https://api.inboxcnx.com/v1/grants/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/token \
  --header 'Authorization: Bearer <token>'

Exchanges an API key for a grant token: a credential valid for 5 minutes and confined to one end user’s mailbox, which you can hand to a client that must not hold the API key. It carries those of the mail scopes (read:messages, modify:messages, delete:messages, report:spam) that the API key holds. A grant token cannot mint another one.

Requires the read:messages scope.

Authorizations

• apiKey

Parameters

Path Parameters

id

required

string format: uuid

Responses

201

The grant-scoped token; it is returned here and nowhere else

Media typeapplication/json

object

token

required

string

expiresAt

required

string

grantId

required

string

scopes

required

Array<string>

Example

{
  "token": "icnxg_eyJvcmciOiIwZjZi…",
  "expiresAt": "2026-10-23T08:05:00.000Z",
  "grantId": "9b2f0c4e-6a1d-4f3b-8c55-0d7e2a91b3c4",
  "scopes": [
    "read:messages"
  ]
}

403

The credential lacks read:messages, or is a grant token (grant_token_chaining)

Media typeapplication/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

404

No such grant for the caller’s organization and application

Media typeapplication/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

409

The grant is not active

Media typeapplication/json

object

error

required

object

code

required

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}