{"name":"CommsHarbor","description":"Domain email, webmail and mailbox management for teams and agents. Free Trial shares 1 GB across unlimited receive-only mailboxes. Three paid monthly packages include sending. Enterprise services have activation on demand.","build":"1ac1514e","environment":"local","base_url":"https://commsharbor.com","docs":{"llms":"https://commsharbor.com/llms.txt","llms_full":"https://commsharbor.com/llms-full.txt","openapi":"https://commsharbor.com/openapi.json","mcp":"https://commsharbor.com/mcp","pricing":"https://commsharbor.com/api/pricing","billing":"https://commsharbor.com/api/billing","human_ui":"https://commsharbor.com/","data_indexes":[{"id":"cep","produto":"https://pontofato.com","caminho":"/enderecos","title":"Postal codes and addresses","description":"Find addresses by location, with coordinates and a 2022 reference date. Not a current postal-code certification. Each HTML page opens the product app with its public data already rendered.","hierarchy":"State → municipality → locality → street → addresses","url":"https://pontofato.com/enderecos/","formats":{"html":"https://pontofato.com/enderecos/","json":"https://api.pontofato.com/enderecos/index.json","md":"https://api.pontofato.com/enderecos/index.md","okf":"https://api.pontofato.com/enderecos/index.okf.md"},"llms":"https://api.pontofato.com/enderecos/llms.txt","openapi":"https://api.pontofato.com/enderecos/openapi.json","mcp":"https://api.pontofato.com/enderecos/mcp","okf":"https://api.pontofato.com/enderecos/okf/index.md","access":"public-read-only","pagination":{"max_items":20,"next":"links.proximo"},"updates":"manual"},{"id":"editais","produto":"https://editalmd.com","caminho":"/licitacoes","title":"Public procurement","description":"Find public procurement by location and date. View documents and reading options in EditalMD. Each HTML page opens the product app with its public data already rendered.","hierarchy":"Procedure → state → year → month → day → municipality → purchases","url":"https://editalmd.com/licitacoes/","formats":{"html":"https://editalmd.com/licitacoes/","json":"https://api.editalmd.com/licitacoes/index.json","md":"https://api.editalmd.com/licitacoes/index.md","okf":"https://api.editalmd.com/licitacoes/index.okf.md"},"llms":"https://api.editalmd.com/licitacoes/llms.txt","openapi":"https://api.editalmd.com/licitacoes/openapi.json","mcp":"https://api.editalmd.com/licitacoes/mcp","okf":"https://api.editalmd.com/licitacoes/okf/index.md","access":"public-read-only","pagination":{"max_items":20,"next":"links.proximo"},"updates":"manual"}]},"auth":{"credito":"Prepaid credit token in `Authorization: Bearer cred_…` (or the `X-Credito` header). Not an account: it is a bearer of balance.","none":"Public endpoint. No tenant data is returned.","guest":"Temporary workspace of this browser (`POST /api/guest`): the HttpOnly `cm_guest` cookie, host-only, or the signed `cm_…` token in `X-Guest-Token` for an API client. It works without an account until `POST /api/auth/claim` attaches it to one; nothing signs anyone in automatically.","session":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied.","organization":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail.","organization_admin":"Owner or admin of the organization (shared-account roles), signed in with a second factor. Never an API key.","platform_admin":"Session with an explicit platform_roles grant. Tenant ownership does not grant platform access."},"endpoints":[{"method":"GET","path":"/agent.json","auth":"none","summary":"Agent card: identity, operator, documentation, the MCP endpoint and the tools it serves. Same document as `/.well-known/agent-card.json`.","grupo":"Discovery","retorno":{"_texto":"`application/json`: `name`, `provider`, `protocol` (`mcp`), `interfaces[]` and `skills[]`."},"exemplo":"curl -s $ORIGIN/agent.json","returns":"`application/json`: `name`, `provider`, `protocol` (`mcp`), `interfaces[]` and `skills[]`.","url":"https://commsharbor.com/agent.json","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/okf/:arquivo","auth":"none","summary":"OKF bundle (Open Knowledge Format v0.1): markdown with frontmatter so an agent reads the whole product without parsing HTML.","grupo":"Discovery","params":{"arquivo":{"desc":"`index.md`, `sobre.md`, `api.md` or `faq.md`.","exemplo":"index.md"}},"retorno":{"_texto":"`text/markdown`. Start at `/okf/index.md`, which lists the bundle."},"erros":{"404":"File outside the bundle."},"exemplo":"curl -s $ORIGIN/okf/index.md","returns":"`text/markdown`. Start at `/okf/index.md`, which lists the bundle.","url":"https://commsharbor.com/okf/:arquivo","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/.well-known/:arquivo","auth":"none","summary":"Machine discovery before the home page: `api-catalog` (RFC 9727, a linkset with the API and the MCP), `security.txt` (RFC 9116), `x402` (payment manifest: network, wallet and the routes that charge) and `mcp-registry-auth` (the official MCP registry key).","grupo":"Discovery","params":{"arquivo":{"desc":"`api-catalog`, `security.txt`, `x402`, `mcp-registry-auth` or `apis.json`.","exemplo":"api-catalog"}},"retorno":{"_texto":"`application/linkset+json` for the api-catalog; `application/json` for x402 and apis.json; `text/plain` for the other two."},"erros":{"404":"Name outside the five published."},"exemplo":"curl -s $ORIGIN/.well-known/api-catalog","returns":"`application/linkset+json` for the api-catalog; `application/json` for x402 and apis.json; `text/plain` for the other two.","url":"https://commsharbor.com/.well-known/:arquivo","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/apis.json","auth":"none","summary":"APIs.json (apisjson.org, 0.19): the index APIs.io harvests — the API, the MCP, OpenAPI, guide and OKF bundle in one file. Also at `/.well-known/apis.json`.","grupo":"Discovery","retorno":{"_texto":"`application/json` in the APIs.json 0.19 format: `apis[]` with `baseURL`, `humanURL` and `properties[]`."},"exemplo":"curl -s $ORIGIN/apis.json","returns":"`application/json` in the APIs.json 0.19 format: `apis[]` with `baseURL`, `humanURL` and `properties[]`.","url":"https://commsharbor.com/apis.json","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/","auth":"none","grupo":"Discovery","summary":"Discover the whole API: every endpoint, every auth mode and the MCP endpoint.","retorno":"ApiIndex","returns":"{ name, description, build, environment, base_url, docs, auth, endpoints, mcp, mcp_tools }","url":"https://commsharbor.com/api/","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/health","auth":"none","grupo":"Discovery","summary":"Read liveness, environment and the commit currently deployed.","desc":"Smoke tests wait for their own commit to appear here instead of racing edge propagation.","retorno":"Health","returns":"{ ok, app, build, environment, timestamp }","url":"https://commsharbor.com/api/health","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/mcp","auth":"none","grupo":"Discovery","summary":"Inspect the remote MCP server card: transport, protocol and tool count.","desc":"`POST /mcp` speaks Streamable HTTP with JSON-RPC 2.0. The tools are the operations in this catalog; the MCP has no backend of its own.","retorno":{"transport":{"tipo":"string","desc":"How the server speaks — `streamable-http`."},"protocol_version":{"tipo":"string","desc":"MCP protocol version the server implements."},"endpoint":{"tipo":"string","desc":"Absolute URL to POST JSON-RPC to."},"server":{"tipo":"object","desc":"`name` and `version` of this server; the version is the deployed commit."},"tools":{"tipo":"int","desc":"How many tools the server exposes."},"usage":{"tipo":"string","desc":"One line saying how to call it."},"api_index":{"tipo":"string","desc":"The self-describing API index, for the operations behind the tools."}},"returns":"{ transport, protocol_version, endpoint, server, tools, usage, api_index }","url":"https://commsharbor.com/mcp","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/auth/bootstrap","auth":"none","grupo":"Account","summary":"Prepare the browser for global sign-in.","desc":"Sets a host-only HttpOnly browser cookie. CSRF is bound to the current session. No CORS.","retorno":{"csrf":{"tipo":"string","desc":"X-CSRF-Token"},"context":{"tipo":"string","desc":"Opaque view context, also in X-MM-Context; not a credential / contexto opaco da vista, não é credencial."}},"erros":{"400":"invalid_request","403":"invalid_origin / invalid_csrf","503":"auth_unavailable: a sessão anterior é preservada / the previous session is preserved"},"returns":"{ csrf, context }","url":"https://commsharbor.com/api/auth/bootstrap","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/account/profile","auth":"session","grupo":"Account","exemplo":"await fetch(\"$ORIGIN/api/account/profile\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","summary":"Read your global profile.","desc":"Reads current preferences from the account. Edit them on your account page; products never own a separate profile.","retorno":{"_texto":"{profile:{name,locale,timeZone,theme,revision}}"},"erros":{"401":"invalid_session","503":"auth_unavailable"},"returns":"{profile:{name,locale,timeZone,theme,revision}}","url":"https://commsharbor.com/api/account/profile","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/account/avatar","auth":"session","grupo":"Account","exemplo":"await fetch(\"$ORIGIN/api/account/avatar\", {credentials: \"same-origin\"}).then(r => {if (!r.ok) throw new Error(\"HTTP \" + r.status); return r.blob();});","exemploLinguagem":"js","summary":"Read your global profile photo.","desc":"Private WebP, up to 64 KiB, no cache. Change it on your account. No user ID or object URL accepted.","retorno":{"_texto":"image/webp; Cache-Control: no-store"},"erros":{"401":"invalid_session","404":"not_found: no photo / sem foto","503":"auth_unavailable"},"returns":"image/webp; Cache-Control: no-store","url":"https://commsharbor.com/api/account/avatar","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/auth/logout","auth":"session","grupo":"Account","exemplo":"// Execute no console da página do produto / Run in the product page console.\n(async () => {\n  const origin = \"$ORIGIN\";\n  const {csrf} = await fetch(origin + \"/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(origin + \"/api/auth/logout\", {\n    method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({})\n  });\n  if (!r.ok) throw new Error(\"Auth HTTP \" + r.status);\n  return r.json();\n})();","exemploLinguagem":"js","summary":"Revoke this product session.","desc":"Bootstrap/CSRF must belong to this browser and session. Other product sessions remain active.","retorno":{"ok":{"tipo":"bool","desc":"true"}},"erros":{"400":"invalid_request","403":"invalid_origin / invalid_csrf","503":"auth_unavailable: a sessão anterior é preservada / the previous session is preserved"},"returns":"{ ok }","url":"https://commsharbor.com/api/auth/logout","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/account/keys","auth":"session","grupo":"Account","summary":"List your API keys in this product.","desc":"Never returns the key itself: name, last 4 characters, organization, creation, last use (hourly) and whether it still works.","retorno":{"keys":{"tipo":"object[]","desc":"`id`, `name`, `organizationId`, `last4`, `createdAt`, `lastUsedAt`, `revokedAt`, `active` (false when revoked or stopped by a password change / ending all sessions)."}},"erros":{"401":"invalid_session","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/account/keys\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ keys }","url":"https://commsharbor.com/api/account/keys","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/account/keys/create","auth":"session","grupo":"Account","summary":"Create an API key for agents and scripts.","desc":"Needs a sign-in in the last 5 minutes; an organization key also needs a second factor in the session and the owner/admin role with this product enabled. At most 10 live keys per account and product. The key (`secret`) is returned ONCE.","corpo":{"name":{"tipo":"string","obrigatorio":true,"desc":"Up to 60 characters."},"organizationId":{"tipo":"string","nulo":true,"obrigatorio":true,"desc":"`null` for an account key."}},"body":{"name":"agent","organizationId":null},"retorno":{"key":{"tipo":"object","desc":"`id`, `name`, `organizationId`, `last4`, `createdAt`."},"secret":{"tipo":"string","desc":"`mmk_…`, shown once."}},"erros":{"400":"invalid_key_name / invalid_organization","401":"invalid_session / reauth_required","403":"invalid_origin / invalid_csrf / organization_forbidden / organization_mfa_required","409":"key_limit_reached","503":"auth_unavailable"},"exemplo":"(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/account/keys/create\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({name: \"agent\", organizationId: null})});\n  return r.json();\n})();","exemploLinguagem":"js","returns":"{ key, secret }","url":"https://commsharbor.com/api/account/keys/create","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/account/keys/revoke","auth":"session","grupo":"Account","summary":"Revoke one of your API keys.","desc":"Stops the key at once. Repeating is harmless.","corpo":{"id":{"tipo":"string","obrigatorio":true,"desc":"The key `id`."}},"body":{"id":"…"},"retorno":{"ok":{"tipo":"bool","desc":"true"}},"erros":{"400":"invalid_key_id","401":"invalid_session","403":"invalid_origin / invalid_csrf","404":"key_not_found","503":"auth_unavailable"},"exemplo":"(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/account/keys/revoke\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({id: \"…\"})});\n  return r.json();\n})();","exemploLinguagem":"js","returns":"{ ok }","url":"https://commsharbor.com/api/account/keys/revoke","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/auth/wallet/agent/start","auth":"none","grupo":"Account","summary":"Start the wallet credential of an agent without an account.","desc":"No account: the wallet proves it is hers by signing the message (EIP-4361). Signing does not pay or transfer anything. The message names this product and lasts 5 minutes. Sign it with personal_sign and send it to /api/auth/wallet/agent/token.","corpo":{"address":{"tipo":"string","desc":"0x…, a carteira (EOA ou contrato na Base)","obrigatorio":true}},"body":{"address":"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23"},"exemplo":"curl -s -XPOST $ORIGIN/api/auth/wallet/agent/start -H 'content-type: application/json' -d '{\"address\":\"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23\"}'","retorno":{"message":{"tipo":"string","desc":"EIP-4361"},"issuedAt":{"tipo":"number","desc":"segundos / seconds"},"expiresIn":{"tipo":"number","desc":"300"}},"erros":{"400":"invalid_wallet_address","503":"auth_unavailable"},"returns":"{ message, issuedAt, expiresIn }","url":"https://commsharbor.com/api/auth/wallet/agent/start","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/auth/wallet/agent/token","auth":"none","grupo":"Account","summary":"Get the wallet credential (mmw_…) of this product.","desc":"The wallet's signature of the start message, checked here (own key) or on Base (contract, EIP-1271/6492). The credential lasts 30 days: send `Authorization: Bearer mmw_…` to the routes that accept the wallet as owner (owner `x402:<address>`). Once the wallet is linked to an account, what it did here moves to the account when the person signs in.","corpo":{"address":{"tipo":"string","desc":"0x…, a mesma carteira do start / the same wallet as in start","obrigatorio":true},"issuedAt":{"tipo":"number","desc":"o issuedAt do start / start's issuedAt","obrigatorio":true},"signature":{"tipo":"string","desc":"personal_sign (0x…)","obrigatorio":true}},"body":{"address":"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23","issuedAt":1791400000,"signature":"0x…"},"exemplo":"curl -s -XPOST $ORIGIN/api/auth/wallet/agent/token -H 'content-type: application/json' -d '{\"address\":\"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23\",\"issuedAt\":1791400000,\"signature\":\"0x…\"}'","retorno":{"token":{"tipo":"string","desc":"mmw_…"},"owner":{"tipo":"string","desc":"x402:0x…"},"expiresAt":{"tipo":"number","desc":"segundos / seconds"}},"erros":{"400":"invalid_body","401":"invalid_wallet","429":"wallet_limited","503":"wallet_unavailable / auth_unavailable"},"returns":"{ token, owner, expiresAt }","url":"https://commsharbor.com/api/auth/wallet/agent/token","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/auth/claim/wallets","auth":"session","grupo":"Account","summary":"Move to the account what its wallets did without an account.","desc":"The sign-in window calls it after every sign-in. For each wallet linked to the account: the rights bought here by x402 (owner x402:<address>) and what this product keeps for that owner. Repeating moves nothing.","exemplo":"await MMConta.fetch(new URL(\"$ORIGIN/api/auth/claim/wallets\").pathname, { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: \"{}\" })","retorno":{"carteiras":{"tipo":"number","desc":"wallets"},"direitos":{"tipo":"number","desc":"rights moved"}},"erros":{"401":"invalid_session","503":"auth_unavailable"},"returns":"{ carteiras, direitos }","url":"https://commsharbor.com/api/auth/claim/wallets","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/guest","auth":"none","grupo":"Account","summary":"Open or restore a temporary workspace in this browser.","desc":"Sets a host-only HttpOnly guest cookie. The SDK limits issuance to 20 per network per hour; a valid cookie is reused.","retorno":{"guest_token":{"tipo":"string","desc":"Signed guest token for an API client."}},"erros":{"429":"guest_rate_limited","503":"auth_unavailable"},"returns":"{ guest_token }","url":"https://commsharbor.com/api/guest","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/visitor","auth":"guest","grupo":"Account","summary":"Read the temporary workspace id.","desc":"The id is derived by the shared account library; product data stays under this id when you link an account.","retorno":{"organization":{"tipo":"object","desc":"`{id,name:null,role:'guest'}`."}},"erros":{"401":"unauthorized / guest_ended","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/visitor\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ organization }","url":"https://commsharbor.com/api/visitor","auth_detail":"Temporary workspace of this browser (`POST /api/guest`): the HttpOnly `cm_guest` cookie, host-only, or the signed `cm_…` token in `X-Guest-Token` for an API client. It works without an account until `POST /api/auth/claim` attaches it to one; nothing signs anyone in automatically."},{"method":"POST","path":"/api/auth/claim","auth":"session","grupo":"Account","summary":"Attach this browser's temporary workspace to your global account.","desc":"Requires a recent sign-in with a second factor, as organization ownership does. The workspace stays available as a guest until the claim succeeds.","corpo":{},"retorno":{"ok":{"tipo":"bool","desc":"true when linked."}},"erros":{"401":"unauthorized — no account session; sign in at `/conta/global` first","409":"guest_claim_mfa_required / guest_already_claimed","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/auth/claim\", {method: \"POST\", credentials: \"same-origin\", headers: {\"content-type\": \"application/json\", \"x-csrf-token\": csrf}, body: \"{}\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ ok }","url":"https://commsharbor.com/api/auth/claim","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/me","auth":"session","grupo":"Account","summary":"Read the global profile and the platform role, if any.","desc":"`user.id` is the shared-account ID. Organizations are not listed here: they live in the shared account, which does not list them inside products yet — open a workspace by its ID with `GET /api/organizations/{organization_id}`.","retorno":{"user":{"tipo":"User","desc":"The person behind the session."},"profile":{"tipo":"Profile","desc":"Global MM profile — it belongs to the person, edited on the account, not to a tenant."},"platform_role":{"tipo":"string","desc":"Platform role, when one was explicitly granted. Owning a tenant grants nothing here.","nulo":true}},"erros":{"401":"No session, or the session expired.","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/me\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ user{id,email}, profile{name,locale,timeZone,theme,revision}, platform_role }","url":"https://commsharbor.com/api/me","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/account/organizations","auth":"session","grupo":"Organizations","summary":"List your organizations: ID, name and your role.","desc":"Served by the shared account on this domain; every organization you belong to, whether or not this product is enabled there. Creating, renaming, members, invitations and organization API keys are on the account page, `/conta/global`.","query":{"after":{"tipo":"string","desc":"`next` of the previous page."}},"retorno":{"organizations":{"tipo":"object[]","desc":"Up to 8 per page: `id`, `name`, `revision`, `role` (`owner`, `admin` or `member`) and `mfaRequired`. Product sessions also return `product: {id, enabled, revision}` for this product. Listing does not activate it."},"next":{"tipo":"string","nulo":true,"desc":"Cursor for the next page."}},"erros":{"400":"invalid_organization_cursor","401":"invalid_session","404":"organization_not_found","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/account/organizations\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ organizations, next }","url":"https://commsharbor.com/api/account/organizations","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/context","auth":"organization","grupo":"Organizations","summary":"Resolve which organization and role the current session or API key is acting as.","desc":"Read this before a write when you are not certain which tenant is active. Guessing is how data lands in the wrong organization. An organization API key answers `kind: api_key` with its scopes.","headers":{"X-Organization-Id":{"tipo":"string","desc":"Which organization to act in; required with a session. The shared account checks, on every request, that you belong to it and that CommsHarbor is enabled for it. An organization API key opens only its own organization: send that ID, or omit the header.","obrigatorio":true}},"retorno":"Identity","erros":{"401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","503":"The shared account is unavailable."},"exemplo":"curl -s $ORIGIN/api/context -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","returns":"{ kind, organizationId, userId, sessionId, apiKeyId, scopes, role, organization }","url":"https://commsharbor.com/api/context","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id","auth":"organization","grupo":"Organizations","summary":"Open one organization: its name, your role and its CommsHarbor plan.","desc":"This is how a workspace is opened. Name and role come from the shared account (null with an organization API key, which carries neither); the plan is the organization's global entitlement in CommsHarbor.","params":{"organization_id":{"desc":"Active organization ID (the organization's id in the shared account). It must match `X-Organization-Id`."}},"headers":{"X-Organization-Id":{"tipo":"string","desc":"Which organization to act in; required with a session. The shared account checks, on every request, that you belong to it and that CommsHarbor is enabled for it. An organization API key opens only its own organization: send that ID, or omit the header.","obrigatorio":true}},"retorno":"Organization","erros":{"401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","503":"The shared account is unavailable."},"exemplo":"curl -s $ORIGIN/api/organizations/$ORG -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","returns":"{ id, name, role, email_workspace }","url":"https://commsharbor.com/api/organizations/:organization_id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id/audit","auth":"organization_admin","grupo":"Credentials","summary":"List the append-only audit trail of the organization.","desc":"Audit records are never rewritten and never carry recipient PII.","params":{"organization_id":{"desc":"Active organization ID (the organization's id in the shared account). It must match `X-Organization-Id`."}},"query":{"cursor":{"tipo":"string","desc":"Opaque cursor from the previous page. Do not build or parse it."},"limit":{"tipo":"int","desc":"Page size, from 1 to 100.","padrao":50}},"retorno":"PageCamel<AuditEvent>","erros":{"401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","503":"The shared account is unavailable."},"exemplo":"curl -s '$ORIGIN/api/organizations/$ORG/audit?limit=20' -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","returns":"{ items[{id,action,actor_user_id,target,metadata,created_at}], nextCursor }","url":"https://commsharbor.com/api/organizations/:organization_id/audit","auth_detail":"Owner or admin of the organization (shared-account roles), signed in with a second factor. Never an API key."},{"method":"GET","path":"/api/platform/context","auth":"platform_admin","grupo":"Credentials","summary":"Confirm an explicitly granted platform administrator.","desc":"Tenant ownership grants nothing here: platform access is a separate, explicit grant.","retorno":{"role":{"tipo":"string","desc":"The platform role that was granted."},"user_id":{"tipo":"string","desc":"Who holds it."}},"erros":{"401":"No session.","403":"This person has no platform grant."},"exemplo":"curl -s $ORIGIN/api/platform/context -b \"__Host-mm-auth=$SESSION\"","returns":"{ role, user_id }","url":"https://commsharbor.com/api/platform/context","auth_detail":"Session with an explicit platform_roles grant. Tenant ownership does not grant platform access."},{"method":"GET","path":"/api/organizations/:organization_id/email/domain-import/:service","auth":"organization","grupo":"Email setup","summary":"Read authorized Google metadata. This does not prove DNS ownership.","desc":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"service":{"desc":"search_console or analytics. Each connection has its own consent."}},"erros":{"401":"Account session required. Organization keys cannot access personal Google connections.","403":"Write requires an owner or admin, the same Origin and valid CSRF.","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Google connection required or changed.","503":"Google import unavailable. Retry or use account/manual domain registration."},"exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email/domain-import/search_console -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","retorno":{"connected":{"tipo":"bool","desc":"This identity has a saved connection for this product and service."},"domains":{"tipo":"object[]","desc":"Distinct domain names from authorized properties or selected Analytics web streams."},"groups":{"tipo":"object[]","opcional":true,"desc":"Analytics accounts and properties. No reports are read."},"resolved":{"tipo":"bool","opcional":true,"desc":"Selected Analytics properties have been resolved to domains."},"available":{"tipo":"bool","opcional":true,"desc":"Google client configuration is available. This does not assert consent or verification approval."}},"returns":"{ connected, domains, groups?, resolved?, available? }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domain-import/:service","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domain-import/:service/connect","auth":"organization","grupo":"Email setup","summary":"Start five-minute Google consent with PKCE. Return an authorization URL. Signing in does not grant this access.","desc":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"service":{"desc":"search_console or analytics. Each connection has its own consent."}},"corpo":{"language":{"tipo":"string","valores":["en","pt"],"desc":"Consent return language."}},"erros":{"401":"Account session required. Organization keys cannot access personal Google connections.","403":"Write requires an owner or admin, the same Origin and valid CSRF.","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Google connection required or changed.","503":"Google import unavailable. Retry or use account/manual domain registration."},"exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domain-import/search_console/connect -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H 'content-type: application/json' -d '{\"language\":\"en\"}'","retorno":{"redirect":{"tipo":"string","desc":"Google consent URL. The owner must approve it in a browser."}},"returns":"{ redirect }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domain-import/:service/connect","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domain-import/:service/resolve","auth":"organization","grupo":"Email setup","summary":"Resolve website addresses for up to 20 selected Analytics properties. Search Console does not use this route.","desc":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"service":{"desc":"search_console or analytics. Each connection has its own consent."}},"corpo":{"properties":{"tipo":"array","itens":{"tipo":"string"},"obrigatorio":true,"desc":"Authorized properties/ID values from the catalog, at most 20 unique entries."}},"erros":{"401":"Account session required. Organization keys cannot access personal Google connections.","403":"Write requires an owner or admin, the same Origin and valid CSRF.","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Google connection required or changed.","503":"Google import unavailable. Retry or use account/manual domain registration."},"exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domain-import/analytics/resolve -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H 'content-type: application/json' -d '{\"properties\":[\"properties/123456789\"]}'","retorno":{"connected":{"tipo":"bool","desc":"This identity has a saved connection for this product and service."},"domains":{"tipo":"object[]","desc":"Distinct domain names from authorized properties or selected Analytics web streams."},"groups":{"tipo":"object[]","opcional":true,"desc":"Analytics accounts and properties. No reports are read."},"resolved":{"tipo":"bool","opcional":true,"desc":"Selected Analytics properties have been resolved to domains."},"available":{"tipo":"bool","opcional":true,"desc":"Google client configuration is available. This does not assert consent or verification approval."}},"returns":"{ connected, domains, groups?, resolved?, available? }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domain-import/:service/resolve","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domain-import/:service/disconnect","auth":"organization","grupo":"Email setup","summary":"Remove this product's saved Google connection and pending consent. Existing email and service resources remain intact.","desc":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"service":{"desc":"search_console or analytics. Each connection has its own consent."}},"corpo":{},"erros":{"401":"Account session required. Organization keys cannot access personal Google connections.","403":"Write requires an owner or admin, the same Origin and valid CSRF.","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Google connection required or changed.","503":"Google import unavailable. Retry or use account/manual domain registration."},"exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domain-import/search_console/disconnect -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H 'content-type: application/json' -d '{}'","retorno":{"connected":{"tipo":"bool","desc":"This identity has a saved connection for this product and service."},"domains":{"tipo":"object[]","desc":"Distinct domain names from authorized properties or selected Analytics web streams."},"groups":{"tipo":"object[]","opcional":true,"desc":"Analytics accounts and properties. No reports are read."},"resolved":{"tipo":"bool","opcional":true,"desc":"Selected Analytics properties have been resolved to domains."},"available":{"tipo":"bool","opcional":true,"desc":"Google client configuration is available. This does not assert consent or verification approval."}},"returns":"{ connected, domains, groups?, resolved?, available? }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domain-import/:service/disconnect","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id/email/domains/:resource_id/products","auth":"organization","grupo":"Email setup","summary":"Read services associated with this exact domain.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"resource_id":{"desc":"Domain ID in the caller's email organization."}},"desc":"The private email backend confirms domain ownership in this organization. Selected native products must already be enabled. Association is idempotent. It does not create a PageAudit project, HookPulse monitor or paid subscription.","retorno":{"services":{"tipo":"string[]","desc":"Associated services with native organization access still enabled."}},"erros":{"400":"Invalid or duplicate service.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Native product access must be enabled first.","503":"Domain services unavailable."},"exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email/domains/$DOMAIN/products -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","returns":"{ services }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domains/:resource_id/products","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domains/:resource_id/products","auth":"organization","grupo":"Email setup","summary":"Associate explicitly selected services with this domain.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"resource_id":{"desc":"Domain ID in the caller's email organization."}},"desc":"The private email backend confirms domain ownership in this organization. Selected native products must already be enabled. Association is idempotent. It does not create a PageAudit project, HookPulse monitor or paid subscription.","retorno":{"services":{"tipo":"string[]","desc":"Associated services with native organization access still enabled."}},"erros":{"400":"Invalid or duplicate service.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Native product access must be enabled first.","503":"Domain services unavailable."},"exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domains/$DOMAIN/products -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H 'content-type: application/json' -d '{\"services\":[\"pageaudit\"]}'","corpo":{"services":{"tipo":"array","itens":{"tipo":"string"},"obrigatorio":true,"desc":"At most two unique values: pageaudit and hookpulse."}},"returns":"{ services }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domains/:resource_id/products","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/realtime/ticket","auth":"session","grupo":"Realtime","summary":"Create a short-lived browser ticket for the selected email workspace.","desc":"Use the shared browser client with the session, CSRF and X-Organization-Id headers. Guests and API keys cannot create browser tickets. Server integrations use the HTTP management API.","corpo":{},"retorno":{"ticket":{"tipo":"string","desc":"Opaque browser credential. Do not log or store it."},"expires_in":{"tipo":"int","desc":"Seconds before an unused ticket expires."},"namespace":{"tipo":"string","desc":"Product namespace on the shared transport."}},"erros":{"401":"Session ended.","403":"Organization access denied.","503":"Live channel unavailable."},"exemplo":"curl -s -XPOST $ORIGIN/api/realtime/ticket -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H 'content-type: application/json' -d '{}'","returns":"{ ticket, expires_in, namespace }","url":"https://commsharbor.com/api/realtime/ticket","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/email/workspaces/:id","auth":"organization","grupo":"Realtime","summary":"Read the aggregate used by the live email workspace.","desc":"The ID must match X-Organization-Id. Membership is checked again for each snapshot and delivered event. Events contain only an opaque change ID. DNS checks run in the private backend, with a 24-hour deadline and a visible resume action after pause.","params":{"id":{"desc":"Selected organization ID."}},"retorno":{"plan":{"tipo":"string","nulo":true,"desc":"Current free, paid or operator bootstrap plan."},"subscription":{"tipo":"object","desc":"Observed service state and valid_until. Optional payment has state confirmed, plan, environment, valid_until and renewal_state from the current paid grant. A sandbox payment cannot activate a production service. Cancellation stops renewal and preserves the confirmed paid period. No payer or card data."},"capabilities":{"tipo":"object","desc":"Observed smtp_send, storage_mode and storage_mb. Trial uses shared storage and denies sending. A paid upgrade can remain awaiting_activation while native mailbox policy is updated."},"bootstrap":{"tipo":"bool","desc":"Operator-managed adoption."},"activation_required":{"tipo":"bool","opcional":true,"desc":"The confirmed payment environment cannot provision this control environment. Request operator activation. This field does not grant provisioning."},"access_state":{"tipo":"string","desc":"Active or expired paid access. Expiry preserves stored mailbox data."},"usage":{"tipo":"object","desc":"Reserved domain, mailbox, alias and storage counts."},"domains":{"tipo":"object[]","desc":"Domains with observed state, DNS provider, copyable setup instructions and verified webmail URLs. dns_progress has completed, total, percent, ready, checked_at and records. Each record has verified, status (pending: no answer of this type; mismatch: different published value; unavailable: lookup failed; verified: matched) and observed (up to 16 published values, 4096 characters each). No observation means not checked yet. dns_monitor has state and, when scheduled, next_check_at in UTC; checking is true while the job runs. A due time is not a propagation estimate. Percent counts confirmed records, not delivery readiness. DNS completion alone does not grant mailbox creation. Assistance has job_id, state and requested_at."},"mailboxes":{"tipo":"object[]","desc":"Mailbox addresses, display names and quotas. No passwords."},"aliases":{"tipo":"object[]","desc":"Alias addresses and destinations."},"jobs":{"tipo":"object[]","desc":"At most 20 recent jobs. Monitoring is an active scheduled observation, not a completed setup. Each job also has its direct status_url."}},"erros":{"401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","503":"The shared account is unavailable."},"exemplo":"curl -s $ORIGIN/api/email/workspaces/$ORG -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","returns":"{ plan, subscription, capabilities, bootstrap, activation_required?, access_state, usage, domains, mailboxes, aliases, jobs }","url":"https://commsharbor.com/api/email/workspaces/:id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/email/plans","auth":"none","grupo":"Email","summary":"Read the free Trial, three paid packages, storage allowances and activation terms.","query":{"lingua":{"tipo":"string","valores":["en","pt"],"desc":"Selected language. Without it, use the shared request language policy."}},"retorno":{"currency":{"tipo":"string","desc":"Display currency: BRL only for Portuguese and country BR from the trusted origin. Otherwise USD, including unknown country."},"country":{"tipo":"string","desc":"Country supplied by the trusted origin, or empty when unknown. A query or client header cannot set it."},"brl_per_usd":{"tipo":"number","desc":"Configured reference exchange rate. This is not your card issuer's exchange rate."},"price_is_estimate":{"tipo":"bool","desc":"True for USD display prices. Card charges use billing_currency and billing_price_cents."},"billing_currency":{"tipo":"string","desc":"BRL. The current subscription provider charges Brazilian reais."},"interval":{"tipo":"string","desc":"Monthly billing."},"auto_renew":{"tipo":"bool","desc":"Monthly automatic renewal until cancellation."},"cancellation":{"tipo":"string","desc":"Cancellation stops future charges."},"paid_access":{"tipo":"string","desc":"Access lasts until the end of the paid period."},"trial_days":{"tipo":"int","desc":"Zero. There is no automatic trial conversion."},"trial":{"tipo":"object","desc":"Free receive-only trial for `days` (7) days, once per organization: storage_mb 1024 shared across unlimited mailboxes (mailboxes null), one domain, smtp_send false, no card and no automatic renewal (`expires` true). After it ends, writes without a paid plan answer 402 `email_trial_expired`. activation_ready is true only after native quota and protocol proof. Activation uses the organization trial route. A paid subscription enables sending only after backend confirmation."},"plans":{"tipo":"object[]","desc":"Three packages with price_cents in display currency, billing_price_cents in BRL, domains, mailboxes, mailbox_gb, email_storage_gb, files_gb, aliases, features and on_demand."},"checkout_live":{"tipo":"bool","desc":"Whether new real subscriptions are open."},"on_demand_activation":{"tipo":"string","desc":"Agree scope and activation date before charging for on-demand services."}},"exemplo":"curl -s $ORIGIN/api/email/plans?lingua=en","returns":"{ currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation }","url":"https://commsharbor.com/api/email/plans","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/pricing","auth":"none","grupo":"Discovery","summary":"Read monthly email packages and purchase entry points.","query":{"lingua":{"tipo":"string","valores":["en","pt"],"desc":"Selected language. Without it, use the shared request language policy."}},"exemplo":"curl -s $ORIGIN/api/pricing?lingua=en","retorno":{"currency":{"tipo":"string","desc":"Display currency: BRL only for Portuguese and country BR from the trusted origin. Otherwise USD, including unknown country."},"country":{"tipo":"string","desc":"Country supplied by the trusted origin, or empty when unknown. A query or client header cannot set it."},"brl_per_usd":{"tipo":"number","desc":"Configured reference exchange rate. This is not your card issuer's exchange rate."},"price_is_estimate":{"tipo":"bool","desc":"True for USD display prices. Card charges use billing_currency and billing_price_cents."},"billing_currency":{"tipo":"string","desc":"BRL. The current subscription provider charges Brazilian reais."},"interval":{"tipo":"string","desc":"Monthly billing."},"auto_renew":{"tipo":"bool","desc":"Monthly automatic renewal until cancellation."},"cancellation":{"tipo":"string","desc":"Cancellation stops future charges."},"paid_access":{"tipo":"string","desc":"Access lasts until the end of the paid period."},"trial_days":{"tipo":"int","desc":"Zero. There is no automatic trial conversion."},"trial":{"tipo":"object","desc":"Free receive-only trial for `days` (7) days, once per organization: storage_mb 1024 shared across unlimited mailboxes (mailboxes null), one domain, smtp_send false, no card and no automatic renewal (`expires` true). After it ends, writes without a paid plan answer 402 `email_trial_expired`. activation_ready is true only after native quota and protocol proof. Activation uses the organization trial route. A paid subscription enables sending only after backend confirmation."},"plans":{"tipo":"object[]","desc":"Three packages with price_cents in display currency, billing_price_cents in BRL, domains, mailboxes, mailbox_gb, email_storage_gb, files_gb, aliases, features and on_demand."},"checkout_live":{"tipo":"bool","desc":"Whether new real subscriptions are open."},"on_demand_activation":{"tipo":"string","desc":"Agree scope and activation date before charging for on-demand services."},"product":{"tipo":"string","desc":"CommsHarbor."},"pricing":{"tipo":"string","desc":"Current package catalog URL."},"billing":{"tipo":"string","desc":"Monthly subscription offer catalog URL."},"api_index":{"tipo":"string","desc":"API catalog URL."}},"returns":"{ currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation, product, pricing, billing, api_index }","url":"https://commsharbor.com/api/pricing","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/billing","auth":"none","grupo":"Discovery","summary":"Read the same email package catalog at the billing address, with the subscription offers URL.","query":{"lingua":{"tipo":"string","valores":["en","pt"],"desc":"Selected language. Without it, use the shared request language policy."}},"exemplo":"curl -s $ORIGIN/api/billing?lingua=en","retorno":{"currency":{"tipo":"string","desc":"Display currency: BRL only for Portuguese and country BR from the trusted origin. Otherwise USD, including unknown country."},"country":{"tipo":"string","desc":"Country supplied by the trusted origin, or empty when unknown. A query or client header cannot set it."},"brl_per_usd":{"tipo":"number","desc":"Configured reference exchange rate. This is not your card issuer's exchange rate."},"price_is_estimate":{"tipo":"bool","desc":"True for USD display prices. Card charges use billing_currency and billing_price_cents."},"billing_currency":{"tipo":"string","desc":"BRL. The current subscription provider charges Brazilian reais."},"interval":{"tipo":"string","desc":"Monthly billing."},"auto_renew":{"tipo":"bool","desc":"Monthly automatic renewal until cancellation."},"cancellation":{"tipo":"string","desc":"Cancellation stops future charges."},"paid_access":{"tipo":"string","desc":"Access lasts until the end of the paid period."},"trial_days":{"tipo":"int","desc":"Zero. There is no automatic trial conversion."},"trial":{"tipo":"object","desc":"Free receive-only trial for `days` (7) days, once per organization: storage_mb 1024 shared across unlimited mailboxes (mailboxes null), one domain, smtp_send false, no card and no automatic renewal (`expires` true). After it ends, writes without a paid plan answer 402 `email_trial_expired`. activation_ready is true only after native quota and protocol proof. Activation uses the organization trial route. A paid subscription enables sending only after backend confirmation."},"plans":{"tipo":"object[]","desc":"Three packages with price_cents in display currency, billing_price_cents in BRL, domains, mailboxes, mailbox_gb, email_storage_gb, files_gb, aliases, features and on_demand."},"checkout_live":{"tipo":"bool","desc":"Whether new real subscriptions are open."},"on_demand_activation":{"tipo":"string","desc":"Agree scope and activation date before charging for on-demand services."},"product":{"tipo":"string","desc":"CommsHarbor."},"pricing":{"tipo":"string","desc":"Current package catalog URL."},"billing":{"tipo":"string","desc":"Monthly subscription offer catalog URL."},"api_index":{"tipo":"string","desc":"API catalog URL."}},"returns":"{ currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation, product, pricing, billing, api_index }","url":"https://commsharbor.com/api/billing","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/organizations/:organization_id/email","summary":"Read the email workspace.","exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"retorno":{"plan":{"tipo":"string","nulo":true,"desc":"Current free, paid or operator bootstrap plan."},"subscription":{"tipo":"object","desc":"Observed service state and valid_until. Optional payment has state confirmed, plan, environment, valid_until and renewal_state from the current paid grant. A sandbox payment cannot activate a production service. Cancellation stops renewal and preserves the confirmed paid period. No payer or card data."},"capabilities":{"tipo":"object","desc":"Observed smtp_send, storage_mode and storage_mb. Trial uses shared storage and denies sending. A paid upgrade can remain awaiting_activation while native mailbox policy is updated."},"bootstrap":{"tipo":"bool","desc":"Operator-managed adoption."},"activation_required":{"tipo":"bool","opcional":true,"desc":"The confirmed payment environment cannot provision this control environment. Request operator activation. This field does not grant provisioning."},"access_state":{"tipo":"string","desc":"Active or expired paid access. Expiry preserves stored mailbox data."},"usage":{"tipo":"object","desc":"Reserved domain, mailbox, alias and storage counts."},"domains":{"tipo":"object[]","desc":"Domains with observed state, DNS provider, copyable setup instructions and verified webmail URLs. dns_progress has completed, total, percent, ready, checked_at and records. Each record has verified, status (pending: no answer of this type; mismatch: different published value; unavailable: lookup failed; verified: matched) and observed (up to 16 published values, 4096 characters each). No observation means not checked yet. dns_monitor has state and, when scheduled, next_check_at in UTC; checking is true while the job runs. A due time is not a propagation estimate. Percent counts confirmed records, not delivery readiness. DNS completion alone does not grant mailbox creation. Assistance has job_id, state and requested_at."},"mailboxes":{"tipo":"object[]","desc":"Mailbox addresses, display names and quotas. No passwords."},"aliases":{"tipo":"object[]","desc":"Alias addresses and destinations."},"jobs":{"tipo":"object[]","desc":"At most 20 recent jobs. Monitoring is an active scheduled observation, not a completed setup. Each job also has its direct status_url."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ plan, subscription, capabilities, bootstrap, activation_required?, access_state, usage, domains, mailboxes, aliases, jobs }","url":"https://commsharbor.com/api/organizations/:organization_id/email","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/trial","summary":"Start the free receive-only Trial for 7 days, once per organization: 1 GB shared storage, unlimited mailboxes and no outgoing SMTP or external filter forwarding. No card, renewal or charge. After 7 days, writes without a paid plan answer 402 `email_trial_expired`. Requires a new workspace and operator-proved native quota.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/trial -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/trial","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id/email/domain-setup","summary":"Find an existing domain before purchase. Return its organization and domain IDs only when this exact caller can open that organization. Otherwise return existing: null. This read creates no charge or job.","exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email/domain-setup?domain=example.com -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"query":{"domain":{"tipo":"string","desc":"Domain to check, at most 253 characters.","obrigatorio":true}},"retorno":{"existing":{"tipo":"object","nulo":true,"desc":"Authorized existing domain: organization_id, domain_id and organization name. Null also covers a foreign or unavailable organization; no foreign ownership information is returned."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ existing }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domain-setup","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domains","summary":"Register a domain and its ownership challenge.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domains -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"domain\":\"example.com\"}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"corpo":{"domain":{"tipo":"string","desc":"Exact domain name.","obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domains","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id/email/domains/:resource_id","summary":"Read domain setup, DNS records and observed readiness.","exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email/domains/$DOMAIN -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"retorno":{"domain":{"tipo":"object","desc":"Domain setup and observed readiness."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ domain }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domains/:resource_id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domains/:resource_id/verify","summary":"Queue a check of ownership, DNS and certificates.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domains/$DOMAIN/verify -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domains/:resource_id/verify","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domains/:resource_id/assistance","summary":"Request assisted DNS setup. The durable request waits for operator activation. It does not change DNS or expose a provider credential.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domains/$DOMAIN/assistance -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/domains/:resource_id/assistance","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/mailboxes","summary":"Create a mailbox within the current free or paid allowance. Trial mailboxes share 1 GB and cannot send email.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/mailboxes -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"domain_id\":\"$DOMAIN\",\"local_part\":\"ana\",\"name\":\"Ana Souza\"}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"corpo":{"domain_id":{"tipo":"string","desc":"Domain ID from the workspace.","obrigatorio":true},"local_part":{"tipo":"string","desc":"Mailbox name before @.","obrigatorio":true},"name":{"tipo":"string","desc":"Mailbox display name.","obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/mailboxes","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"PATCH","path":"/api/organizations/:organization_id/email/mailboxes/:resource_id","summary":"Change mailbox name or quota within the plan.","exemplo":"curl -s -XPATCH $ORIGIN/api/organizations/$ORG/email/mailboxes/$MAILBOX -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"name\":\"Ana Souza\",\"quota_mb\":2048}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{"name":{"tipo":"string","desc":"Display name."},"quota_mb":{"tipo":"int","desc":"Quota in MiB. Must fit the plan and current usage."},"files_quota_mb":{"tipo":"int","desc":"File allowance in MiB. The sum of mailbox allowances must fit files_gb in the plan. Zero disables files. Existing files are preserved."}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/mailboxes/:resource_id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/mailboxes/:resource_id/password","summary":"Set the mailbox password. It is encrypted for the executor and is never returned.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/mailboxes/$MAILBOX/password -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"password\":\"$MAILBOX_PASSWORD\"}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{"password":{"tipo":"string","desc":"New mailbox password: 14 to 128 characters, with no control characters.","obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/mailboxes/:resource_id/password","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/mailboxes/:resource_id/suspend","summary":"Suspend access while preserving mailbox data.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/mailboxes/$MAILBOX/suspend -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/mailboxes/:resource_id/suspend","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/mailboxes/:resource_id/resume","summary":"Restore suspended mailbox access.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/mailboxes/$MAILBOX/resume -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/mailboxes/:resource_id/resume","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/aliases","summary":"Create an alias to existing mailboxes in this organization.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/aliases -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"domain_id\":\"$DOMAIN\",\"local_part\":\"sales\",\"destinations\":[\"ana@example.com\"]}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"corpo":{"domain_id":{"tipo":"string","desc":"Domain ID from the workspace, where the alias is created.","obrigatorio":true},"local_part":{"tipo":"string","desc":"Alias name before @.","obrigatorio":true},"destinations":{"tipo":"array","desc":"Existing mailbox addresses in this organization.","itens":{"tipo":"string"},"obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/aliases","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"PATCH","path":"/api/organizations/:organization_id/email/aliases/:resource_id","summary":"Change the alias destinations within this organization.","exemplo":"curl -s -XPATCH $ORIGIN/api/organizations/$ORG/email/aliases/$ALIAS -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"destinations\":[\"ana@example.com\",\"bruno@example.com\"]}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{"destinations":{"tipo":"array","desc":"Existing mailbox addresses.","itens":{"tipo":"string"},"obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/aliases/:resource_id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/aliases/:resource_id/suspend","summary":"Suspend an alias without deleting its configuration.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/aliases/$ALIAS/suspend -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/aliases/:resource_id/suspend","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/aliases/:resource_id/resume","summary":"Restore a suspended alias without changing its destinations.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/aliases/$ALIAS/resume -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/aliases/:resource_id/resume","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id/email/jobs/:resource_id","summary":"Read one durable job in this organization.","exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email/jobs/$JOB -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/jobs/:resource_id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/services","summary":"Request an included service with activation on demand.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/services -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"service\":\"migration\"}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"corpo":{"service":{"tipo":"string","desc":"Service code from the plan catalog.","valores":["migration","chat","meetings","documents","shared_mailboxes","bookings","scheduled_send","signatures"],"obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://commsharbor.com/api/organizations/:organization_id/email/services","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/credito/assinaturas","auth":"session","grupo":"Assinaturas","summary":"Lista até 20 assinaturas da própria conta neste produto.","desc":"Exige venda mensal ativa ou homologação habilitada e pagamento de teste autorizado pelo servidor. Sem essa autorização, responde 404. Filtra conta, produto, recebedor e ambiente. Não consulta o Asaas ou conta a tabela. A oferta aceita permanece disponível quando o catálogo deixa de vender essa oferta. Sandbox exige bilhete válido. A query completa admite até 640 caracteres, incluindo o cursor.","query":{"dev":{"tipo":"string","desc":"Bilhete de homologação assinado e vigente. Não autoriza outra conta."},"x402_dev":{"tipo":"string","desc":"Mesmo bilhete de `dev`. Use apenas um desses parâmetros por pedido."},"cursor":{"tipo":"string","desc":"proximo recebido na página anterior: data UTC em ISO com milissegundos, ~ e ID hexadecimal de 32 caracteres."},"recurso":{"tipo":"string","desc":"Recurso do produto: até 256 caracteres, sem controles. Filtra a assinatura da própria conta; vazio indica compra por conta."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Bilhete assinado e vigente da homologação. Sem ele, a flag do corpo não autoriza sandbox."}},"colecao":{"porPagina":20,"teto":20,"anda":"Use proximo como cursor. Ordem decrescente por criado_em e id. Null encerra a lista."},"retorno":{"itens":{"tipo":"RegistroDeAssinatura[]","desc":"Até 20 registros da própria conta."},"proximo":{"tipo":"string","nulo":true,"desc":"Cursor da próxima página, ou null."},"simulado":{"tipo":"bool","desc":"Ambiente autorizado pelo servidor para este pedido."}},"erros":{"400":"Corpo, query, oferta, aceite, cartão ou ambiente inválido; cartão recusado.","401":"Sessão ausente ou inválida; chave de API não autoriza estes pedidos.","403":"Origem ou cookie inválido; na escrita, proteção CSRF inválida.","404":"Venda e homologação não autorizadas; assinatura inexistente, de outra conta, produto, recebedor ou ambiente.","431":"Cabeçalho de cookies acima de 8 KiB.","503":"Conta, banco, configuração ou provedor indisponível; limite de quatro operações simultâneas atingido."},"exemplo":"curl -s $ORIGIN/api/credito/assinaturas -b sessao.cookies","returns":"{ itens[{recurso,id,oferta_id,oferta,estado,simulado,pagamento_em,criado_em,atualizado_em,cancelamento_em,cancelado_em}], proximo, simulado }","url":"https://commsharbor.com/api/credito/assinaturas","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/credito/assinaturas/ofertas","auth":"none","grupo":"Assinaturas","summary":"Consulta a oferta mensal e o ambiente deste pedido, quando o produto habilita assinaturas.","desc":"Exige venda mensal ativa ou homologação habilitada e pagamento de teste autorizado pelo servidor. Sem essa autorização, responde 404. Não cria cobrança, reserva ou benefício. Não converte o teste em contratação.","query":{"dev":{"tipo":"string","desc":"Bilhete de homologação assinado e vigente. Opcional; até 512 caracteres na query."},"x402_dev":{"tipo":"string","desc":"Mesmo bilhete de `dev`. Use apenas um desses parâmetros por pedido."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Bilhete assinado e vigente da homologação. Sem ele, a flag do corpo não autoriza sandbox."}},"retorno":{"ofertas":{"tipo":"OfertaDeAssinatura[]","desc":"De 1 a 8 ofertas versionadas deste produto."},"simulado":{"tipo":"bool","desc":"Ambiente autorizado pelo servidor para este pedido."}},"erros":{"400":"Corpo, query, oferta, aceite, cartão ou ambiente inválido; cartão recusado.","404":"Venda e homologação não autorizadas; assinatura inexistente, de outra conta, produto, recebedor ou ambiente.","503":"Conta, banco, configuração ou provedor indisponível; limite de quatro operações simultâneas atingido."},"exemplo":"curl -s $ORIGIN/api/credito/assinaturas/ofertas","returns":"{ ofertas[{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,cancelamento,acesso_pago,teste_dias,conversao_teste,beneficios,hash}], simulado }","url":"https://commsharbor.com/api/credito/assinaturas/ofertas","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/credito/assinaturas","auth":"session","grupo":"Assinaturas","summary":"Contrata e paga a oferta mensal com cartão pela API, quando habilitado.","desc":"Exige venda mensal ativa ou homologação habilitada e pagamento de teste autorizado pelo servidor. Sem essa autorização, responde 404. Exige sessão autenticada nos últimos cinco minutos. Não aceita Authorization ou X-Api-Key. Envie somente os campos declarados, com JSON até 4 KiB e HTTPS. recurso só é aceito quando o produto exige e confirma sua titularidade no servidor. simulado deve coincidir com o catálogo e com o ambiente autorizado deste pedido. Se o bilhete vencer, o servidor recusa a troca para produção antes de criar a cobrança. Preço e benefícios vêm do servidor. O cartão passa somente nesta requisição ao Asaas; não é salvo nem devolvido. O IP do comprador vem do servidor, nunca do corpo. Aguarde até 120 segundos. Repetir a oferta retorna a reserva existente. Resultado inconclusivo exige consulta pela referência antes de outra criação. A criação não concede benefício. O pagamento confirmado no Asaas concede o período pago.","query":{"dev":{"tipo":"string","desc":"Bilhete de homologação assinado e vigente. Opcional; até 512 caracteres na query."},"x402_dev":{"tipo":"string","desc":"Mesmo bilhete de `dev`. Use apenas um desses parâmetros por pedido."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Bilhete assinado e vigente da homologação. Sem ele, a flag do corpo não autoriza sandbox."},"Origin":{"tipo":"string","obrigatorio":true,"desc":"Origem HTTPS exata deste produto."},"X-CSRF-Token":{"tipo":"string","obrigatorio":true,"desc":"Token de 64 caracteres do bootstrap da sessão deste produto. Protege contra pedidos de outro site."}},"corpo":{"recurso":{"tipo":"string","desc":"Obrigatório somente no produto que vende por recurso. O servidor confirma que a conta é dona dele."},"simulado":{"tipo":"bool","obrigatorio":true,"desc":"Valor do catálogo. Declara intenção; não concede autorização de teste."},"aceite":{"tipo":"AceiteDeAssinatura","obrigatorio":true,"desc":"Somente oferta_id, versao, hash e renovacao; iguais ao catálogo atual."},"cartao":{"tipo":"CartaoDeAssinatura","obrigatorio":true,"desc":"Dados do cartão e de cobrança do titular. Não envie preço, IP, ambiente ou identificador de outra conta."}},"retorno":"RegistroDeAssinatura","erros":{"400":"Corpo, query, oferta, aceite, cartão ou ambiente inválido; cartão recusado.","401":"Sessão ausente ou inválida; chave de API não autoriza estes pedidos.","403":"Origem ou cookie inválido; na escrita, proteção CSRF inválida.","404":"Venda e homologação não autorizadas; assinatura inexistente, de outra conta, produto, recebedor ou ambiente.","409":"Estado incompatível ou outra oferta já reservada para esta conta e produto.","413":"Corpo JSON acima de 4 KiB.","415":"Tipo do corpo diferente de application/json, ou corpo comprimido.","429":"A conta atingiu o limite diário de criação de cobranças.","431":"Cabeçalho de cookies acima de 8 KiB.","503":"Conta, banco, configuração ou provedor indisponível; limite de quatro operações simultâneas atingido."},"exemplo":"curl -s -X POST $ORIGIN/api/credito/assinaturas -b sessao.cookies -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"content-type: application/json\" --data-binary @contratacao.json","returns":"{ recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,cancelamento,acesso_pago,teste_dias,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em }","url":"https://commsharbor.com/api/credito/assinaturas","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/credito/assinaturas/:id","auth":"session","grupo":"Assinaturas","summary":"Consulta a própria assinatura e a oferta aceita, sem criar pagamento.","desc":"Exige venda mensal ativa ou homologação habilitada e pagamento de teste autorizado pelo servidor. Sem essa autorização, responde 404. Exige sessão válida deste produto. Não consulta o provedor. Sandbox exige bilhete válido também na leitura.","query":{"dev":{"tipo":"string","desc":"Bilhete de homologação assinado e vigente. Opcional; até 512 caracteres na query."},"x402_dev":{"tipo":"string","desc":"Mesmo bilhete de `dev`. Use apenas um desses parâmetros por pedido."},"recurso":{"tipo":"string","desc":"Recurso do produto: até 256 caracteres, sem controles. Filtra a assinatura da própria conta; vazio indica compra por conta."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Bilhete assinado e vigente da homologação. Sem ele, a flag do corpo não autoriza sandbox."}},"params":{"id":{"tipo":"string","desc":"ID local da assinatura: 32 caracteres hexadecimais minúsculos.","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":"RegistroDeAssinatura","erros":{"400":"Corpo, query, oferta, aceite, cartão ou ambiente inválido; cartão recusado.","401":"Sessão ausente ou inválida; chave de API não autoriza estes pedidos.","403":"Origem ou cookie inválido; na escrita, proteção CSRF inválida.","404":"Venda e homologação não autorizadas; assinatura inexistente, de outra conta, produto, recebedor ou ambiente.","431":"Cabeçalho de cookies acima de 8 KiB.","503":"Conta, banco, configuração ou provedor indisponível; limite de quatro operações simultâneas atingido."},"exemplo":"curl -s $ORIGIN/api/credito/assinaturas/0123456789abcdef0123456789abcdef -b sessao.cookies","returns":"{ recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,cancelamento,acesso_pago,teste_dias,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em }","url":"https://commsharbor.com/api/credito/assinaturas/:id","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/credito/assinaturas/:id","auth":"session","grupo":"Assinaturas","summary":"Interrompe futuras cobranças da própria assinatura e mantém o período pago.","desc":"Exige venda mensal ativa ou homologação habilitada e pagamento de teste autorizado pelo servidor. Sem essa autorização, responde 404. Envie somente {} com JSON até 4 KiB, sessão válida, origem e CSRF. Grava o pedido antes de chamar o Asaas. Cancelamento pendente não equivale a cancelamento confirmado. Pode repetir o mesmo pedido. Reembolso tem tratamento próprio; este pedido não estorna o pagamento.","query":{"dev":{"tipo":"string","desc":"Bilhete de homologação assinado e vigente. Opcional; até 512 caracteres na query."},"x402_dev":{"tipo":"string","desc":"Mesmo bilhete de `dev`. Use apenas um desses parâmetros por pedido."},"recurso":{"tipo":"string","desc":"Recurso do produto: até 256 caracteres, sem controles. Filtra a assinatura da própria conta; vazio indica compra por conta."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Bilhete assinado e vigente da homologação. Sem ele, a flag do corpo não autoriza sandbox."},"Origin":{"tipo":"string","obrigatorio":true,"desc":"Origem HTTPS exata deste produto."},"X-CSRF-Token":{"tipo":"string","obrigatorio":true,"desc":"Token de 64 caracteres do bootstrap da sessão deste produto. Protege contra pedidos de outro site."}},"params":{"id":{"tipo":"string","desc":"ID local da assinatura: 32 caracteres hexadecimais minúsculos.","exemplo":"0123456789abcdef0123456789abcdef"}},"body":{},"retorno":"RegistroDeAssinatura","erros":{"400":"Corpo, query, oferta, aceite, cartão ou ambiente inválido; cartão recusado.","401":"Sessão ausente ou inválida; chave de API não autoriza estes pedidos.","403":"Origem ou cookie inválido; na escrita, proteção CSRF inválida.","404":"Venda e homologação não autorizadas; assinatura inexistente, de outra conta, produto, recebedor ou ambiente.","409":"Estado incompatível ou outra oferta já reservada para esta conta e produto.","413":"Corpo JSON acima de 4 KiB.","415":"Tipo do corpo diferente de application/json, ou corpo comprimido.","431":"Cabeçalho de cookies acima de 8 KiB.","503":"Conta, banco, configuração ou provedor indisponível; limite de quatro operações simultâneas atingido."},"exemplo":"curl -s -X POST $ORIGIN/api/credito/assinaturas/0123456789abcdef0123456789abcdef -b sessao.cookies -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"content-type: application/json\" -d '{}'","returns":"{ recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,cancelamento,acesso_pago,teste_dias,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em }","url":"https://commsharbor.com/api/credito/assinaturas/:id","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/credito","auth":"none","summary":"Top up prepaid credit: pay once with x402 and get the token that debits on any API of the house.","grupo":"Credit","query":{"usd":{"tipo":"int","desc":"Package: 1, 5, 10 ou 25 dollars.","obrigatorio":true}},"retorno":{"token":{"tipo":"string","desc":"Bearer token for the balance (`cred_…`). Shown ONCE — it cannot be recovered."},"saldo_usd":{"tipo":"string","desc":"Credited balance."},"guarde":{"tipo":"string","desc":"Warning that the token is the bearer of the credit."},"usar":{"tipo":"string","desc":"How to present the token on paid routes."},"saldo_em":{"tipo":"string","desc":"Where to check balance and statement."}},"erros":{"400":"Package outside the list (1, 5, 10 ou 25).","402":"Unpaid — the body carries the x402 `accepts[]`."},"exemplo":"curl -s -XPOST '$ORIGIN/api/credito?usd=10'","returns":"{ token, saldo_usd, guarde, usar, saldo_em }","url":"https://commsharbor.com/api/credito","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito","auth":"credito","summary":"Credit balance and statement — the latest movements, without returning the token.","grupo":"Credit","retorno":{"saldo_micros":{"tipo":"int","desc":"Balance in micro-dollars (1e-6 USD)."},"saldo_usd":{"tipo":"string","desc":"Formatted balance."},"criado_em":{"tipo":"string","desc":"When the credit was opened."},"movimentos":{"tipo":"object[]","desc":"Recent credits and debits, with product and resource."}},"erros":{"401":"No token, or unknown token."},"exemplo":"curl -s $ORIGIN/api/credito -H 'Authorization: Bearer cred_…'","returns":"{ saldo_micros, saldo_usd, criado_em, movimentos }","url":"https://commsharbor.com/api/credito","auth_detail":"Prepaid credit token in `Authorization: Bearer cred_…` (or the `X-Credito` header). Not an account: it is a bearer of balance."},{"method":"GET","path":"/api/credito/pix","auth":"none","summary":"Credit by Pix (Brazil): the key, the fixed rate, the packs in reais and what the receipt accepts.","grupo":"Credit","retorno":{"chave":{"tipo":"string","desc":"The Pix key that receives the payment."},"brl_por_usd":{"tipo":"number","desc":"Fixed rate used for the packs."},"pacotes":{"tipo":"object[]","desc":"The packs (3, 5, 10 or 25 dollars), each with `brl_centavos` and `copia_e_cola` (the Pix copy-and-paste code for the amount, the same text as the QR: the bank app comes with the amount filled in)."},"comprovante":{"tipo":"object","desc":"Accepted types (photo or PDF) and the maximum size, in bytes."},"liberacao":{"tipo":"string","desc":"`manual`: the owner checks the Pix and releases it."}},"exemplo":"curl -s $ORIGIN/api/credito/pix","returns":"{ chave, brl_por_usd, pacotes, comprovante, liberacao }","url":"https://commsharbor.com/api/credito/pix","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/credito/pix","auth":"none","summary":"Request credit paid by Pix: multipart with `usd`, `comprovante` (photo or PDF up to 2 MB) and `email`; the rest is optional.","desc":"The credit code comes back in the response and works once the owner checks the Pix and releases it (by hand, usually the same day). `email` is required: it is how the owner reaches the person. Optional: `nome`, `pagina` (the page the request came from, up to 2,000 characters) and what the person was buying when the 402 came — `recurso` (up to 2,000), `descricao` (up to 300) and `preco_usd` (decimal, e.g. `0.50`); and `navegador_id` (a UUID that links the requests from the same browser). Everything that arrives is recorded with the request — the receipt included —, with the signed-in account (checked by the session cookie), the network and browser.","grupo":"Credit","retorno":{"id":{"tipo":"string","desc":"Request id, to follow it."},"estado":{"tipo":"string","desc":"`pendente` until the decision."},"credito":{"tipo":"string","desc":"The `cred_…` token, shown ONCE; it works after the release."},"estado_em":{"tipo":"string","desc":"Where to follow the request."}},"erros":{"400":"Pack outside the list (3, 5, 10 or 25), no receipt or no valid e-mail.","413":"Receipt above 2 MB.","415":"Receipt that is neither a photo (JPEG, PNG, WebP) nor a PDF.","429":"This network already sent today's requests.","502":"The e-mail to the owner did not go out: the request is recorded as `falhou`; send it again.","503":"Review queue full, or Pix not available in this app."},"exemplo":"curl -s -XPOST $ORIGIN/api/credito/pix -F usd=5 -F email=you@company.com -F comprovante=@pix.pdf","returns":"{ id, estado, credito, estado_em }","url":"https://commsharbor.com/api/credito/pix","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/pix/:id","auth":"none","summary":"Status of a Pix credit request: `pendente`, `liberado`, `recusado` or `falhou`.","grupo":"Credit","params":{"id":{"desc":"Request id (32 hex).","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":{"estado":{"tipo":"string","desc":"`pendente`, `liberado`, `recusado` or `falhou` (the e-mail to the owner did not go out; send again)."},"usd":{"tipo":"int","desc":"The requested pack."},"decidido_em":{"tipo":"string","desc":"When the owner decided, or `null`."}},"erros":{"404":"Unknown request."},"exemplo":"curl -s $ORIGIN/api/credito/pix/0123456789abcdef0123456789abcdef","returns":"{ estado, usd, decidido_em }","url":"https://commsharbor.com/api/credito/pix/:id","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/credito/asaas/:id/cancelar","auth":"none","grupo":"Crédito","summary":"Cancels a pending charge when the payment dialog closes.","desc":"Requires the `cancelamento` capability returned at creation. An older credit charge accepts its token in `credito`. The product and environment must match. This does not refund payments or remove records. 202 means cancellation is pending; the scheduled worker retries provider failures.","params":{"id":{"desc":"Charge id (32 hex).","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":{"id":{"tipo":"string","desc":"Charge id."},"estado":{"tipo":"string","desc":"`cancelando`, `vencido`, or the confirmed final state."}},"erros":{"404":"Invalid charge or capability, or a different product or environment."},"exemplo":"curl -s -XPOST $ORIGIN/api/credito/asaas/0123456789abcdef0123456789abcdef/cancelar -H 'content-type: application/json' -d '{\"cancelamento\":\"<bilhete>\"}'","returns":"{ id, estado }","url":"https://commsharbor.com/api/credito/asaas/:id/cancelar","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/asaas","auth":"none","summary":"Automatic Pix: whether it is available in this app, the packs in reais and the balance the product sells.","grupo":"Crédito","retorno":{"disponivel":{"tipo":"boolean","desc":"`false` when the app has no Asaas configured (use the Pix with receipt)."},"pacotes":{"tipo":"object[]","desc":"The credit packs (3, 5, 10 or 25 dollars), with `brl_centavos`."},"exatos":{"tipo":"object[]","desc":"Prices declared by the app, with `usd` and `brl_centavos`. Amounts start at R$ 5.00 and cannot exceed R$ 10,000."},"saldo":{"tipo":"object","desc":"When the product sells a balance in reais: the range and whether the account can buy."},"precisa_documento":{"tipo":"boolean","desc":"Whether the payer's CPF or CNPJ is still required."}},"exemplo":"curl -s $ORIGIN/api/credito/asaas","returns":"{ disponivel, pacotes, exatos, saldo, precisa_documento }","url":"https://commsharbor.com/api/credito/asaas","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/credito/asaas","auth":"none","summary":"Creates a dynamic Pix: JSON with `oferta` (`pacote` with `usd`, or `saldo` with `centavos`) and the payer.","desc":"The payment releases what was bought by itself: the pack becomes the `cred_…` token already in the response; the balance goes to the logged-in account's organization. The first purchase needs `documento` (CPF or CNPJ, sent to the gateway and not stored here) and `nome`; `email`, `pagina` and `navegador_id` are optional. With `forma: \"cartao_boleto\"` the charge is open: the response brings `pagamento_em`, the gateway page where you pay by card, boleto or Pix (due in three days). With `forma: \"cartao\"` and `cartao` (`titular`, `numero`, `mes`, `ano`, `cvv`, `documento`, `email`, `cep`, `numero_endereco`, `telefone`), the charge is paid by card in the same request: 200 with `estado: \"pago\"`, 202 with `conferir` while the issuer reviews it, 422 when the card is declined; the card is not stored. Set `usd` to an amount from `pacotes` or `exatos` in the GET response. The server sets the amount in cents and rejects amounts that the app has not declared.","grupo":"Crédito","retorno":{"id":{"tipo":"string","desc":"Charge id, to follow up."},"credito":{"tipo":"string","desc":"For a pack: the `cred_…` token, shown ONCE; valid when the payment arrives."},"forma":{"tipo":"string","desc":"`pix` (the default), `cartao` or `cartao_boleto`."},"pix":{"tipo":"object","desc":"`copia_e_cola`, `imagem` (PNG QR, data URI) and `expira_em`; `pix` form only."},"pagamento_em":{"tipo":"string","desc":"In the `cartao_boleto` form: the gateway payment page."},"estado":{"tipo":"string","desc":"In the `cartao` form: `pago`, or `pendente` with `conferir`."},"estado_em":{"tipo":"string","desc":"Where to follow the payment."},"cancelamento":{"tipo":"string","desc":"Capability to cancel a pending Pix or boleto charge."}},"erros":{"400":"Credit amount outside `pacotes` and `exatos`, amount out of range, invalid CPF/CNPJ, name or e-mail, invalid card data (`cartao_dados`, with the `campo`), or the gateway refused the payer (`pagador_recusado`, with the reason in `detalhe`).","422":"Card declined (`cartao_recusado`, with the `campo` when the gateway says which); try another card with `POST /api/credito/asaas/:id/cartao`.","429":"Limit of 3 attempts per minute or 10 per day, per account or network, or the card limit.","502":"The gateway did not create the Pix; try again.","503":"Automatic Pix unavailable in this app, the gateway is busy (`asaas_ocupado`, wait `retry_after_s`), or too many charges from people not signed in waiting for payment."},"exemplo":"curl -s -XPOST $ORIGIN/api/credito/asaas -H 'content-type: application/json' -d '{\"oferta\":\"pacote\",\"usd\":5,\"documento\":\"000.000.000-00\",\"nome\":\"Ana\"}'","returns":"{ id, credito, forma, pix, pagamento_em, estado, estado_em, cancelamento }","url":"https://commsharbor.com/api/credito/asaas","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/asaas/:id","auth":"none","summary":"State of an automatic Pix charge: `pendente`, `pago`, `vencido`, `estornado` or `falhou`.","grupo":"Crédito","params":{"id":{"desc":"Charge id (32 hex).","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":{"estado":{"tipo":"string","desc":"`pago` releases the pack token or the balance; a Pix paid after the due date counts."},"pago_em":{"tipo":"string","desc":"When the payment was confirmed, or `null`."}},"erros":{"404":"Unknown charge."},"exemplo":"curl -s $ORIGIN/api/credito/asaas/0123456789abcdef0123456789abcdef","returns":"{ estado, pago_em }","url":"https://commsharbor.com/api/credito/asaas/:id","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/credito/asaas/:id/cartao","auth":"none","summary":"Pays a card charge whose card was declined with another card: the same charge, never charged twice.","desc":"JSON with the `cartao` (the same fields as `POST /api/credito/asaas`) and, without an account, the `navegador_id` that created the charge. Only a card charge waiting for payment, by whoever created it, and up to five attempts per charge.","grupo":"Crédito","params":{"id":{"desc":"Id da cobrança (32 hex).","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":{"estado":{"tipo":"string","desc":"`pago`, or `pendente` with `conferir` while the issuer reviews it."},"estado_em":{"tipo":"string","desc":"Where to follow the payment."}},"erros":{"400":"Invalid card data (`cartao_dados`, with the `campo`).","404":"Unknown charge, someone else's charge, or not a card charge.","409":"The charge expired or was closed; start the payment again.","422":"Card declined (`cartao_recusado`).","429":"Used up the card attempts for this charge or for today."},"exemplo":"curl -s -XPOST $ORIGIN/api/credito/asaas/0123456789abcdef0123456789abcdef/cartao -H 'content-type: application/json' -d '{\"cartao\":{…}}'","returns":"{ estado, estado_em }","url":"https://commsharbor.com/api/credito/asaas/:id/cartao","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/asaas/saude","auth":"none","summary":"Health of this app's Pix and enabled subscriptions: failures and reasons for the dashboard.","grupo":"Crédito","retorno":{"ativo":{"tipo":"boolean","desc":"`false` when Asaas and subscriptions are disabled."},"tarefas":{"tipo":"object[]","desc":"Each problem has `id`, `falhando`, and `motivo`. Includes Pix and, when enabled, subscription recovery, queue, and budget. Does not call the provider."}},"exemplo":"curl -s $ORIGIN/api/credito/asaas/saude","returns":"{ ativo, tarefas }","url":"https://commsharbor.com/api/credito/asaas/saude","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/erro-cliente","auth":"none","summary":"Browser error report, sent by the interface itself. Agents need not call it.","grupo":"Operations","desc":"The interface reports on its own JS errors, unhandled rejections, scripts/CSS that failed to load and CSP blocks — once per session — and the app reports handled failures through `window.mmErro.relata`. The server validates the envelope, redacts credentials, e-mails and phone numbers, merges repeats of the same failure per minute and records an operational event; nothing is written to a database. It keeps no IP, cookie, query string or full User-Agent. Always answers 204, even for an invalid report.","corpo":{"code":{"tipo":"string","desc":"Failure code, `UI-` + letters/digits (`UI-JS-001` global error, `UI-PROMESSA-001`, `UI-RECURSO-001`, `UI-CSP-001`, `UI-APP-001` app report).","obrigatorio":true},"phase":{"tipo":"string","desc":"Where it broke, lowercase: `global`, `promessa`, `script`, `load_list`…","obrigatorio":true},"path":{"tipo":"string","desc":"Path of the open page, without query; numbers, hashes and tokens in it are kept as `:id`."},"message":{"tipo":"string","desc":"Error message, up to 2000 characters."},"stack":{"tipo":"string","desc":"Stack trace, up to 12000 characters."},"source":{"tipo":"string","desc":"Originating script; only its path is kept."},"line":{"tipo":"int","desc":"Line in the originating script."},"column":{"tipo":"int","desc":"Column in the originating script."},"visivel":{"tipo":"bool","desc":"Whether the tab was visible when it broke."},"build":{"tipo":"string","desc":"Build of the reporting page (its `<meta name=\"build\">`), up to 64 letters, digits, `.`, `_` or `-`; it dates the failure."}},"body":{"code":"UI-APP-001","phase":"carregar_lista","path":"/","message":"lista 500"},"retorno":{"_texto":"204 with no body, always — an invalid, repeated or over-cap report also gets 204."},"exemplo":"curl -s -XPOST $ORIGIN/api/erro-cliente -H 'content-type: application/json' -d '{\"code\":\"UI-APP-001\",\"phase\":\"carregar_lista\",\"path\":\"/\",\"message\":\"lista 500\"}'","returns":"204 with no body, always — an invalid, repeated or over-cap report also gets 204.","url":"https://commsharbor.com/api/erro-cliente","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/pagamento/aberto","auth":"none","statusOk":202,"summary":"The interface reports a visible payment prompt. Agents must not call this route.","grupo":"Operations","desc":"An empty same-origin report, sent automatically when a payment prompt becomes visible. It starts no payment, grants no access and receives no identity or credentials. It writes no database row per report. Counts events, not unique people. The private operator dashboard separates API payment requests and browser payment views per UTC day; the two counts may overlap.","headers":{"Origin":{"tipo":"string","desc":"The page origin, identical to this route's origin.","obrigatorio":true},"Sec-Fetch-Site":{"tipo":"string","desc":"`same-origin`, set by the browser.","obrigatorio":true},"X-MM-Payment-View":{"tipo":"string","desc":"`1`, set by the shared component.","obrigatorio":true}},"retorno":{"_texto":"202 with no body when accepted; 204 when ignored. Always no-store."},"returns":"202 with no body when accepted; 204 when ignored. Always no-store.","url":"https://commsharbor.com/api/pagamento/aberto","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/funil","auth":"none","statusOk":202,"summary":"The interface reports the steps of a visit (conversion funnel). Agents must not call this route.","grupo":"Operations","desc":"A same-origin batch sent by the page itself: page views, engagement, offer in view, buy click, payment window, payment sent or accepted. It keeps the browser's random id, the path without query, the referring host and the utm tags; never IP, e-mail or account. It writes no database row: one line per batch in the day's journal, with a cap. Declared robots and smoke tests are left out.","headers":{"Origin":{"tipo":"string","desc":"The page origin, identical to this route's origin.","obrigatorio":false},"Content-Type":{"tipo":"string","desc":"`application/json` or `text/plain`.","obrigatorio":true}},"corpo":{"v":{"tipo":"number","desc":"Batch version: `1`.","obrigatorio":true},"vid":{"tipo":"string","desc":"This browser's random id (UUID v4).","obrigatorio":true},"sid":{"tipo":"string","desc":"Session id (30 idle minutes end it).","obrigatorio":true},"sn":{"tipo":"number","desc":"This browser's session number.","obrigatorio":true},"pv":{"tipo":"string","desc":"Page view id.","obrigatorio":true},"e":{"tipo":"object[]","desc":"Up to 40 events `{ t, n, p? }` from the funnel vocabulary.","obrigatorio":true}},"retorno":{"_texto":"202 with no body when stored; 204 when ignored. Always no-store."},"exemplo":"curl -s -XPOST $ORIGIN/api/funil -H 'content-type: text/plain' -H 'x-mm-smoke: 1' -d '{\"v\":1,\"vid\":\"0f8b9c1e-2a3b-4c5d-8e6f-7a8b9c0d1e2f\",\"sid\":\"s1abcdefgh\",\"sn\":1,\"pv\":\"p1abcdefgh\",\"e\":[{\"t\":0,\"n\":\"pagina\"}]}'","returns":"202 with no body when stored; 204 when ignored. Always no-store.","url":"https://commsharbor.com/api/funil","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/funil/arquivos","auth":"none","summary":"Operator: the funnel journal days kept by this app, with the size of each.","grupo":"Operations","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>`.","obrigatorio":true}},"retorno":{"v":{"tipo":"number","desc":"Stored batch version."},"produto":{"tipo":"string","desc":"The product."},"teto":{"tipo":"object","desc":"`bytesDia` and `dias` kept."},"dias":{"tipo":"object[]","desc":"`{ dia, bytes }`, oldest to today."}},"erros":{"401":"Unauthorized","503":"Not configured"},"exemplo":"curl -s $ORIGIN/api/funil/arquivos -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"{ v, produto, teto, dias }","url":"https://commsharbor.com/api/funil/arquivos","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/funil/arquivo","auth":"none","summary":"Operator: a slice of one funnel journal day, as NDJSON, from a byte offset.","grupo":"Operations","desc":"Up to 4 MiB per response, cut at the last whole line. `X-MM-Funil-Proximo` says where to ask for the rest; `X-MM-Funil-Tamanho`, the day's size now.","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>`.","obrigatorio":true}},"query":{"dia":{"tipo":"string","desc":"The day, `YYYY-MM-DD` (UTC).","obrigatorio":true},"desde":{"tipo":"number","desc":"The byte to read from; `0` at the start.","obrigatorio":false}},"retorno":{"_texto":"JSON lines, one per stored batch."},"erros":{"400":"Invalid parameters","401":"Unauthorized","503":"Not configured"},"exemplo":"curl -s \"$ORIGIN/api/funil/arquivo?dia=2026-09-27&desde=0\" -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"JSON lines, one per stored batch.","url":"https://commsharbor.com/api/funil/arquivo","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/vitrine","auth":"none","grupo":"Public stats","summary":"The product's public numbers: traffic, agents, usage and reliability, no money.","desc":"Projection published hourly by the house collector, rounded to two significant digits; `null` is a missing measurement, never zero. 15-minute cache with ETag (`If-None-Match` → 304). There is no way to send numbers through this route: publishing belongs to the collector, with its own token.","retorno":{"v":{"tipo":"int","desc":"Contract version (1)."},"produto":{"tipo":"string","desc":"Product id."},"publicado":{"tipo":"bool","desc":"`false` before the collector's first publication; then only these five keys come."},"atualizado_em":{"tipo":"string","desc":"When the collector published (ISO 8601).","nulo":true},"stale":{"tipo":"bool","desc":"`true` when the projection is older than 26 h."},"nome":{"tipo":"string","desc":"Product name.","opcional":true},"desde":{"tipo":"string","desc":"First day the series covers.","nulo":true,"opcional":true},"fuso":{"tipo":"string","desc":"Time zone of the days (`UTC`).","opcional":true},"hoje":{"tipo":"object","desc":"Today: pages by class (human, AI, bot), API calls by class, machine-surface reads and product usage.","opcional":true},"dias":{"tipo":"object[]","desc":"Up to 31 days, oldest first: `dia`, `paginas`, `api`, `api_ia`, `maquina`, `visitantes`, `uso`.","opcional":true},"janelas":{"tipo":"object","desc":"7- and 30-day sums (`d7`, `d30`).","opcional":true},"visitantes":{"tipo":"object","desc":"Unique visitors at the edge over 7 days.","opcional":true},"pessoas":{"tipo":"object","desc":"GA4 when available: users, sessions, countries, devices and who arrived from AI.","nulo":true,"opcional":true},"agentes":{"tipo":"object","desc":"The AI agents and bots that read the most, 7 days.","opcional":true},"superficies":{"tipo":"object","desc":"Reads of OKF, llms, well-known, OpenAPI and MCP over 7 days.","opcional":true},"mcp":{"tipo":"object","desc":"MCP calls over 7 days.","opcional":true},"uso":{"tipo":"object","desc":"Real product usage per resource: label, today, 7 and 30 days.","opcional":true},"contas":{"tipo":"object","desc":"Users and guests.","nulo":true,"opcional":true},"confiabilidade":{"tipo":"object","desc":"Share of requests without 5xx over 7 days, and the live build.","opcional":true},"catalogo":{"tipo":"object","desc":"Size of the catalog, when the product has one.","nulo":true,"opcional":true},"apoio":{"tipo":"object","desc":"Impressions and clicks per sponsor, when any.","opcional":true}},"exemplo":"curl -s $ORIGIN/api/vitrine","returns":"{ v, produto, publicado, atualizado_em, stale, nome?, desde?, fuso?, hoje?, dias?, janelas?, visitantes?, pessoas?, agentes?, superficies?, mcp?, uso?, contas?, confiabilidade?, catalogo?, apoio? }","url":"https://commsharbor.com/api/vitrine","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/vitrine/operador","auth":"none","grupo":"Public stats","summary":"The product's full document on the operator panel — operator token only.","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>` — the operator class.","obrigatorio":true}},"retorno":{"produto":{"tipo":"string","desc":"Product id."},"atualizado_em":{"tipo":"string","desc":"When the collector published.","nulo":true},"operador":{"tipo":"object","desc":"The collector's full document, with what the public projection leaves out.","nulo":true}},"erros":{"401":"No token, wrong token or a token of another class.","503":"Worker without `METRICS_TOKEN` or without the control plane."},"exemplo":"curl -s $ORIGIN/api/vitrine/operador -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"{ produto, atualizado_em, operador }","url":"https://commsharbor.com/api/vitrine/operador","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/vitrine/painel","auth":"none","grupo":"Public stats","summary":"The whole house panel, in the shape the gm reads — operator token only.","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>` — the operator class.","obrigatorio":true}},"retorno":{"apps":{"tipo":"object[]","desc":"One operator document per product, ordered by id."},"updated":{"tipo":"string","desc":"When the collector closed the round.","opcional":true},"totals":{"tipo":"object","desc":"House totals.","opcional":true}},"erros":{"401":"No token, wrong token or a token of another class.","503":"Worker without `METRICS_TOKEN` or without the control plane."},"exemplo":"curl -s $ORIGIN/api/vitrine/painel -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"{ apps, updated?, totals? }","url":"https://commsharbor.com/api/vitrine/painel","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/vitrine/cursores","auth":"none","grupo":"Public stats","summary":"The resolved-error cursor per product (`borda`, `cli`) — operator token only.","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>` — the operator class.","obrigatorio":true}},"retorno":{"_texto":"JSON: `{ [product]: { borda?: ISO, cli?: ISO } }`; empty is `{}`."},"erros":{"401":"No token, wrong token or a token of another class.","503":"Worker without `METRICS_TOKEN` or without the control plane."},"exemplo":"curl -s $ORIGIN/api/vitrine/cursores -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"JSON: `{ [product]: { borda?: ISO, cli?: ISO } }`; empty is `{}`.","url":"https://commsharbor.com/api/vitrine/cursores","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/partners","auth":"none","grupo":"Partnership","summary":"Partnership, sponsorship and advertising: the product's placements with a suggested price, the public numbers next to them and how to propose.","desc":"Information on request, no activation: placements from the house catalogue priced in USD per 30 days (90 and 365 days discounted), sponsors in effect, an excerpt of `/api/vitrine`, the house wallet (USDC on Base) and the contact path — bank deposit, PIX or invoice are arranged in the reply. Cached for 1 hour.","retorno":{"status":{"tipo":"string","desc":"`sob_consulta`: information and proposal, no activation and no charge."},"produto":{"tipo":"string","desc":"Product name."},"idioma":{"tipo":"string","desc":"Language of the texts (the product's)."},"titulo":{"tipo":"string","desc":"Title of the offer."},"descricao":{"tipo":"string","desc":"One sentence about the offer."},"publico":{"tipo":"string","desc":"Who uses the product — the audience a sponsor reaches."},"modalidades":{"tipo":"object[]","desc":"`{ id, nome }`: patrocinio, parceria, anuncio."},"placements":{"tipo":"object[]","desc":"The product's placements: `id`, `nome`, `onde`, `formato`, `exclusivo`, `medicao`, `price_usd_30d` (suggested; `null` is on request), `exposure[{ dias, price_usd }]` for 30, 90 and 365 days, `disponivel`."},"house_bundle":{"tipo":"object","desc":"The house bundle: footer and agent mention across the ten products, discounted."},"parcerias":{"tipo":"string[]","desc":"Partnership ideas the product is open to discuss."},"current_sponsors":{"tipo":"object[]","desc":"Sponsors in effect: `id`, `nome`, `url`, `frase`, `espacos`, `ate`."},"stats":{"tipo":"object","desc":"Excerpt of the public numbers (`hoje`, `janelas`, `agentes`, `confiabilidade`) and the `link` to `/api/vitrine`; `publicado: false` before the first publication."},"payment":{"tipo":"object","desc":"How to pay: `rede`, `chain_id`, `ativo`, `pay_to`, `eip681` (the house wallet, when declared), `alternativas` and the `nota` — bank deposit, PIX or invoice in the reply."},"contact":{"tipo":"object","desc":"`email`, `form_url`, `api_url` (`POST /api/contact`, free: one message every 10 s per network), `campos` (required), `campos_proposta` (the optional proposal fields, each with its accepted values), `message_template`, `instructions`."},"politica":{"tipo":"object","desc":"Placement label, refused sectors, prepayment, deadlines."},"_links":{"tipo":"object","desc":"`self`, `stats`, `page` (`null` until the page exists), `contact`, `casa` (the same path on the ten products)."}},"exemplo":"curl -s $ORIGIN/api/partners","returns":"{ status, produto, idioma, titulo, descricao, publico, modalidades, placements, house_bundle, parcerias, current_sponsors, stats, payment, contact, politica, _links }","url":"https://commsharbor.com/api/partners","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/contact","auth":"none","summary":"Write to the people behind the product — free, for people and agents alike.","grupo":"Contact","desc":"One route for a question and for a sponsorship, partnership or ad proposal (`tipo`, with the placements of `GET /api/partners`). No captcha, no account, no payment. One message every 10 seconds per network: one that arrives sooner waits its turn and then goes out — no error. The message reaches the team by e-mail, with `email` as the reply address.","corpo":{"name":{"tipo":"string","desc":"What to call the person writing.","obrigatorio":true},"email":{"tipo":"string","desc":"Where to reply.","obrigatorio":true},"message":{"tipo":"string","desc":"What you want to say.","obrigatorio":true},"tipo":{"tipo":"string","desc":"Proposal: `patrocinio`, `parceria` or `anuncio`. Turns on the fields below."},"empresa":{"tipo":"string","desc":"Who is proposing, when it is a company."},"site":{"tipo":"string","desc":"Website of who is proposing."},"orcamento":{"tipo":"string","desc":"`ate_100`, `100_500`, `500_2000`, `2000_mais` or `a_combinar`."},"espaco":{"tipo":"string[]","desc":"Placement ids from `GET /api/partners`, up to 6."},"duracao":{"tipo":"string","desc":"Exposure in days: `30`, `90` or `365`."},"pagamento":{"tipo":"string","desc":"`usdc`, `deposito` or `a_combinar`."}},"body":{"name":"Agent","email":"agent@example.com","message":"hello from an agent"},"retorno":{"ok":{"tipo":"bool","desc":"Always `true` when the message was accepted."}},"erros":{"400":"Validation: `code` names the field.","503":"Contact is not configured on this server."},"exemplo":"curl -s -XPOST $ORIGIN/api/contact -H 'content-type: application/json' -d '{\"name\":\"Agent\",\"email\":\"agent@example.com\",\"message\":\"hello from an agent\"}'","returns":"{ ok }","url":"https://commsharbor.com/api/contact","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/metrics","auth":"none","summary":"Last-7-day metrics for the operator dashboard; with the token, payments come along.","grupo":"Operations","desc":"Without credentials it returns product usage: deliveries per day and organization totals. With `METRICS_TOKEN` as Bearer it adds `payments` — x402 settled on Base mainnet only.","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>` to include the financial block; a wrong token is 401.","obrigatorio":false}},"retorno":"Metricas","erros":{"401":"Wrong operator token.","503":"Worker without METRICS_TOKEN configured."},"exemplo":"curl -s $ORIGIN/api/metrics -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"{ app, today, today_visits, today_contacts?, days, usage, accounts, financeiro?, payments? }","url":"https://commsharbor.com/api/metrics","auth_detail":"Public endpoint. No tenant data is returned."}],"mcp":{"endpoint":"https://commsharbor.com/mcp","transport":"streamable-http","tools":35},"mcp_tools":["commsharbor_health","commsharbor_logout","commsharbor_me","commsharbor_context","commsharbor_organization_get","commsharbor_audit","commsharbor_platform_context","commsharbor_billing_catalog","commsharbor_email_google_catalog","commsharbor_email_google_connect","commsharbor_email_google_resolve","commsharbor_email_google_disconnect","commsharbor_email_domain_products_list","commsharbor_email_domain_products_add","commsharbor_email_workspace_snapshot","commsharbor_email_plans","commsharbor_email_workspace","commsharbor_email_trial_activate","commsharbor_email_domain_setup","commsharbor_email_domain_create","commsharbor_email_domain_get","commsharbor_email_domain_verify","commsharbor_email_domain_assistance","commsharbor_email_mailbox_create","commsharbor_email_mailbox_update","commsharbor_email_mailbox_password","commsharbor_email_mailbox_suspend","commsharbor_email_mailbox_resume","commsharbor_email_alias_create","commsharbor_email_alias_update","commsharbor_email_alias_suspend","commsharbor_email_alias_resume","commsharbor_email_job_get","commsharbor_email_service_request","pricing"]}