# Change an inbox's label or visibility `PATCH /v1/inboxes/{id}` - Authentication: required (Bearer token) - Required scope: `api.inboxes.manage` Two fields, and the omissions are the contract. **`ttl` and `expires_at` are not settable.** An expiry that could be pushed out would make "and then it is gone" a negotiation. Mint another inbox instead. **`allowed_senders` is not settable.** The list is frozen at mint, because `restricted` is a claim about what was verified at that moment — an inbox that could gain senders later could be un-restricted after it had already skipped the quota. **Flipping `visibility` to `org` is a disclosure**, not a setting: it exposes the mail this inbox has received to every colleague holding `inboxes.use`. Flipping back removes their access to anything they have not already read. A body naming neither field is `422`, not a no-op `200`. ## Path parameters - `id` (string, required) — The inbox's UUID, exactly as returned by `POST /v1/inboxes`. A value that is not a UUID is a 404 rather than a 422 — it names nothing, and saying "that is not a valid UUID" would confirm the format of ids that do exist. ## Request body Content type: `application/json` ```json { "visibility": "private", "label": "string" } ``` ## Example request ```bash curl -X PATCH 'https://api.sendops.dev/v1/inboxes/00000000-0000-0000-0000-000000000000' \ -H "Authorization: Bearer $SENDOPS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"visibility":"private","label":"string"}' ``` ## Responses ### 200 — The updated inbox Content type: `application/json` ```json { "id": "00000000-0000-0000-0000-000000000000", "address": "k7q2m9xv4p@sndps.com", "expires_at": "2026-05-17T20:00:00Z", "poll_url": "https://example.com", "pull_url": "https://fetch.sendops.dev/p/pt_ab3k…/messages", "pull_token": { "id": "00000000-0000-0000-0000-000000000000", "prefix": "pt_ab3kd9", "label": "string", "created_at": "2026-05-17T20:00:00Z", "revoked_at": "2026-05-17T20:00:00Z" }, "restricted": true, "restriction_source": "verified", "account_ref": "ws_123", "visibility": "private", "label": "string", "status": "active", "allowed_senders": [ "string" ], "message_count": 0, "dropped_count": 0, "created_at": "2026-05-17T20:00:00Z" } ``` ### 401 — Missing, malformed, or unknown API key Content type: `application/problem+json` ```json { "type": "https://example.com", "title": "string", "status": 0, "detail": "string", "code": "invalid_key", "request_id": "string", "retry_after": 0, "retention_days": 0, "scope": "string", "resource": "string", "errors": [ { "field": "string", "reason": "string" } ], "attribute_id": "00000000-0000-0000-0000-000000000000", "content_hash": "string", "differs": [ "string" ] } ``` ### 403 — Either the credential lacks the required scope (`code: invalid_scope`), or it is bound to the `test` environment and this operation is irreversible (`code: test_environment_forbidden`). Branch on `code`: the first is fixed by granting the scope, the second only by using a live credential. See the "Live and test credentials" section of the API description. Content type: `application/problem+json` ```json { "type": "https://example.com", "title": "string", "status": 0, "detail": "string", "code": "invalid_key", "request_id": "string", "retry_after": 0, "retention_days": 0, "scope": "string", "resource": "string", "errors": [ { "field": "string", "reason": "string" } ], "attribute_id": "00000000-0000-0000-0000-000000000000", "content_hash": "string", "differs": [ "string" ] } ``` ### 404 — Resource not found Content type: `application/problem+json` ```json { "type": "https://example.com", "title": "string", "status": 0, "detail": "string", "code": "invalid_key", "request_id": "string", "retry_after": 0, "retention_days": 0, "scope": "string", "resource": "string", "errors": [ { "field": "string", "reason": "string" } ], "attribute_id": "00000000-0000-0000-0000-000000000000", "content_hash": "string", "differs": [ "string" ] } ``` ### 422 — A query parameter, path value or body field failed validation. The body is a `validation_failed` Problem. When the refusal is about a reference — a segment key, template slug, topic or attribute name the organization does not have — it additionally carries `validation_code`, `field`, `line`/`column`, `missing`, `candidates` and `next_step`, so a client can correct the call without a second round of guessing. See `ValidationProblem`. Content type: `application/problem+json` ```json { "type": "https://example.com", "title": "string", "status": 0, "detail": "string", "code": "invalid_key", "request_id": "string", "retry_after": 0, "retention_days": 0, "scope": "string", "resource": "string", "errors": [ { "field": "string", "reason": "string" } ], "attribute_id": "00000000-0000-0000-0000-000000000000", "content_hash": "string", "differs": [ "string" ], "validation_code": "invalid_syntax", "field": "string", "line": 0, "column": 0, "missing": [ { "kind": "segment", "key": "string" } ], "candidates": {}, "next_step": "string" } ``` ### 429 — Per-org rate limit exceeded Content type: `application/problem+json` ```json { "type": "https://example.com", "title": "string", "status": 0, "detail": "string", "code": "invalid_key", "request_id": "string", "retry_after": 0, "retention_days": 0, "scope": "string", "resource": "string", "errors": [ { "field": "string", "reason": "string" } ], "attribute_id": "00000000-0000-0000-0000-000000000000", "content_hash": "string", "differs": [ "string" ] } ``` ### 500 — Unexpected server-side failure. The `code` is `internal_error`. The `request_id` field can be quoted to SendOps support to investigate. Content type: `application/problem+json` ```json { "type": "https://example.com", "title": "string", "status": 0, "detail": "string", "code": "invalid_key", "request_id": "string", "retry_after": 0, "retention_days": 0, "scope": "string", "resource": "string", "errors": [ { "field": "string", "reason": "string" } ], "attribute_id": "00000000-0000-0000-0000-000000000000", "content_hash": "string", "differs": [ "string" ] } ```