{"name":"CommsHarbor","description":"Domain email, webmail and mailbox management for teams and agents. Free Trial shares 1 GB across unlimited receive-only mailboxes. Three paid monthly packages include sending. Enterprise services have activation on demand.","build":"ef1ee6a8","environment":"production","base_url":"https://staging.commsharbor.com","docs":{"llms":"https://staging.commsharbor.com/llms.txt","llms_full":"https://staging.commsharbor.com/llms-full.txt","openapi":"https://staging.commsharbor.com/openapi.json","mcp":"https://staging.commsharbor.com/mcp","pricing":"https://staging.commsharbor.com/api/pricing","billing":"https://staging.commsharbor.com/api/billing","human_ui":"https://staging.commsharbor.com/","data_indexes":[{"id":"cep","produto":"https://pontofato.com","caminho":"/enderecos","title":"Postal codes and addresses","description":"Find addresses by location, with coordinates and a 2022 reference date. Not a current postal-code certification. Each HTML page opens the product app with its public data already rendered.","hierarchy":"State → municipality → locality → street → addresses","url":"https://pontofato.com/enderecos/","formats":{"html":"https://pontofato.com/enderecos/","json":"https://api.pontofato.com/enderecos/index.json","md":"https://api.pontofato.com/enderecos/index.md","okf":"https://api.pontofato.com/enderecos/index.okf.md"},"llms":"https://api.pontofato.com/enderecos/llms.txt","openapi":"https://api.pontofato.com/enderecos/openapi.json","mcp":"https://api.pontofato.com/enderecos/mcp","okf":"https://api.pontofato.com/enderecos/okf/index.md","access":"public-read-only","pagination":{"max_items":20,"next":"links.proximo"},"updates":"manual"},{"id":"editais","produto":"https://editalmd.com","caminho":"/licitacoes","title":"Public procurement","description":"Find public procurement by location and date. View documents and reading options in EditalMD. Each HTML page opens the product app with its public data already rendered.","hierarchy":"Procedure → state → year → month → day → municipality → purchases","url":"https://editalmd.com/licitacoes/","formats":{"html":"https://editalmd.com/licitacoes/","json":"https://api.editalmd.com/licitacoes/index.json","md":"https://api.editalmd.com/licitacoes/index.md","okf":"https://api.editalmd.com/licitacoes/index.okf.md"},"llms":"https://api.editalmd.com/licitacoes/llms.txt","openapi":"https://api.editalmd.com/licitacoes/openapi.json","mcp":"https://api.editalmd.com/licitacoes/mcp","okf":"https://api.editalmd.com/licitacoes/okf/index.md","access":"public-read-only","pagination":{"max_items":20,"next":"links.proximo"},"updates":"manual"}]},"auth":{"credito":"Credit token in `Authorization: Bearer cred_…` or `X-Credito`. For recovered x402 funds, use the wallet credential mmw_… in Bearer or X-Wallet-Token, issued through /api/auth/wallet/agent/start and /api/auth/wallet/agent/token.","none":"Public endpoint. No tenant data is returned.","guest":"Temporary workspace of this browser (`POST /api/guest`): the HttpOnly `cm_guest` cookie, host-only, or the signed `cm_…` token in `X-Guest-Token` for an API client. It works without an account until `POST /api/auth/claim` attaches it to one; nothing signs anyone in automatically.","session":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied.","organization":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail.","organization_admin":"Owner or admin of the organization (shared-account roles), signed in with a second factor. Never an API key.","platform_admin":"Session with an explicit platform_roles grant. Tenant ownership does not grant platform access."},"endpoints":[{"method":"GET","path":"/agent.json","auth":"none","summary":"Agent card: identity, operator, documentation, the MCP endpoint and the tools it serves. Same document as `/.well-known/agent-card.json`.","grupo":"Discovery","retorno":{"_texto":"`application/json`: `name`, `provider`, `protocol` (`mcp`), `interfaces[]` and `skills[]`."},"exemplo":"curl -s $ORIGIN/agent.json","returns":"`application/json`: `name`, `provider`, `protocol` (`mcp`), `interfaces[]` and `skills[]`.","url":"https://staging.commsharbor.com/agent.json","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/okf/:arquivo","auth":"none","summary":"OKF bundle (Open Knowledge Format v0.1): markdown with frontmatter so an agent reads the whole product without parsing HTML.","grupo":"Discovery","params":{"arquivo":{"desc":"`index.md`, `sobre.md`, `api.md` or `faq.md`.","exemplo":"index.md"}},"retorno":{"_texto":"`text/markdown`. Start at `/okf/index.md`, which lists the bundle."},"erros":{"404":"File outside the bundle."},"exemplo":"curl -s $ORIGIN/okf/index.md","returns":"`text/markdown`. Start at `/okf/index.md`, which lists the bundle.","url":"https://staging.commsharbor.com/okf/:arquivo","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/.well-known/:arquivo","auth":"none","summary":"Machine discovery before the home page: `api-catalog` (RFC 9727, a linkset with the API and the MCP), `security.txt` (RFC 9116), `x402` (payment manifest: network, wallet and the routes that charge) and `mcp-registry-auth` (the official MCP registry key).","grupo":"Discovery","params":{"arquivo":{"desc":"`api-catalog`, `security.txt`, `x402`, `mcp-registry-auth` or `apis.json`.","exemplo":"api-catalog"}},"retorno":{"_texto":"`application/linkset+json` for the api-catalog; `application/json` for x402 and apis.json; `text/plain` for the other two."},"erros":{"404":"Name outside the five published."},"exemplo":"curl -s $ORIGIN/.well-known/api-catalog","returns":"`application/linkset+json` for the api-catalog; `application/json` for x402 and apis.json; `text/plain` for the other two.","url":"https://staging.commsharbor.com/.well-known/:arquivo","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/apis.json","auth":"none","summary":"APIs.json (apisjson.org, 0.19): the index APIs.io harvests — the API, the MCP, OpenAPI, guide and OKF bundle in one file. Also at `/.well-known/apis.json`.","grupo":"Discovery","retorno":{"_texto":"`application/json` in the APIs.json 0.19 format: `apis[]` with `baseURL`, `humanURL` and `properties[]`."},"exemplo":"curl -s $ORIGIN/apis.json","returns":"`application/json` in the APIs.json 0.19 format: `apis[]` with `baseURL`, `humanURL` and `properties[]`.","url":"https://staging.commsharbor.com/apis.json","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/","auth":"none","grupo":"Discovery","summary":"Discover the whole API: every endpoint, every auth mode and the MCP endpoint.","retorno":"ApiIndex","returns":"{ name, description, build, environment, base_url, docs, auth, endpoints, mcp, mcp_tools }","url":"https://staging.commsharbor.com/api/","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/health","auth":"none","grupo":"Discovery","summary":"Read liveness, environment and the commit currently deployed.","desc":"Smoke tests wait for their own commit to appear here instead of racing edge propagation.","retorno":"Health","returns":"{ ok, app, build, environment, timestamp }","url":"https://staging.commsharbor.com/api/health","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/mcp","auth":"none","grupo":"Discovery","summary":"Inspect the remote MCP server card: transport, protocol and tool count.","desc":"`POST /mcp` speaks Streamable HTTP with JSON-RPC 2.0. The tools are the operations in this catalog; the MCP has no backend of its own.","retorno":{"transport":{"tipo":"string","desc":"How the server speaks — `streamable-http`."},"protocol_version":{"tipo":"string","desc":"MCP protocol version the server implements."},"endpoint":{"tipo":"string","desc":"Absolute URL to POST JSON-RPC to."},"server":{"tipo":"object","desc":"`name` and `version` of this server; the version is the deployed commit."},"tools":{"tipo":"int","desc":"How many tools the server exposes."},"usage":{"tipo":"string","desc":"One line saying how to call it."},"api_index":{"tipo":"string","desc":"The self-describing API index, for the operations behind the tools."}},"returns":"{ transport, protocol_version, endpoint, server, tools, usage, api_index }","url":"https://staging.commsharbor.com/mcp","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/auth/bootstrap","auth":"none","grupo":"Account","summary":"Prepare the browser for global sign-in.","desc":"Sets a host-only HttpOnly browser cookie. CSRF is bound to the current session. No CORS.","retorno":{"csrf":{"tipo":"string","desc":"X-CSRF-Token"},"context":{"tipo":"string","desc":"Opaque view context, also in X-MM-Context; not a credential / contexto opaco da vista, não é credencial."}},"erros":{"400":"invalid_request","403":"invalid_origin / invalid_csrf","503":"auth_unavailable: a sessão anterior é preservada / the previous session is preserved"},"returns":"{ csrf, context }","url":"https://staging.commsharbor.com/api/auth/bootstrap","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/account/profile","auth":"session","grupo":"Account","exemplo":"await fetch(\"$ORIGIN/api/account/profile\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","summary":"Read your global profile.","desc":"Reads current preferences from the account. Edit them on your account page; products never own a separate profile.","retorno":{"_texto":"{profile:{name,locale,timeZone,theme,revision}}"},"erros":{"401":"invalid_session","503":"auth_unavailable"},"returns":"{profile:{name,locale,timeZone,theme,revision}}","url":"https://staging.commsharbor.com/api/account/profile","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/account/avatar","auth":"session","grupo":"Account","exemplo":"await fetch(\"$ORIGIN/api/account/avatar\", {credentials: \"same-origin\"}).then(r => {if (!r.ok) throw new Error(\"HTTP \" + r.status); return r.blob();});","exemploLinguagem":"js","summary":"Read your global profile photo.","desc":"Private WebP, up to 64 KiB, no cache. Change it on your account. No user ID or object URL accepted.","retorno":{"_texto":"image/webp; Cache-Control: no-store"},"erros":{"401":"invalid_session","404":"not_found: no photo / sem foto","503":"auth_unavailable"},"returns":"image/webp; Cache-Control: no-store","url":"https://staging.commsharbor.com/api/account/avatar","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/auth/logout","auth":"session","grupo":"Account","exemplo":"// Execute no console da página do produto / Run in the product page console.\n(async () => {\n  const origin = \"$ORIGIN\";\n  const {csrf} = await fetch(origin + \"/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(origin + \"/api/auth/logout\", {\n    method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({})\n  });\n  if (!r.ok) throw new Error(\"Auth HTTP \" + r.status);\n  return r.json();\n})();","exemploLinguagem":"js","summary":"Revoke this product session.","desc":"Bootstrap/CSRF must belong to this browser and session. Other product sessions remain active.","retorno":{"ok":{"tipo":"bool","desc":"true"}},"erros":{"400":"invalid_request","403":"invalid_origin / invalid_csrf","503":"auth_unavailable: a sessão anterior é preservada / the previous session is preserved"},"returns":"{ ok }","url":"https://staging.commsharbor.com/api/auth/logout","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/auth/pwa/install","auth":"session","grupo":"Installed app","summary":"Prepare a personal app installation.","desc":"Requires recent sign-in, exact Origin and browser CSRF. Returns a private signed PIN and a no-store manifest address. At most 10 active installations per account and product.","corpo":{"path":{"tipo":"string","obrigatorio":true,"desc":"Same-origin task path, up to 1600 characters."},"state":{"tipo":"object","obrigatorio":true,"desc":"Up to 30 allowlisted preference keys and string values."},"manifest":{"tipo":"object","obrigatorio":true,"desc":"Public app name and same-origin icons."}},"retorno":{"_texto":"{pin,path,manifest}"},"exemplo":"(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const manifest = await fetch(document.querySelector('link[rel=\"manifest\"]').href).then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/auth/pwa/install\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({path: location.pathname + location.search, state: {}, manifest})});\n  return r.json();\n})();","exemploLinguagem":"js","erros":{"400":"invalid_installation_path / invalid_installation_state / invalid_installation_manifest","401":"invalid_session / reauth_required","409":"installation_not_created","503":"auth_unavailable"},"returns":"{pin,path,manifest}","url":"https://staging.commsharbor.com/api/auth/pwa/install","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/auth/pwa/restore","auth":"none","grupo":"Installed app","summary":"Restore an installed app.","desc":"Requires the signed PIN, exact Origin and browser CSRF. Verifies host, product, account status, security version and installation revocation. Keeps the original authentication time. Sensitive actions still require recent sign-in.","corpo":{"pin":{"tipo":"string","obrigatorio":true,"desc":"Private signed installation credential."}},"retorno":{"_texto":"{ok:true,state,path,manifest}; HttpOnly session cookies"},"exemplo":"(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/auth/pwa/restore\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({pin: \"…\"})});\n  return r.json();\n})();","exemploLinguagem":"js","erros":{"401":"invalid_installation","403":"invalid_origin / invalid_csrf","503":"auth_unavailable"},"returns":"{ok:true,state,path,manifest}; HttpOnly session cookies","url":"https://staging.commsharbor.com/api/auth/pwa/restore","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/auth/pwa/manifest","auth":"none","grupo":"Installed app","summary":"Read the private installation manifest.","desc":"Requires the installation cookie and its manifest key. Private, no-store. The start URL keeps the PIN in the fragment.","query":{"key":{"tipo":"string","obrigatorio":true,"desc":"Key in the manifest address that the install or restore call returned."}},"retorno":{"_texto":"application/manifest+json"},"exemplo":"await fetch(\"$ORIGIN/api/auth/pwa/manifest?key=…\", {credentials: \"same-origin\"}).then(r => r.json())","exemploLinguagem":"js","erros":{"401":"invalid_installation"},"returns":"application/manifest+json","url":"https://staging.commsharbor.com/api/auth/pwa/manifest","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/account/keys","auth":"session","grupo":"Account","summary":"List your API keys in this product.","desc":"Never returns the key itself: name, last 4 characters, organization, creation, last use (hourly) and whether it still works.","retorno":{"keys":{"tipo":"object[]","desc":"`id`, `name`, `organizationId`, `last4`, `createdAt`, `lastUsedAt`, `revokedAt`, `active` (false when revoked or stopped by a password change / ending all sessions)."}},"erros":{"401":"invalid_session","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/account/keys\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ keys }","url":"https://staging.commsharbor.com/api/account/keys","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/account/keys/create","auth":"session","grupo":"Account","summary":"Create an API key for agents and scripts.","desc":"Needs a sign-in within the last 2 hours; an organization key also needs a second factor in the session and the owner/admin role with this product enabled. At most 10 live keys per account and product. The key (`secret`) is returned ONCE.","corpo":{"name":{"tipo":"string","obrigatorio":true,"desc":"Up to 60 characters."},"organizationId":{"tipo":"string","nulo":true,"obrigatorio":true,"desc":"`null` for an account key."}},"body":{"name":"agent","organizationId":null},"retorno":{"key":{"tipo":"object","desc":"`id`, `name`, `organizationId`, `last4`, `createdAt`."},"secret":{"tipo":"string","desc":"`mmk_…`, shown once."}},"erros":{"400":"invalid_key_name / invalid_organization","401":"invalid_session / reauth_required","403":"invalid_origin / invalid_csrf / organization_forbidden / organization_mfa_required","409":"key_limit_reached","503":"auth_unavailable"},"exemplo":"(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/account/keys/create\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({name: \"agent\", organizationId: null})});\n  return r.json();\n})();","exemploLinguagem":"js","returns":"{ key, secret }","url":"https://staging.commsharbor.com/api/account/keys/create","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/account/keys/revoke","auth":"session","grupo":"Account","summary":"Revoke one of your API keys.","desc":"Stops the key at once. Repeating is harmless.","corpo":{"id":{"tipo":"string","obrigatorio":true,"desc":"The key `id`."}},"body":{"id":"…"},"retorno":{"ok":{"tipo":"bool","desc":"true"}},"erros":{"400":"invalid_key_id","401":"invalid_session","403":"invalid_origin / invalid_csrf","404":"key_not_found","503":"auth_unavailable"},"exemplo":"(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/account/keys/revoke\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({id: \"…\"})});\n  return r.json();\n})();","exemploLinguagem":"js","returns":"{ ok }","url":"https://staging.commsharbor.com/api/account/keys/revoke","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/account/apps","auth":"session","grupo":"Account","summary":"List the apps connected to your account in this product.","desc":"The MCP clients you signed in with (OAuth), such as claude.ai or ChatGPT. Never returns a token.","retorno":{"apps":{"tipo":"object[]","desc":"Up to 50: `id`, `nome` (the app; its host when it identifies itself by a metadata document), `criadoEm`, `usadoEm` (hourly, or null)."}},"erros":{"401":"invalid_session","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/account/apps\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ apps }","url":"https://staging.commsharbor.com/api/account/apps","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/account/apps/revoke","auth":"session","grupo":"Account","summary":"Disconnect an app from your account.","desc":"Stops the app's access at once; it asks you to sign in again. Repeating is harmless.","corpo":{"id":{"tipo":"string","obrigatorio":true,"desc":"The app `id`."}},"body":{"id":"…"},"retorno":{"ok":{"tipo":"bool","desc":"true"}},"erros":{"400":"invalid_app_id","401":"invalid_session","403":"invalid_origin / invalid_csrf","404":"app_not_found","503":"auth_unavailable"},"exemplo":"(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/account/apps/revoke\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({id: \"…\"})});\n  return r.json();\n})();","exemploLinguagem":"js","returns":"{ ok }","url":"https://staging.commsharbor.com/api/account/apps/revoke","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/account/callouts","auth":"session","grupo":"Account","summary":"List the notices that you closed in this product.","desc":"The keys of the notices that stay closed for your account, on every device, such as the explanation of an area.","retorno":{"callouts":{"tipo":"string[]","desc":"Up to 200 keys, in alphabetical order."}},"erros":{"401":"invalid_session","403":"product_required","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/account/callouts\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ callouts }","url":"https://staging.commsharbor.com/api/account/callouts","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/account/callouts/dismiss","auth":"session","grupo":"Account","summary":"Close a notice for good.","desc":"The notice does not open again for your account in this product. Repeating is harmless.","corpo":{"key":{"tipo":"string","obrigatorio":true,"desc":"The notice key: letters, digits and `_.:-`, up to 80."}},"body":{"key":"financeiro_expense"},"retorno":{"ok":{"tipo":"bool","desc":"true"}},"erros":{"400":"invalid_callout","401":"invalid_session","403":"invalid_origin / invalid_csrf","409":"too_many_callouts","503":"auth_unavailable"},"exemplo":"(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/account/callouts/dismiss\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({key: \"financeiro_expense\"})});\n  return r.json();\n})();","exemploLinguagem":"js","returns":"{ ok }","url":"https://staging.commsharbor.com/api/account/callouts/dismiss","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/account/callouts/reopen","auth":"session","grupo":"Account","summary":"Open a closed notice again.","desc":"Undoes the close: the notice shows again for your account in this product. A product also keeps an on/off choice here, as the hidden values of Finance. Repeating is harmless.","corpo":{"key":{"tipo":"string","obrigatorio":true,"desc":"The notice key: letters, digits and `_.:-`, up to 80."}},"body":{"key":"financeiro_expense"},"retorno":{"ok":{"tipo":"bool","desc":"true"}},"erros":{"400":"invalid_callout","401":"invalid_session","403":"invalid_origin / invalid_csrf","503":"auth_unavailable"},"exemplo":"(async () => {\n  const {csrf} = await fetch(\"$ORIGIN/api/auth/bootstrap\").then(r => r.json());\n  const r = await fetch(\"$ORIGIN/api/account/callouts/reopen\", {method: \"POST\", credentials: \"same-origin\",\n    headers: {\"Content-Type\": \"application/json\", \"X-CSRF-Token\": csrf},\n    body: JSON.stringify({key: \"financeiro_expense\"})});\n  return r.json();\n})();","exemploLinguagem":"js","returns":"{ ok }","url":"https://staging.commsharbor.com/api/account/callouts/reopen","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/auth/wallet/agent/start","auth":"none","grupo":"Account","summary":"Start the wallet credential of an agent without an account.","desc":"No account: the wallet proves it is hers by signing the message (EIP-4361). Signing does not pay or transfer anything. The message names this product and lasts 5 minutes. Before you sign, compare the message with the URL that you called. The domain on the first line must be the host of that URL. URI must be its origin. If one is different, do not sign. Sign it with personal_sign and send it to /api/auth/wallet/agent/token.","corpo":{"address":{"tipo":"string","desc":"0x…, a carteira (EOA ou contrato na Base)","obrigatorio":true}},"body":{"address":"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23"},"exemplo":"curl -s -XPOST $ORIGIN/api/auth/wallet/agent/start -H 'content-type: application/json' -d '{\"address\":\"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23\"}'","retorno":{"message":{"tipo":"string","desc":"EIP-4361"},"issuedAt":{"tipo":"number","desc":"segundos / seconds"},"expiresIn":{"tipo":"number","desc":"300"}},"erros":{"400":"invalid_wallet_address","503":"auth_unavailable"},"returns":"{ message, issuedAt, expiresIn }","url":"https://staging.commsharbor.com/api/auth/wallet/agent/start","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/auth/wallet/agent/token","auth":"none","grupo":"Account","summary":"Get the wallet credential (mmw_…) of this product.","desc":"The wallet's signature of the start message, checked here (own key) or on Base (contract, EIP-1271/6492). The credential lasts 30 days: send `Authorization: Bearer mmw_…` to the routes that accept the wallet as owner (owner `x402:<address>`). Once the wallet is linked to an account, what it did here moves to the account when the person signs in.","corpo":{"address":{"tipo":"string","desc":"0x…, a mesma carteira do start / the same wallet as in start","obrigatorio":true},"issuedAt":{"tipo":"number","desc":"o issuedAt do start / start's issuedAt","obrigatorio":true},"signature":{"tipo":"string","desc":"personal_sign (0x…)","obrigatorio":true}},"body":{"address":"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23","issuedAt":1791400000,"signature":"0x…"},"exemplo":"curl -s -XPOST $ORIGIN/api/auth/wallet/agent/token -H 'content-type: application/json' -d '{\"address\":\"0x2c7536E3605D9C16a7a3D7b1898e529396a65c23\",\"issuedAt\":1791400000,\"signature\":\"0x…\"}'","retorno":{"token":{"tipo":"string","desc":"mmw_…"},"owner":{"tipo":"string","desc":"x402:0x…"},"expiresAt":{"tipo":"number","desc":"segundos / seconds"}},"erros":{"400":"invalid_body","401":"invalid_wallet","429":"wallet_limited","503":"wallet_unavailable / auth_unavailable"},"returns":"{ token, owner, expiresAt }","url":"https://staging.commsharbor.com/api/auth/wallet/agent/token","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/auth/claim/wallets","auth":"session","grupo":"Account","summary":"Move to the account what its wallets did without an account.","desc":"The sign-in window calls it after every sign-in. For each wallet linked to the account: the rights bought here by x402 (owner x402:<address>) and what this product keeps for that owner. Repeating moves nothing.","exemplo":"await MMConta.fetch(new URL(\"$ORIGIN/api/auth/claim/wallets\").pathname, { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: \"{}\" })","retorno":{"carteiras":{"tipo":"number","desc":"wallets"},"direitos":{"tipo":"number","desc":"rights moved"}},"erros":{"401":"invalid_session","503":"auth_unavailable"},"returns":"{ carteiras, direitos }","url":"https://staging.commsharbor.com/api/auth/claim/wallets","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/guest","auth":"none","grupo":"Account","summary":"Open or restore a temporary workspace in this browser.","desc":"Sets a host-only HttpOnly guest cookie. The SDK limits issuance to 20 per network per hour; a valid cookie is reused.","retorno":{"guest_token":{"tipo":"string","desc":"Signed guest token for an API client."}},"erros":{"429":"guest_rate_limited","503":"auth_unavailable"},"returns":"{ guest_token }","url":"https://staging.commsharbor.com/api/guest","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/visitor","auth":"guest","grupo":"Account","summary":"Read the temporary workspace id.","desc":"The id is derived by the shared account library; product data stays under this id when you link an account.","retorno":{"organization":{"tipo":"object","desc":"`{id,name:null,role:'guest'}`."}},"erros":{"401":"unauthorized / guest_ended","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/visitor\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ organization }","url":"https://staging.commsharbor.com/api/visitor","auth_detail":"Temporary workspace of this browser (`POST /api/guest`): the HttpOnly `cm_guest` cookie, host-only, or the signed `cm_…` token in `X-Guest-Token` for an API client. It works without an account until `POST /api/auth/claim` attaches it to one; nothing signs anyone in automatically."},{"method":"POST","path":"/api/auth/claim","auth":"session","grupo":"Account","summary":"Attach this browser's temporary workspace to your global account.","desc":"Requires a recent sign-in with a second factor, as organization ownership does. The workspace stays available as a guest until the claim succeeds.","corpo":{},"retorno":{"ok":{"tipo":"bool","desc":"true when linked."}},"erros":{"401":"unauthorized — no account session; sign in at `/conta/global` first","409":"guest_claim_mfa_required / guest_already_claimed","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/auth/claim\", {method: \"POST\", credentials: \"same-origin\", headers: {\"content-type\": \"application/json\", \"x-csrf-token\": csrf}, body: \"{}\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ ok }","url":"https://staging.commsharbor.com/api/auth/claim","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/me","auth":"session","grupo":"Account","summary":"Read the global profile and the platform role, if any.","desc":"`user.id` is the shared-account ID. Organizations are not listed here: they live in the shared account, which does not list them inside products yet — open a workspace by its ID with `GET /api/organizations/{organization_id}`.","retorno":{"user":{"tipo":"User","desc":"The person behind the session."},"profile":{"tipo":"Profile","desc":"Global MM profile — it belongs to the person, edited on the account, not to a tenant."},"platform_role":{"tipo":"string","desc":"Platform role, when one was explicitly granted. Owning a tenant grants nothing here.","nulo":true}},"erros":{"401":"No session, or the session expired.","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/me\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ user{id,email}, profile{name,locale,timeZone,theme,revision}, platform_role }","url":"https://staging.commsharbor.com/api/me","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/account/organizations","auth":"session","grupo":"Organizations","summary":"List your organizations: ID, name and your role.","desc":"Served by the shared account on this domain; every organization you belong to, whether or not this product is enabled there. Creating, renaming, members, invitations and organization API keys are on the account page, `/conta/global`.","query":{"after":{"tipo":"string","desc":"`next` of the previous page."}},"retorno":{"organizations":{"tipo":"object[]","desc":"Up to 8 per page: `id`, `name`, `revision`, `role` (`owner`, `admin` or `member`) and `mfaRequired`. Product sessions also return `product: {id, enabled, revision}` for this product. Listing does not activate it."},"next":{"tipo":"string","nulo":true,"desc":"Cursor for the next page."}},"erros":{"400":"invalid_organization_cursor","401":"invalid_session","404":"organization_not_found","503":"auth_unavailable"},"exemplo":"await fetch(\"$ORIGIN/api/account/organizations\", {credentials: \"same-origin\"}).then(r => r.json());","exemploLinguagem":"js","returns":"{ organizations, next }","url":"https://staging.commsharbor.com/api/account/organizations","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/context","auth":"organization","grupo":"Organizations","summary":"Resolve which organization and role the current session or API key is acting as.","desc":"Read this before a write when you are not certain which tenant is active. Guessing is how data lands in the wrong organization. An organization API key answers `kind: api_key` with its scopes.","headers":{"X-Organization-Id":{"tipo":"string","desc":"Which organization to act in; required with a session. The shared account checks, on every request, that you belong to it and that CommsHarbor is enabled for it. An organization API key opens only its own organization: send that ID, or omit the header.","obrigatorio":true}},"retorno":"Identity","erros":{"401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","503":"The shared account is unavailable."},"exemplo":"curl -s $ORIGIN/api/context -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","returns":"{ kind, organizationId, userId, sessionId, apiKeyId, scopes, role, organization }","url":"https://staging.commsharbor.com/api/context","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id","auth":"organization","grupo":"Organizations","summary":"Open one organization: its name, your role and its CommsHarbor plan.","desc":"This is how a workspace is opened. Name and role come from the shared account (null with an organization API key, which carries neither); the plan is the organization's global entitlement in CommsHarbor.","params":{"organization_id":{"desc":"Active organization ID (the organization's id in the shared account). It must match `X-Organization-Id`."}},"headers":{"X-Organization-Id":{"tipo":"string","desc":"Which organization to act in; required with a session. The shared account checks, on every request, that you belong to it and that CommsHarbor is enabled for it. An organization API key opens only its own organization: send that ID, or omit the header.","obrigatorio":true}},"retorno":"Organization","erros":{"401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","503":"The shared account is unavailable."},"exemplo":"curl -s $ORIGIN/api/organizations/$ORG -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","returns":"{ id, name, role, email_workspace }","url":"https://staging.commsharbor.com/api/organizations/:organization_id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id/audit","auth":"organization_admin","grupo":"Credentials","summary":"List the append-only audit trail of the organization.","desc":"Audit records are never rewritten and never carry recipient PII.","params":{"organization_id":{"desc":"Active organization ID (the organization's id in the shared account). It must match `X-Organization-Id`."}},"query":{"cursor":{"tipo":"string","desc":"Opaque cursor from the previous page. Do not build or parse it."},"limit":{"tipo":"int","desc":"Page size, from 1 to 100.","padrao":50}},"retorno":"PageCamel<AuditEvent>","erros":{"401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","503":"The shared account is unavailable."},"exemplo":"curl -s '$ORIGIN/api/organizations/$ORG/audit?limit=20' -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","returns":"{ items[{id,action,actor_user_id,target,metadata,created_at}], nextCursor }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/audit","auth_detail":"Owner or admin of the organization (shared-account roles), signed in with a second factor. Never an API key."},{"method":"GET","path":"/api/platform/context","auth":"platform_admin","grupo":"Credentials","summary":"Confirm an explicitly granted platform administrator.","desc":"Tenant ownership grants nothing here: platform access is a separate, explicit grant.","retorno":{"role":{"tipo":"string","desc":"The platform role that was granted."},"user_id":{"tipo":"string","desc":"Who holds it."}},"erros":{"401":"No session.","403":"This person has no platform grant."},"exemplo":"curl -s $ORIGIN/api/platform/context -b \"__Host-mm-auth=$SESSION\"","returns":"{ role, user_id }","url":"https://staging.commsharbor.com/api/platform/context","auth_detail":"Session with an explicit platform_roles grant. Tenant ownership does not grant platform access."},{"method":"GET","path":"/api/organizations/:organization_id/email/domain-import/:service","auth":"organization","grupo":"Email setup","summary":"Read authorized Google metadata. This does not prove DNS ownership.","desc":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"service":{"desc":"search_console or analytics. Each connection has its own consent."}},"erros":{"401":"Account session required. Organization keys cannot access personal Google connections.","403":"Write requires an owner or admin, the same Origin and valid CSRF.","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Google connection required or changed.","503":"Google import unavailable. Retry or use account/manual domain registration."},"exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email/domain-import/search_console -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","retorno":{"connected":{"tipo":"bool","desc":"This identity has a saved connection for this product and service."},"domains":{"tipo":"object[]","desc":"Distinct domain names from authorized properties or selected Analytics web streams."},"groups":{"tipo":"object[]","opcional":true,"desc":"Analytics accounts and properties. No reports are read."},"resolved":{"tipo":"bool","opcional":true,"desc":"Selected Analytics properties have been resolved to domains."},"available":{"tipo":"bool","opcional":true,"desc":"Google client configuration is available. This does not assert consent or verification approval."}},"returns":"{ connected, domains, groups?, resolved?, available? }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domain-import/:service","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domain-import/:service/connect","auth":"organization","grupo":"Email setup","summary":"Start five-minute Google consent with PKCE. Return an authorization URL. Signing in does not grant this access.","desc":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"service":{"desc":"search_console or analytics. Each connection has its own consent."}},"corpo":{"language":{"tipo":"string","valores":["en","pt"],"desc":"Consent return language."}},"erros":{"401":"Account session required. Organization keys cannot access personal Google connections.","403":"Write requires an owner or admin, the same Origin and valid CSRF.","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Google connection required or changed.","503":"Google import unavailable. Retry or use account/manual domain registration."},"exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domain-import/search_console/connect -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H 'content-type: application/json' -d '{\"language\":\"en\"}'","retorno":{"redirect":{"tipo":"string","desc":"Google consent URL. The owner must approve it in a browser."}},"returns":"{ redirect }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domain-import/:service/connect","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domain-import/:service/resolve","auth":"organization","grupo":"Email setup","summary":"Resolve website addresses for up to 20 selected Analytics properties. Search Console does not use this route.","desc":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"service":{"desc":"search_console or analytics. Each connection has its own consent."}},"corpo":{"properties":{"tipo":"array","itens":{"tipo":"string"},"obrigatorio":true,"desc":"Authorized properties/ID values from the catalog, at most 20 unique entries."}},"erros":{"401":"Account session required. Organization keys cannot access personal Google connections.","403":"Write requires an owner or admin, the same Origin and valid CSRF.","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Google connection required or changed.","503":"Google import unavailable. Retry or use account/manual domain registration."},"exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domain-import/analytics/resolve -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H 'content-type: application/json' -d '{\"properties\":[\"properties/123456789\"]}'","retorno":{"connected":{"tipo":"bool","desc":"This identity has a saved connection for this product and service."},"domains":{"tipo":"object[]","desc":"Distinct domain names from authorized properties or selected Analytics web streams."},"groups":{"tipo":"object[]","opcional":true,"desc":"Analytics accounts and properties. No reports are read."},"resolved":{"tipo":"bool","opcional":true,"desc":"Selected Analytics properties have been resolved to domains."},"available":{"tipo":"bool","opcional":true,"desc":"Google client configuration is available. This does not assert consent or verification approval."}},"returns":"{ connected, domains, groups?, resolved?, available? }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domain-import/:service/resolve","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domain-import/:service/disconnect","auth":"organization","grupo":"Email setup","summary":"Remove this product's saved Google connection and pending consent. Existing email and service resources remain intact.","desc":"Requires an account session in this organization. Reads site metadata only. Google access and refresh tokens remain encrypted on the server. This does not change DNS, buy a subscription or grant another product access to Google data.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"service":{"desc":"search_console or analytics. Each connection has its own consent."}},"corpo":{},"erros":{"401":"Account session required. Organization keys cannot access personal Google connections.","403":"Write requires an owner or admin, the same Origin and valid CSRF.","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Google connection required or changed.","503":"Google import unavailable. Retry or use account/manual domain registration."},"exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domain-import/search_console/disconnect -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H 'content-type: application/json' -d '{}'","retorno":{"connected":{"tipo":"bool","desc":"This identity has a saved connection for this product and service."},"domains":{"tipo":"object[]","desc":"Distinct domain names from authorized properties or selected Analytics web streams."},"groups":{"tipo":"object[]","opcional":true,"desc":"Analytics accounts and properties. No reports are read."},"resolved":{"tipo":"bool","opcional":true,"desc":"Selected Analytics properties have been resolved to domains."},"available":{"tipo":"bool","opcional":true,"desc":"Google client configuration is available. This does not assert consent or verification approval."}},"returns":"{ connected, domains, groups?, resolved?, available? }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domain-import/:service/disconnect","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id/email/domains/:resource_id/products","auth":"organization","grupo":"Email setup","summary":"Read services associated with this exact domain.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"resource_id":{"desc":"Domain ID in the caller's email organization."}},"desc":"The private email backend confirms domain ownership in this organization. Selected native products must already be enabled. Association is idempotent. It does not create a PageAudit project, HookPulse monitor or paid subscription.","retorno":{"services":{"tipo":"string[]","desc":"Associated services with native organization access still enabled."}},"erros":{"400":"Invalid or duplicate service.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Native product access must be enabled first.","503":"Domain services unavailable."},"exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email/domains/$DOMAIN/products -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","returns":"{ services }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domains/:resource_id/products","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domains/:resource_id/products","auth":"organization","grupo":"Email setup","summary":"Associate explicitly selected services with this domain.","params":{"organization_id":{"desc":"Organization ID. Must match X-Organization-Id."},"resource_id":{"desc":"Domain ID in the caller's email organization."}},"desc":"The private email backend confirms domain ownership in this organization. Selected native products must already be enabled. Association is idempotent. It does not create a PageAudit project, HookPulse monitor or paid subscription.","retorno":{"services":{"tipo":"string[]","desc":"Associated services with native organization access still enabled."}},"erros":{"400":"Invalid or duplicate service.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Native product access must be enabled first.","503":"Domain services unavailable."},"exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domains/$DOMAIN/products -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H 'content-type: application/json' -d '{\"services\":[\"pageaudit\"]}'","corpo":{"services":{"tipo":"array","itens":{"tipo":"string"},"obrigatorio":true,"desc":"At most two unique values: pageaudit and hookpulse."}},"returns":"{ services }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domains/:resource_id/products","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/realtime/ticket","auth":"session","grupo":"Realtime","summary":"Create a short-lived browser ticket for the selected email workspace.","desc":"Use the shared browser client with the session, CSRF and X-Organization-Id headers. Guests and API keys cannot create browser tickets. Server integrations use the HTTP management API.","corpo":{},"retorno":{"ticket":{"tipo":"string","desc":"Opaque browser credential. Do not log or store it."},"expires_in":{"tipo":"int","desc":"Seconds before an unused ticket expires."},"namespace":{"tipo":"string","desc":"Product namespace on the shared transport."}},"erros":{"401":"Session ended.","403":"Organization access denied.","503":"Live channel unavailable."},"exemplo":"curl -s -XPOST $ORIGIN/api/realtime/ticket -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H 'content-type: application/json' -d '{}'","returns":"{ ticket, expires_in, namespace }","url":"https://staging.commsharbor.com/api/realtime/ticket","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/email/workspaces/:id","auth":"organization","grupo":"Realtime","summary":"Read the aggregate used by the live email workspace.","desc":"The ID must match X-Organization-Id. Membership is checked again for each snapshot and delivered event. Events contain only an opaque change ID. DNS checks run in the private backend, with a 24-hour deadline and a visible resume action after pause.","params":{"id":{"desc":"Selected organization ID."}},"retorno":{"plan":{"tipo":"string","nulo":true,"desc":"Current free, paid or operator bootstrap plan."},"subscription":{"tipo":"object","desc":"Observed service state and valid_until. Optional payment has state confirmed, plan, environment, valid_until and renewal_state from the current paid grant. A sandbox payment cannot activate a production service. Cancellation stops renewal and preserves the confirmed paid period. No payer or card data."},"capabilities":{"tipo":"object","desc":"Observed smtp_send, storage_mode and storage_mb. Trial uses shared storage and denies sending. A paid upgrade can remain awaiting_activation while native mailbox policy is updated."},"bootstrap":{"tipo":"bool","desc":"Operator-managed adoption."},"activation_required":{"tipo":"bool","opcional":true,"desc":"The confirmed payment environment cannot provision this control environment. Request operator activation. This field does not grant provisioning."},"access_state":{"tipo":"string","desc":"Active or expired paid access. Expiry preserves stored mailbox data."},"usage":{"tipo":"object","desc":"Reserved domain, mailbox, alias and storage counts."},"domains":{"tipo":"object[]","desc":"Domains with observed state, DNS provider, copyable setup instructions and verified webmail URLs. dns_progress has completed, total, percent, ready, checked_at and records. Each record has verified, status (pending: no answer of this type; mismatch: different published value; unavailable: lookup failed; verified: matched) and observed (up to 16 published values, 4096 characters each). No observation means not checked yet. dns_monitor has state and, when scheduled, next_check_at in UTC; checking is true while the job runs. A due time is not a propagation estimate. Percent counts confirmed records, not delivery readiness. DNS completion alone does not grant mailbox creation. Assistance has job_id, state and requested_at."},"mailboxes":{"tipo":"object[]","desc":"Mailbox addresses, display names and quotas. No passwords."},"aliases":{"tipo":"object[]","desc":"Alias addresses and destinations."},"jobs":{"tipo":"object[]","desc":"At most 20 recent jobs. Monitoring is an active scheduled observation, not a completed setup. Each job also has its direct status_url."}},"erros":{"401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","503":"The shared account is unavailable."},"exemplo":"curl -s $ORIGIN/api/email/workspaces/$ORG -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","returns":"{ plan, subscription, capabilities, bootstrap, activation_required?, access_state, usage, domains, mailboxes, aliases, jobs }","url":"https://staging.commsharbor.com/api/email/workspaces/:id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/email/plans","auth":"none","grupo":"Email","summary":"Read the free Trial, three paid packages, storage allowances and activation terms.","query":{"lingua":{"tipo":"string","valores":["en","pt"],"desc":"Selected language. Without it, use the shared request language policy."}},"retorno":{"currency":{"tipo":"string","desc":"Display currency: BRL only for Portuguese and country BR from the trusted origin. Otherwise USD, including unknown country."},"country":{"tipo":"string","desc":"Country supplied by the trusted origin, or empty when unknown. A query or client header cannot set it."},"brl_per_usd":{"tipo":"number","desc":"Configured reference exchange rate. This is not your card issuer's exchange rate."},"price_is_estimate":{"tipo":"bool","desc":"True for USD display prices. Card charges use billing_currency and billing_price_cents."},"billing_currency":{"tipo":"string","desc":"BRL. The current subscription provider charges Brazilian reais."},"interval":{"tipo":"string","desc":"Monthly billing."},"auto_renew":{"tipo":"bool","desc":"Monthly automatic renewal until cancellation."},"cancellation":{"tipo":"string","desc":"Cancellation stops future charges."},"paid_access":{"tipo":"string","desc":"Access lasts until the end of the paid period."},"trial_days":{"tipo":"int","desc":"Zero. There is no automatic trial conversion."},"trial":{"tipo":"object","desc":"Free receive-only trial for `days` (7) days, once per organization: storage_mb 1024 shared across unlimited mailboxes (mailboxes null), one domain, smtp_send false, no card and no automatic renewal (`expires` true). After it ends, writes without a paid plan answer 402 `email_trial_expired`. activation_ready is true only after native quota and protocol proof. Activation uses the organization trial route. A paid subscription enables sending only after backend confirmation."},"plans":{"tipo":"object[]","desc":"Three packages with price_cents in display currency, billing_price_cents in BRL, domains, mailboxes, mailbox_gb, email_storage_gb, files_gb, aliases, features and on_demand."},"checkout_live":{"tipo":"bool","desc":"Whether new real subscriptions are open."},"on_demand_activation":{"tipo":"string","desc":"Agree scope and activation date before charging for on-demand services."}},"exemplo":"curl -s $ORIGIN/api/email/plans?lingua=en","returns":"{ currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation }","url":"https://staging.commsharbor.com/api/email/plans","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/pricing","auth":"none","grupo":"Discovery","summary":"Read monthly email packages and purchase entry points.","query":{"lingua":{"tipo":"string","valores":["en","pt"],"desc":"Selected language. Without it, use the shared request language policy."}},"exemplo":"curl -s $ORIGIN/api/pricing?lingua=en","retorno":{"currency":{"tipo":"string","desc":"Display currency: BRL only for Portuguese and country BR from the trusted origin. Otherwise USD, including unknown country."},"country":{"tipo":"string","desc":"Country supplied by the trusted origin, or empty when unknown. A query or client header cannot set it."},"brl_per_usd":{"tipo":"number","desc":"Configured reference exchange rate. This is not your card issuer's exchange rate."},"price_is_estimate":{"tipo":"bool","desc":"True for USD display prices. Card charges use billing_currency and billing_price_cents."},"billing_currency":{"tipo":"string","desc":"BRL. The current subscription provider charges Brazilian reais."},"interval":{"tipo":"string","desc":"Monthly billing."},"auto_renew":{"tipo":"bool","desc":"Monthly automatic renewal until cancellation."},"cancellation":{"tipo":"string","desc":"Cancellation stops future charges."},"paid_access":{"tipo":"string","desc":"Access lasts until the end of the paid period."},"trial_days":{"tipo":"int","desc":"Zero. There is no automatic trial conversion."},"trial":{"tipo":"object","desc":"Free receive-only trial for `days` (7) days, once per organization: storage_mb 1024 shared across unlimited mailboxes (mailboxes null), one domain, smtp_send false, no card and no automatic renewal (`expires` true). After it ends, writes without a paid plan answer 402 `email_trial_expired`. activation_ready is true only after native quota and protocol proof. Activation uses the organization trial route. A paid subscription enables sending only after backend confirmation."},"plans":{"tipo":"object[]","desc":"Three packages with price_cents in display currency, billing_price_cents in BRL, domains, mailboxes, mailbox_gb, email_storage_gb, files_gb, aliases, features and on_demand."},"checkout_live":{"tipo":"bool","desc":"Whether new real subscriptions are open."},"on_demand_activation":{"tipo":"string","desc":"Agree scope and activation date before charging for on-demand services."},"quota":{"tipo":"PaymentQuota","desc":"Public allowances and list prices: the free email check, the per-call email check and the mailbox packages (signed-in account only). Not personal usage."},"product":{"tipo":"string","desc":"CommsHarbor."},"pricing":{"tipo":"string","desc":"Current package catalog URL."},"billing":{"tipo":"string","desc":"Monthly subscription offer catalog URL."},"api_index":{"tipo":"string","desc":"API catalog URL."}},"returns":"{ currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation, quota{free,paid,how_to_pay,live,free_now?,charged_now?,trial?}, product, pricing, billing, api_index }","url":"https://staging.commsharbor.com/api/pricing","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/billing","auth":"none","grupo":"Discovery","summary":"Read the same email package catalog at the billing address, with the subscription offers URL.","query":{"lingua":{"tipo":"string","valores":["en","pt"],"desc":"Selected language. Without it, use the shared request language policy."}},"exemplo":"curl -s $ORIGIN/api/billing?lingua=en","retorno":{"currency":{"tipo":"string","desc":"Display currency: BRL only for Portuguese and country BR from the trusted origin. Otherwise USD, including unknown country."},"country":{"tipo":"string","desc":"Country supplied by the trusted origin, or empty when unknown. A query or client header cannot set it."},"brl_per_usd":{"tipo":"number","desc":"Configured reference exchange rate. This is not your card issuer's exchange rate."},"price_is_estimate":{"tipo":"bool","desc":"True for USD display prices. Card charges use billing_currency and billing_price_cents."},"billing_currency":{"tipo":"string","desc":"BRL. The current subscription provider charges Brazilian reais."},"interval":{"tipo":"string","desc":"Monthly billing."},"auto_renew":{"tipo":"bool","desc":"Monthly automatic renewal until cancellation."},"cancellation":{"tipo":"string","desc":"Cancellation stops future charges."},"paid_access":{"tipo":"string","desc":"Access lasts until the end of the paid period."},"trial_days":{"tipo":"int","desc":"Zero. There is no automatic trial conversion."},"trial":{"tipo":"object","desc":"Free receive-only trial for `days` (7) days, once per organization: storage_mb 1024 shared across unlimited mailboxes (mailboxes null), one domain, smtp_send false, no card and no automatic renewal (`expires` true). After it ends, writes without a paid plan answer 402 `email_trial_expired`. activation_ready is true only after native quota and protocol proof. Activation uses the organization trial route. A paid subscription enables sending only after backend confirmation."},"plans":{"tipo":"object[]","desc":"Three packages with price_cents in display currency, billing_price_cents in BRL, domains, mailboxes, mailbox_gb, email_storage_gb, files_gb, aliases, features and on_demand."},"checkout_live":{"tipo":"bool","desc":"Whether new real subscriptions are open."},"on_demand_activation":{"tipo":"string","desc":"Agree scope and activation date before charging for on-demand services."},"quota":{"tipo":"PaymentQuota","desc":"Public allowances and list prices: the free email check, the per-call email check and the mailbox packages (signed-in account only). Not personal usage."},"product":{"tipo":"string","desc":"CommsHarbor."},"pricing":{"tipo":"string","desc":"Current package catalog URL."},"billing":{"tipo":"string","desc":"Monthly subscription offer catalog URL."},"api_index":{"tipo":"string","desc":"API catalog URL."}},"returns":"{ currency, country, brl_per_usd, price_is_estimate, billing_currency, interval, auto_renew, cancellation, paid_access, trial_days, trial, plans, checkout_live, on_demand_activation, quota{free,paid,how_to_pay,live,free_now?,charged_now?,trial?}, product, pricing, billing, api_index }","url":"https://staging.commsharbor.com/api/billing","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/organizations/:organization_id/email","summary":"Read the email workspace.","exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"retorno":{"plan":{"tipo":"string","nulo":true,"desc":"Current free, paid or operator bootstrap plan."},"subscription":{"tipo":"object","desc":"Observed service state and valid_until. Optional payment has state confirmed, plan, environment, valid_until and renewal_state from the current paid grant. A sandbox payment cannot activate a production service. Cancellation stops renewal and preserves the confirmed paid period. No payer or card data."},"capabilities":{"tipo":"object","desc":"Observed smtp_send, storage_mode and storage_mb. Trial uses shared storage and denies sending. A paid upgrade can remain awaiting_activation while native mailbox policy is updated."},"bootstrap":{"tipo":"bool","desc":"Operator-managed adoption."},"activation_required":{"tipo":"bool","opcional":true,"desc":"The confirmed payment environment cannot provision this control environment. Request operator activation. This field does not grant provisioning."},"access_state":{"tipo":"string","desc":"Active or expired paid access. Expiry preserves stored mailbox data."},"usage":{"tipo":"object","desc":"Reserved domain, mailbox, alias and storage counts."},"domains":{"tipo":"object[]","desc":"Domains with observed state, DNS provider, copyable setup instructions and verified webmail URLs. dns_progress has completed, total, percent, ready, checked_at and records. Each record has verified, status (pending: no answer of this type; mismatch: different published value; unavailable: lookup failed; verified: matched) and observed (up to 16 published values, 4096 characters each). No observation means not checked yet. dns_monitor has state and, when scheduled, next_check_at in UTC; checking is true while the job runs. A due time is not a propagation estimate. Percent counts confirmed records, not delivery readiness. DNS completion alone does not grant mailbox creation. Assistance has job_id, state and requested_at."},"mailboxes":{"tipo":"object[]","desc":"Mailbox addresses, display names and quotas. No passwords."},"aliases":{"tipo":"object[]","desc":"Alias addresses and destinations."},"jobs":{"tipo":"object[]","desc":"At most 20 recent jobs. Monitoring is an active scheduled observation, not a completed setup. Each job also has its direct status_url."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"agent_value":{"principal":true,"idioma":"en","en":{"when":"How can I use email on my domain without running a mail server?","result":"The authorized email workspace: domains, mailboxes, aliases, quota, observed capabilities and setup jobs.","replaces":"We operate the mail server and webmail. Your agent manages the authorized domains and mailboxes through the existing service.","free":"Read /api/email/plans. If trial.activation_ready is true, activate the 7-day trial, verify your domain and create mailboxes. They share 1 GB and can receive through webmail or IMAP. No card or automatic conversion.","paid":"A monthly package buys sending and the listed mailbox and storage capacity. Sending stays disabled during the trial, including SMTP and external filter forwarding. The human account accepts renewal and cancellation; an organization key manages service but cannot buy it.","limits":"Check checkout_live, domain readiness and observed sending capability. A payment or accepted job alone does not prove activation or delivery. Enterprise services can require activation on demand.","alternative":"The organization already has suitable managed email or requires an activation that is not available.","start":{"href":"/","label":"Set up domain email"}},"pt":{"when":"Como usar e-mail no meu domínio sem operar um servidor?","result":"Área autorizada de e-mail: domínios, caixas, aliases, cota, capacidades observadas e trabalhos de configuração.","replaces":"Operamos o servidor e o webmail. Seu agente gerencia os domínios e as caixas autorizados pelo serviço existente.","free":"Leia /api/email/plans. Se trial.activation_ready for true, ative os 7 dias de teste, verifique seu domínio e crie caixas. Elas compartilham 1 GB e recebem pelo webmail ou IMAP. Sem cartão nem conversão automática.","paid":"O pacote mensal compra envio e a capacidade de caixas e armazenamento indicada. Durante o teste, SMTP e encaminhamento externo por filtro ficam desativados. A pessoa aceita renovação e cancelamento; chave da organização gerencia o serviço, mas não compra.","limits":"Confira checkout_live, domínio pronto e envio observado. Pagamento ou trabalho aceito não prova ativação nem entrega. Serviços Empresariais podem depender de ativação sob demanda.","alternative":"A organização já tem e-mail gerenciado adequado ou precisa de ativação indisponível.","start":{"href":"/","label":"Configurar e-mail do domínio"}}},"returns":"{ plan, subscription, capabilities, bootstrap, activation_required?, access_state, usage, domains, mailboxes, aliases, jobs }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/trial","summary":"Start the free receive-only Trial for 7 days, once per organization: 1 GB shared storage, unlimited mailboxes and no outgoing SMTP or external filter forwarding. No card, renewal or charge. After 7 days, writes without a paid plan answer 402 `email_trial_expired`. Requires a new workspace and operator-proved native quota.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/trial -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/trial","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id/email/domain-setup","summary":"Find an existing domain. Use it before a purchase. Return its organization and domain IDs only when this exact caller can open that organization. Otherwise return existing: null. This read creates no charge or job.","exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email/domain-setup?domain=example.com -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"query":{"domain":{"tipo":"string","desc":"Domain to check, at most 253 characters.","obrigatorio":true}},"retorno":{"existing":{"tipo":"object","nulo":true,"desc":"Authorized existing domain: organization_id, domain_id and organization name. Null also covers a foreign or unavailable organization; no foreign ownership information is returned."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ existing }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domain-setup","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domains","summary":"Register a domain and its ownership challenge.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domains -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"domain\":\"example.com\"}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"corpo":{"domain":{"tipo":"string","desc":"Exact domain name.","obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domains","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id/email/domains/:resource_id","summary":"Read domain setup, DNS records and observed readiness.","exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email/domains/$DOMAIN -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"retorno":{"domain":{"tipo":"object","desc":"Domain setup and observed readiness."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ domain }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domains/:resource_id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domains/:resource_id/verify","summary":"Queue a check of ownership, DNS and certificates.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domains/$DOMAIN/verify -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domains/:resource_id/verify","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/domains/:resource_id/assistance","summary":"Request assisted DNS setup. The durable request waits for operator activation. It does not change DNS or expose a provider credential.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/domains/$DOMAIN/assistance -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/domains/:resource_id/assistance","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/mailboxes","summary":"Create a mailbox within the current allowance. Trial mailboxes share 1 GB and cannot send email.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/mailboxes -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"domain_id\":\"$DOMAIN\",\"local_part\":\"ana\",\"name\":\"Ana Souza\"}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"corpo":{"domain_id":{"tipo":"string","desc":"Domain ID from the workspace.","obrigatorio":true},"local_part":{"tipo":"string","desc":"Mailbox name before @.","obrigatorio":true},"name":{"tipo":"string","desc":"Mailbox display name.","obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/mailboxes","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"PATCH","path":"/api/organizations/:organization_id/email/mailboxes/:resource_id","summary":"Change mailbox name or quota within the plan.","exemplo":"curl -s -XPATCH $ORIGIN/api/organizations/$ORG/email/mailboxes/$MAILBOX -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"name\":\"Ana Souza\",\"quota_mb\":2048}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{"name":{"tipo":"string","desc":"Display name."},"quota_mb":{"tipo":"int","desc":"Quota in MiB. Must fit the plan and current usage."},"files_quota_mb":{"tipo":"int","desc":"File allowance in MiB. The sum of mailbox allowances must fit files_gb in the plan. Zero disables files. Existing files are preserved."}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/mailboxes/:resource_id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/mailboxes/:resource_id/password","summary":"Set the mailbox password. It is encrypted for the executor and is never returned.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/mailboxes/$MAILBOX/password -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"password\":\"$MAILBOX_PASSWORD\"}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{"password":{"tipo":"string","desc":"New mailbox password: 14 to 128 characters, with no control characters.","obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/mailboxes/:resource_id/password","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/mailboxes/:resource_id/suspend","summary":"Suspend access while preserving mailbox data.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/mailboxes/$MAILBOX/suspend -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/mailboxes/:resource_id/suspend","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/mailboxes/:resource_id/resume","summary":"Restore suspended mailbox access.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/mailboxes/$MAILBOX/resume -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/mailboxes/:resource_id/resume","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/aliases","summary":"Create an alias to existing mailboxes in this organization.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/aliases -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"domain_id\":\"$DOMAIN\",\"local_part\":\"sales\",\"destinations\":[\"ana@example.com\"]}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"corpo":{"domain_id":{"tipo":"string","desc":"Domain ID from the workspace, where the alias is created.","obrigatorio":true},"local_part":{"tipo":"string","desc":"Alias name before @.","obrigatorio":true},"destinations":{"tipo":"array","desc":"Existing mailbox addresses in this organization.","itens":{"tipo":"string"},"obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/aliases","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"PATCH","path":"/api/organizations/:organization_id/email/aliases/:resource_id","summary":"Change the alias destinations within this organization.","exemplo":"curl -s -XPATCH $ORIGIN/api/organizations/$ORG/email/aliases/$ALIAS -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"destinations\":[\"ana@example.com\",\"bruno@example.com\"]}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{"destinations":{"tipo":"array","desc":"Existing mailbox addresses.","itens":{"tipo":"string"},"obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/aliases/:resource_id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/aliases/:resource_id/suspend","summary":"Suspend an alias without deleting its configuration.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/aliases/$ALIAS/suspend -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/aliases/:resource_id/suspend","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/aliases/:resource_id/resume","summary":"Restore a suspended alias without changing its destinations.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/aliases/$ALIAS/resume -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"corpo":{},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/aliases/:resource_id/resume","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/organizations/:organization_id/email/jobs/:resource_id","summary":"Read one durable job in this organization.","exemplo":"curl -s $ORIGIN/api/organizations/$ORG/email/jobs/$JOB -b \"__Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\"","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."},"resource_id":{"desc":"Opaque resource ID returned by this email API."}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/jobs/:resource_id","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"POST","path":"/api/organizations/:organization_id/email/services","summary":"Request an included service with activation on demand.","exemplo":"curl -s -XPOST $ORIGIN/api/organizations/$ORG/email/services -b \"__Host-mm-auth-browser=$BROWSER; __Host-mm-auth=$SESSION\" -H \"X-Organization-Id: $ORG\" -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"Idempotency-Key: $KEY\" -H 'content-type: application/json' -d '{\"service\":\"migration\"}'","auth":"organization","grupo":"Email","desc":"No guest access. Members can read. Owners, admins and organization keys can manage email. The private service credential stays on the server. Mailbox passwords and message content are never returned.","params":{"organization_id":{"desc":"Organization ID from the shared account. It must match X-Organization-Id."}},"corpo":{"service":{"tipo":"string","desc":"Service code from the plan catalog.","valores":["migration","chat","meetings","documents","shared_mailboxes","bookings","scheduled_send","signatures"],"obrigatorio":true}},"headers":{"Idempotency-Key":{"tipo":"string","desc":"Stable key of 8 to 128 characters. Reuse it only with the same operation and body.","obrigatorio":true}},"retorno":{"job":{"tipo":"object","desc":"Durable job ID, status and status_url. A 202 response is acceptance, not completion."}},"erros":{"400":"Invalid fields or missing idempotency key.","401":"No signed-in session, or the API key is invalid or revoked (`invalid_api_key`); an old `ch_…` key answers `api_key_retired`.","403":"The session or key lacks the permission this operation needs (an API key never reaches billing, erasure, exports or the audit trail), an account key was used where an organization key is needed (`organization_key_required`), or an owner/admin has no second factor (`organization_mfa_required`).","404":"The organization is not available to this session or key (no membership, CommsHarbor is not enabled for it, or the key belongs to another organization), or the resource does not exist in it. Another tenant's ID answers the same 404 — the API never confirms that it exists elsewhere.","409":"Conflicting replay, pending setup or plan not active.","429":"Daily provisioning capacity reached. Retry later with the same idempotency key.","503":"Private email backend unavailable or Trial activation has not passed native proof."},"returns":"{ job }","url":"https://staging.commsharbor.com/api/organizations/:organization_id/email/services","auth_detail":"Shared account session plus `X-Organization-Id`: the shared account checks, on every request, the membership, the role and that CommsHarbor is enabled for the organization; owners and admins need a second factor. Agents can use an organization API key instead: an owner or admin creates it on the account page (`/conta/global`) and it goes as `Authorization: Bearer mmk_…` or `X-Api-Key`. It opens only its own organization, works while its creator is still an owner or admin there, and manages domains, mailboxes and aliases — never billing, erasure, exports or the audit trail."},{"method":"GET","path":"/api/email-check","auth":"none","grupo":"Email security check","summary":"Check SPF, DKIM, DMARC, MX, MTA-STS and BIMI of a domain, with a 0-100 score and what to fix.","desc":"Public DNS only, no account and no charge. The same domain is served from memory for 10 minutes. A network can run 30 new checks per day. DKIM is looked up in common selectors only; `dkim_not_found` does not prove that no key exists. `incomplete: true` means a DNS answer failed and the score can be lower than the real one; `unread` names those parts, and a failed query never becomes a missing finding.","query":{"domain":{"tipo":"string","obrigatorio":true,"desc":"Public domain to check, such as example.com. A subdomain or URL is reduced to its registrable domain."}},"retorno":{"domain":{"tipo":"string","desc":"Registrable domain that was checked."},"score":{"tipo":"int","desc":"0 to 100: DMARC up to 40, SPF 20, DKIM 20, MX 10, MTA-STS 5 and BIMI 5."},"rating":{"tipo":"string","desc":"protected (90+), good (70+), at_risk (40+) or exposed."},"findings":{"tipo":"object[]","desc":"`{code, severity}`, most severe first. Codes: dmarc_missing, dmarc_none, spf_plus_all, spf_missing, spf_multiple, dmarc_quarantine, dkim_not_found, spf_neutral, spf_softfail, dmarc_no_reports, mx_missing, mta_sts_missing, bimi_missing."},"spf":{"tipo":"object","desc":"`{record, ending, multiple}`: the first SPF record, its `all` ending and whether there are two."},"dmarc":{"tipo":"object","desc":"`{record, policy, reports}`: policy reject, quarantine, none or null; reports when `rua` is set."},"dkim":{"tipo":"object","desc":"`{found, checked}`: selectors with a published key and the selectors looked up."},"mx":{"tipo":"string[]","desc":"MX records as `priority host`."},"mta_sts":{"tipo":"bool","desc":"An MTA-STS policy record exists."},"bimi":{"tipo":"bool","desc":"A BIMI record exists at the default selector."},"unread":{"tipo":"string[]","desc":"Parts whose DNS query failed (spf, dmarc, dkim, mx, mta_sts, bimi). They have no findings and no points."},"incomplete":{"tipo":"bool","desc":"At least one DNS query failed."},"checked_at":{"tipo":"string","desc":"ISO time of the DNS reading."},"share_url":{"tipo":"string","desc":"Public page with this result."},"badge_url":{"tipo":"string","desc":"SVG badge with the score."}},"erros":{"400":"domain_invalid: not a public domain.","429":"rate_limited: 30 new checks per account, or per network without an account, per day.","503":"dns_unavailable: the DNS lookup failed; limit_unavailable: the daily limit could not be checked. Retry in a minute."},"exemplo":"curl -s \"$ORIGIN/api/email-check?domain=example.com\"","returns":"{ domain, score, rating, findings, spf, dmarc, dkim, mx, mta_sts, bimi, unread, incomplete, checked_at, share_url, badge_url }","url":"https://staging.commsharbor.com/api/email-check","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/email-check/badge","auth":"none","grupo":"Email security check","summary":"SVG badge with the email security score of a domain, for a website or README.","desc":"Public DNS only, no account and no charge. The same domain is served from memory for 10 minutes. A network can run 30 new checks per day. The badge does not use the network's daily checks. An invalid domain or a failed lookup shows \"unknown\".","query":{"domain":{"tipo":"string","obrigatorio":true,"desc":"Public domain to check, such as example.com. A subdomain or URL is reduced to its registrable domain."}},"retorno":{"_texto":"`image/svg+xml` — a 20px-high badge with the score in the colour of its rating."},"erros":{},"exemplo":"curl -s \"$ORIGIN/api/email-check/badge?domain=example.com\"","returns":"`image/svg+xml` — a 20px-high badge with the score in the colour of its rating.","url":"https://staging.commsharbor.com/api/email-check/badge","auth_detail":"Public endpoint. No tenant data is returned."},{"auth":"credito","method":"GET","path":"/api/x402/email-check","summary":"Checks the email security of a domain for an agent, paid per call: SPF, DKIM, DMARC, MX and a score, with no account.","grupo":"Email security check","desc":"The check of `GET /api/email-check`, sold per call to agents, with no account and without the 30 free checks per day before. A request without payment gets the 402 with the price; a paid one gets the audit in the same response, with the payment in `cobranca`. DKIM is looked up in common selectors only; `incomplete: true` means a DNS answer failed. A refused domain, the hourly limit of the service and a failed DNS lookup are not charged.","query":{"domain":{"tipo":"string","obrigatorio":true,"desc":"Public domain to check, such as example.com. A subdomain or URL is reduced to its registrable domain.","exemplo":"example.com"}},"retorno":"VerificacaoAvulsa","exemploRetorno":{"domain":"example.com","mx":["0 ."],"spf":{"record":"v=spf1 -all","ending":"-all","multiple":false},"dmarc":{"record":"v=DMARC1; adkim=s; aspf=s; p=reject; sp=reject","policy":"reject","reports":false},"dkim":{"found":[],"checked":["google","selector1","selector2","default","k1","k2","mail","dkim","s1","s2","smtp","mx"]},"mta_sts":false,"bimi":false,"unread":[],"score":65,"rating":"at_risk","findings":[{"code":"dkim_not_found","severity":"medium"},{"code":"dmarc_no_reports","severity":"low"},{"code":"mta_sts_missing","severity":"low"},{"code":"bimi_missing","severity":"low"}],"incomplete":false,"checked_at":"2026-10-24T11:52:00.161Z","share_url":"https://commsharbor.com/email-security-check?domain=example.com","badge_url":"https://commsharbor.com/api/email-check/badge?domain=example.com"},"erros":{"400":"Paid without `domain` (`missing_input`) or with a domain that is not public (`domain_invalid`), both with `example`. Not charged.","401":"API key refused (`invalid_api_key`), OAuth token refused (`invalid_token`), credit refused (`credito_invalido`), test credit outside dev (`credito_simulado`), or recovery without wallet authentication (`wallet_proof_required`). The first x402 purchase needs no account.","402":"No payment: `accepts` (x402, USDC on Base) with the price of this call, at least US$ 0.01; `credito.preco_desta_chamada`, the lower price with prepaid credit; and `pacotes` (the credit top-ups and how many calls each one pays). Credit without balance answers `saldo_insuficiente`.","409":"Payment is in progress, the request differs from the original, or the amount was recovered as balance. Do not sign another authorization to retry the purchase.","410":"The 24-hour response recovery period ended. The financial record remains; the same proof cannot cause another charge.","429":"rate_limited: the hourly limit of the service. Retry after the stated delay. Not charged.","503":"dns_unavailable: the DNS lookup failed. Retry in a minute. Not charged."},"exemplo":"curl -s -i '$ORIGIN/api/x402/email-check?domain=example.com'","headers":{"authorization":{"tipo":"string","obrigatorio":false,"desc":"`Bearer mmk_…` (API key) or `Bearer mmo_…` (OAuth): the paid call uses the account balance without another header. Without an account, use prepaid credit from `POST /api/credito` as `Bearer cred_…`."},"x-api-key":{"tipo":"string","obrigatorio":false,"desc":"The mmk_… API key for this product. It identifies the account and authorizes its balance for the paid call."},"payment-signature":{"tipo":"string","obrigatorio":false,"desc":"The signed x402 payment proof (base64): `PAYMENT-SIGNATURE` (v2) or `X-PAYMENT` (v1)."},"x-wallet-token":{"tipo":"string","obrigatorio":false,"desc":"To recover an x402 response within 24 hours, repeat the same request and payment proof. Send the payer wallet's `mmw_…` credential here, issued through `/api/auth/wallet/agent/start` and `/api/auth/wallet/agent/token`. There is no new charge."}},"agent_value":{"idioma":"en","en":{"when":"Does this domain publish SPF, DKIM and DMARC?","result":"SPF, DKIM, DMARC and MX findings, a score and source-query limitations.","replaces":"DNS lookups, record parsing and assembling the domain's email-policy findings.","free":"GET /api/email-check offers the same check within its free allowance. Use it first when it covers your task.","paid":"The x402 route buys a check from the first call, without an account or the free allowance first. Monthly domain-email packages buy mailboxes and storage, not this check; management requires organization authority.","limits":"DKIM checks common selectors only. Inspect incomplete and unread. A score does not prove inbox placement, stop every phishing attack or verify the contents of a mailbox.","alternative":"The free check suffices or you already have equivalent DNS analysis. For hosted email, evaluate activation readiness and the actual mailbox package separately."},"pt":{"when":"Este domínio publica SPF, DKIM e DMARC?","result":"Achados de SPF, DKIM, DMARC e MX, nota e limites das consultas às fontes.","replaces":"Consultas DNS, interpretação dos registros e montagem dos achados de política de e-mail.","free":"GET /api/email-check oferece a mesma análise na franquia gratuita. Use essa opção primeiro quando atender à tarefa.","paid":"A rota x402 compra uma análise desde a primeira chamada, sem conta nem consumo prévio da franquia. Pacotes mensais de e-mail compram caixas e armazenamento, não esta análise; a gestão exige autorização da organização.","limits":"O DKIM usa seletores comuns. Confira incomplete e unread. A nota não prova chegada à caixa de entrada, bloqueio de todo phishing nem o conteúdo de uma caixa.","alternative":"A análise gratuita basta ou você já tem análise DNS equivalente. Para hospedar e-mail, avalie separadamente o preparo da ativação e o pacote de caixas."}},"returns":"{ domain, score, rating, findings, spf, dmarc, dkim, mx, mta_sts, bimi, unread, incomplete, checked_at, share_url, badge_url, cobranca{via,preco_usd,repetido,saldo_usd?} }","url":"https://staging.commsharbor.com/api/x402/email-check","auth_detail":"Credit token in `Authorization: Bearer cred_…` or `X-Credito`. For recovered x402 funds, use the wallet credential mmw_… in Bearer or X-Wallet-Token, issued through /api/auth/wallet/agent/start and /api/auth/wallet/agent/token."},{"method":"GET","path":"/api/email-raio-x","auth":"none","grupo":"Email security check","summary":"The monthly Brazil email security report: DMARC and SPF totals of city halls, governments, banks and listed companies.","desc":"Public DNS only, read once a month. The sample is built from Brazil's open company registry (Receita Federal, the email of each active head office) and the CVM register of listed companies. Only totals: no domain is listed. A share is `count / (com_mx - dmarc.nao_lido)`; domains without MX are left out. Only the DMARC policy classifies; SPF is counted but does not change the class. `percent` rounds each group to 100 by the largest remainder, the same rule as the page.","retorno":{"mes":{"tipo":"string","desc":"Month of the reading, `YYYY-MM` (UTC)."},"medido_em":{"tipo":"string","desc":"ISO time when the reading finished."},"amostra":{"tipo":"string","desc":"Date of the domain list, `YYYY-MM-DD`."},"grupos":{"tipo":"object","desc":"Totals by group: `prefeituras` (city halls), `governos_estaduais`, `governo_federal`, `bancos`, `companhias_abertas` (listed companies) and `varejo` (listed retailers), each with the fields of `total`. A domain can be in two groups, so the groups add up to more than `total`."},"total":{"tipo":"object","desc":"`{dominios, com_mx, sem_mx, mx_nao_lido, dmarc, spf, percent}`: domains in the sample and how many receive email (with MX). Among those, `dmarc` counts `reject`, `quarantine`, `none`, `ausente` (no record) and `nao_lido` (the DNS answer failed); `spf` counts the ending: `hardfail` (-all), `softfail` (~all), `fraco` (?all, +all or no ending), `ausente`, `multiplo` and `nao_lido`. `percent` has the whole-number shares of `ausente`, `none`, `quarantine` and `reject`, which add up to 100, and `nao_rejeitam` (100 minus `reject`): the numbers on the page. `null` when no DMARC answer was read."},"method":{"tipo":"string","desc":"How the reading was made."},"page":{"tipo":"string","desc":"Public page with the report, in English."},"page_pt":{"tipo":"string","desc":"Public page with the report, in Portuguese."}},"erros":{"503":"report_not_ready: the first monthly reading is still running; retry in an hour."},"exemplo":"curl -s \"$ORIGIN/api/email-raio-x\"","returns":"{ mes, medido_em, amostra, grupos, total, method, page, page_pt }","url":"https://staging.commsharbor.com/api/email-raio-x","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/assinaturas","auth":"session","grupo":"Subscriptions","summary":"List at most 20 subscriptions owned by this account in this product.","desc":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Filters account, product, merchant and environment. Does not query Asaas or count the table. The accepted offer remains readable after sales close. Sandbox reads require a valid ticket. The complete query is limited to 640 characters, including the cursor.","query":{"dev":{"tipo":"string","desc":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},"x402_dev":{"tipo":"string","desc":"Alias for dev. Send only one of these parameters."},"cursor":{"tipo":"string","desc":"proximo from the previous page: UTC ISO time with milliseconds, ~ and a 32-character hexadecimal ID."},"recurso":{"tipo":"string","desc":"Product resource: at most 256 characters without controls. Filters this account's subscriptions."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."}},"colecao":{"porPagina":20,"teto":20,"anda":"Use proximo as the cursor. Descending criado_em and id order. Null ends the list."},"retorno":{"itens":{"tipo":"RegistroDeAssinatura[]","desc":"At most 20 records owned by this account."},"proximo":{"tipo":"string","nulo":true,"desc":"Next-page cursor, or null."},"simulado":{"tipo":"bool","desc":"Server-authorized environment for this request."},"recursos":{"tipo":"object","desc":"Optional for organization subscriptions: maps resource IDs on this page and its filter to names verified in this account's organizations; null when the name is not authorized. Never uses a name from the URL."}},"erros":{"400":"Invalid body, query, offer, acceptance, card or environment; card declined.","401":"Missing or invalid session. An API key cannot authorize these requests.","403":"Invalid origin or cookie; invalid CSRF protection on a write.","404":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment.","431":"Cookie header exceeds 8 KiB.","503":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."},"exemplo":"curl -s $ORIGIN/api/credito/assinaturas -b sessao.cookies","returns":"{ itens[{recurso,id,oferta_id,oferta,estado,simulado,pagamento_em,criado_em,atualizado_em,cancelamento_em,cancelado_em,pago_ate}], proximo, simulado, recursos }","url":"https://staging.commsharbor.com/api/credito/assinaturas","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/credito/assinaturas/ofertas","auth":"none","grupo":"Subscriptions","summary":"Read the subscription offers and request environment when enabled.","desc":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Creates no charge, reservation or benefit. Does not convert a trial into a purchase.","query":{"dev":{"tipo":"string","desc":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},"x402_dev":{"tipo":"string","desc":"Alias for dev. Send only one of these parameters."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."}},"retorno":{"ofertas":{"tipo":"OfertaDeAssinatura[]","desc":"1 to 8 versioned offers for this product."},"simulado":{"tipo":"bool","desc":"Server-authorized environment for this request."}},"erros":{"400":"Invalid body, query, offer, acceptance, card or environment; card declined.","404":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment.","503":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."},"exemplo":"curl -s $ORIGIN/api/credito/assinaturas/ofertas","returns":"{ ofertas[{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}], simulado }","url":"https://staging.commsharbor.com/api/credito/assinaturas/ofertas","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/credito/assinaturas","auth":"session","grupo":"Subscriptions","summary":"Subscribe and pay for the selected offer by card through the API.","desc":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Requires a human session authenticated within the last 2 hours. Rejects Authorization and X-Api-Key. Send only the declared fields, with HTTPS and a JSON body of at most 4 KiB. recurso is accepted only when the product verifies it. simulado must match the catalog and authorized environment. An expired test ticket cannot change the request to production. Price and benefits come from the server. Card data goes to Asaas for this request only; it is not stored or returned. The server supplies the buyer IP. Allow up to 120 seconds. A repeated offer returns the existing reservation. An uncertain outcome requires a reference lookup before another creation. Creation grants no benefit. Only an Asaas-confirmed payment grants the paid period.","query":{"dev":{"tipo":"string","desc":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},"x402_dev":{"tipo":"string","desc":"Alias for dev. Send only one of these parameters."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."},"Origin":{"tipo":"string","obrigatorio":true,"desc":"Exact HTTPS origin of this product."},"X-CSRF-Token":{"tipo":"string","obrigatorio":true,"desc":"64-character token from this product's session bootstrap. Required for writes."}},"corpo":{"recurso":{"tipo":"string","desc":"Required when the product sells per resource. The server verifies the resource and account."},"simulado":{"tipo":"bool","obrigatorio":true,"desc":"Value from the catalog. States intent; grants no payment-test authority."},"aceite":{"tipo":"AceiteDeAssinatura","obrigatorio":true,"desc":"Only oferta_id, versao, hash and renovacao. Match the current catalog."},"cartao":{"tipo":"CartaoDeAssinatura","obrigatorio":true,"desc":"Cardholder's card and billing data. Do not send price, IP, environment or another account's identifier."}},"retorno":"RegistroDeAssinatura","erros":{"400":"Invalid body, query, offer, acceptance, card or environment; card declined.","401":"Missing or invalid session. An API key cannot authorize these requests.","403":"Invalid origin or cookie; invalid CSRF protection on a write.","404":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment.","409":"Incompatible state or another offer already reserved for this account and product.","413":"JSON body exceeds 4 KiB.","415":"Body is not application/json or has content encoding.","429":"This account reached its daily charge-creation limit.","431":"Cookie header exceeds 8 KiB.","503":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."},"exemplo":"curl -s -X POST $ORIGIN/api/credito/assinaturas -b sessao.cookies -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"content-type: application/json\" --data-binary @contratacao.json","returns":"{ recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em, pago_ate }","url":"https://staging.commsharbor.com/api/credito/assinaturas","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/credito/assinaturas/:id","auth":"session","grupo":"Subscriptions","summary":"Read an owned subscription and its accepted offer without creating a payment.","desc":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Requires this product's valid human session. Does not query the provider. Sandbox reads also require a valid ticket.","query":{"dev":{"tipo":"string","desc":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},"x402_dev":{"tipo":"string","desc":"Alias for dev. Send only one of these parameters."},"recurso":{"tipo":"string","desc":"Product resource: at most 256 characters without controls. Filters this account's subscriptions."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."}},"params":{"id":{"tipo":"string","desc":"Local subscription ID: 32 lowercase hexadecimal characters.","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":"RegistroDeAssinatura","erros":{"400":"Invalid body, query, offer, acceptance, card or environment; card declined.","401":"Missing or invalid session. An API key cannot authorize these requests.","403":"Invalid origin or cookie; invalid CSRF protection on a write.","404":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment.","431":"Cookie header exceeds 8 KiB.","503":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."},"exemplo":"curl -s $ORIGIN/api/credito/assinaturas/0123456789abcdef0123456789abcdef -b sessao.cookies","returns":"{ recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em, pago_ate }","url":"https://staging.commsharbor.com/api/credito/assinaturas/:id","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"POST","path":"/api/credito/assinaturas/:id","auth":"session","grupo":"Subscriptions","summary":"Stop future charges for an owned subscription and keep the paid period.","desc":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Send only {} as JSON, with a valid session, origin and CSRF token. The server records cancellation intent before it calls Asaas. Pending is not confirmed cancellation. The request is repeatable. Refunds have a separate process; cancellation does not refund a payment.","query":{"dev":{"tipo":"string","desc":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},"x402_dev":{"tipo":"string","desc":"Alias for dev. Send only one of these parameters."},"recurso":{"tipo":"string","desc":"Product resource: at most 256 characters without controls. Filters this account's subscriptions."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."},"Origin":{"tipo":"string","obrigatorio":true,"desc":"Exact HTTPS origin of this product."},"X-CSRF-Token":{"tipo":"string","obrigatorio":true,"desc":"64-character token from this product's session bootstrap. Required for writes."}},"params":{"id":{"tipo":"string","desc":"Local subscription ID: 32 lowercase hexadecimal characters.","exemplo":"0123456789abcdef0123456789abcdef"}},"body":{},"retorno":"RegistroDeAssinatura","erros":{"400":"Invalid body, query, offer, acceptance, card or environment; card declined.","401":"Missing or invalid session. An API key cannot authorize these requests.","403":"Invalid origin or cookie; invalid CSRF protection on a write.","404":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment.","409":"Incompatible state or another offer already reserved for this account and product.","413":"JSON body exceeds 4 KiB.","415":"Body is not application/json or has content encoding.","431":"Cookie header exceeds 8 KiB.","503":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."},"exemplo":"curl -s -X POST $ORIGIN/api/credito/assinaturas/0123456789abcdef0123456789abcdef -b sessao.cookies -H \"Origin: $ORIGIN\" -H \"X-CSRF-Token: $CSRF\" -H \"content-type: application/json\" -d '{}'","returns":"{ recurso, id, oferta_id, oferta{id,produto,versao,preco_centavos,moeda,ciclo,renovacao_automatica,compromisso_meses,compromisso_semanas,cancelamento,acesso_pago,teste_dias,primeira_cobranca?,desconto_primeira_cobranca_centavos?,conversao_teste,beneficios,hash}, estado, simulado, pagamento_em, criado_em, atualizado_em, cancelamento_em, cancelado_em, pago_ate }","url":"https://staging.commsharbor.com/api/credito/assinaturas/:id","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/credito/assinaturas/:id/estado","auth":"session","stream":true,"grupo":"Subscriptions","summary":"Observe changes to an owned subscription through the realtime channel.","desc":"Requires enabled subscription sales or a server-authorized payment test. Otherwise returns 404. Requires this product's human session. Returns only ID and cursor, including after reconnection. A signal grants no paid access and exposes no financial data. Read the authenticated subscription after a change. That read still verifies environment, merchant and resource.","query":{"dev":{"tipo":"string","desc":"Valid signed payment-test ticket. At most 512 characters. It never authorizes another account."},"x402_dev":{"tipo":"string","desc":"Alias for dev. Send only one of these parameters."}},"headers":{"X-X402-Dev":{"tipo":"string","desc":"Valid signed payment-test ticket. The request body's sandbox flag does not authorize a test."}},"params":{"id":{"tipo":"string","desc":"Local subscription ID: 32 lowercase hexadecimal characters.","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":{"id":{"tipo":"string","desc":"Local subscription ID: 32 lowercase hexadecimal characters.","exemplo":"0123456789abcdef0123456789abcdef"},"cursor":{"tipo":"string","desc":"State version. Compare for equality. It does not confirm a payment."}},"erros":{"400":"Invalid body, query, offer, acceptance, card or environment; card declined.","401":"Missing or invalid session. An API key cannot authorize these requests.","403":"Invalid origin or cookie; invalid CSRF protection on a write.","404":"Sales and payment tests are unavailable, or the subscription is outside this account, product, merchant or environment.","431":"Cookie header exceeds 8 KiB.","503":"Account, database, configuration or provider unavailable; four concurrent operations already in progress."},"exemplo":"curl -s $ORIGIN/api/credito/assinaturas/0123456789abcdef0123456789abcdef/estado -b sessao.cookies","returns":"{ id, cursor }","url":"https://staging.commsharbor.com/api/credito/assinaturas/:id/estado","auth_detail":"Shared account session: HttpOnly cookie `__Host-mm-auth` (sign in at `/conta/global`); writes need the same Origin, the `__Host-mm-auth-browser` cookie and `X-CSRF-Token` from `/api/auth/bootstrap`. No organization is implied."},{"method":"GET","path":"/api/credito/x402/saude","auth":"none","exemplo":"curl -s $ORIGIN/api/credito/x402/saude","grupo":"Credit","summary":"x402 verifier health: pending payments, missing hashes, failed or stalled reconciliation.","retorno":{"verificado_em":{"tipo":"string","desc":"Reading time in UTC."},"ativo":{"tipo":"boolean","desc":"Verifier configured in this process."},"tarefas":{"tipo":"object[]","desc":"Failures with id and reason, without payer data. Bounded counts show +."}},"erros":{"503":"Verifier unavailable in this process."},"returns":"{ verificado_em, ativo, tarefas }","url":"https://staging.commsharbor.com/api/credito/x402/saude","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/barrados/saude","auth":"none","exemplo":"curl -s $ORIGIN/api/credito/barrados/saude","grupo":"Credit","summary":"People who paid and were blocked on this site in the last 24 hours: the site asked for payment from someone with balance or a plan, or charged and did not deliver.","retorno":{"verificado_em":{"tipo":"string","desc":"Reading time in UTC."},"ativo":{"tipo":"boolean","desc":"The reading worked."},"total":{"tipo":"int","desc":"Number of different cases."},"tarefas":{"tipo":"object[]","desc":"Up to 8 cases, with class, route, count and last time, without payer data."}},"returns":"{ verificado_em, ativo, total, tarefas }","url":"https://staging.commsharbor.com/api/credito/barrados/saude","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/conta","auth":"credito","exemplo":"curl -s $ORIGIN/api/credito/conta -H 'Cookie: <sessão>'","grupo":"Credit","summary":"The balance of the session account: the sum of its purchases in this environment, in every product, without the code. With movimentos=1, the statement of the account.","query":{"movimentos":{"tipo":"string","desc":"`1`: reads only the paged statement of the account, without the balance."},"de":{"tipo":"string","desc":"Inclusive start in UTC ISO 8601 with milliseconds. Default: 1970-01-01T00:00:00.000Z."},"ate":{"tipo":"string","desc":"Exclusive end in UTC ISO 8601 with milliseconds. Default: now. Keep the value between pages."},"antes":{"tipo":"string","desc":"The `proximo` cursor of the previous page. Only with movimentos=1."},"limite":{"tipo":"int","desc":"1 to 50 entries per page; default 20. Only with movimentos=1."}},"retorno":{"saldo_micros":{"tipo":"int","desc":"The balance in millionths of a dollar."},"saldo_usd":{"tipo":"string","desc":"The balance in dollars, formatted."},"referencia_usd":{"tipo":"string","desc":"The balance right after the last top-up, added across the wallets with a balance: the base of what is left."},"cotacao_brl_por_usd":{"tipo":"number","desc":"The BRL rate the screen uses to show the balance."},"movimentos":{"tipo":"object[]","desc":"Only with movimentos=1: id, em, valor_usd, saldo_usd, motivo, produto and recurso, newest first."},"proximo":{"tipo":"string","desc":"Only with movimentos=1: the cursor of the next page or null."}},"erros":{"400":"Invalid period, limit or cursor.","401":"No session."},"returns":"{ saldo_micros, saldo_usd, referencia_usd, cotacao_brl_por_usd, movimentos, proximo }","url":"https://staging.commsharbor.com/api/credito/conta","auth_detail":"Credit token in `Authorization: Bearer cred_…` or `X-Credito`. For recovered x402 funds, use the wallet credential mmw_… in Bearer or X-Wallet-Token, issued through /api/auth/wallet/agent/start and /api/auth/wallet/agent/token."},{"method":"POST","path":"/api/credito/conta","auth":"credito","exemplo":"curl -s -XPOST $ORIGIN/api/credito/conta -H 'Authorization: Bearer cred_…' -H 'Cookie: <sessão>'","grupo":"Credit","summary":"Links credit bought without an account to the account of the session, USDC included. Then the balance works in the products of the shared credit with `X-Credito: conta`, added to the other purchases of the account.","retorno":{"ok":{"tipo":"boolean","desc":"The link was checked."},"ligadas":{"tipo":"int","desc":"Purchases linked now. Zero when the purchase already has an account."},"da_conta":{"tipo":"boolean","desc":"The balance of this code is already in the account balance."}},"erros":{"401":"No session or no credit code."},"returns":"{ ok, ligadas, da_conta }","url":"https://staging.commsharbor.com/api/credito/conta","auth_detail":"Credit token in `Authorization: Bearer cred_…` or `X-Credito`. For recovered x402 funds, use the wallet credential mmw_… in Bearer or X-Wallet-Token, issued through /api/auth/wallet/agent/start and /api/auth/wallet/agent/token."},{"method":"POST","path":"/api/credito","auth":"none","summary":"Top up prepaid credit: pay once with x402 and get the token that debits on any API of the house.","grupo":"Credit","preco_usd_faixa":[0.1,25],"query":{"usd":{"tipo":"number","desc":"Package: 0.1, 1, 5, 10 or 25 dollars.","obrigatorio":true,"enum":[0.1,1,5,10,25]}},"retorno":{"token":{"tipo":"string","desc":"Bearer token for the balance (`cred_…`). Shown ONCE — it cannot be recovered."},"saldo_usd":{"tipo":"string","desc":"Credited balance."},"guarde":{"tipo":"string","desc":"Warning that the token is the bearer of the credit."},"usar":{"tipo":"string","desc":"How to present the token on paid routes."},"usar_com_outra_credencial":{"tipo":"string","desc":"The `X-Credito` header, for when `Authorization` already carries another credential."},"saldo_em":{"tipo":"string","desc":"Where to check balance and statement."},"onde_gastar":{"tipo":"object","desc":"`precos`: the paid actions and prices of this product (`/api/pricing`); `produtos`: the APIs.json with our other products."}},"erros":{"400":"Package outside the list (0.1, 1, 5, 10 or 25).","402":"Unpaid — the body carries the x402 `accepts[]`."},"exemplo":"curl -s -XPOST '$ORIGIN/api/credito?usd=10'","returns":"{ token, saldo_usd, guarde, usar, usar_com_outra_credencial, saldo_em, onde_gastar }","url":"https://staging.commsharbor.com/api/credito","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito","auth":"credito","summary":"Balance and statement with cred_…; wallet balance and up to 20 recovery records with mmw_….","desc":"A request without a token receives 401. The Link header points to the x402 manifest. When billing is configured, accepts[] contains the same terms as the smallest POST top-up. GET cannot charge or create credit.","grupo":"Credit","retorno":{"saldo_micros":{"tipo":"int","desc":"Balance in micro-dollars (1e-6 USD)."},"saldo_usd":{"tipo":"string","desc":"Formatted balance."},"criado_em":{"tipo":"string","desc":"When the credit was opened."},"movimentos":{"tipo":"object[]","desc":"Recent credits and debits, with product and resource."},"wallet":{"tipo":"string","desc":"Only with mmw_…: authenticated wallet address."},"payments":{"tipo":"object[]","desc":"Only with mmw_…: up to 20 payments with id, produto, rede, tx_hash, micros, estado and criado_ms. creditado means recovered balance."},"onde_gastar":{"tipo":"object","desc":"`precos`: the paid actions and prices of this product; `produtos`: the APIs.json with our other products."}},"erros":{"401":"No token, or unknown token."},"exemplo":"curl -s $ORIGIN/api/credito -H 'Authorization: Bearer cred_…'","returns":"{ saldo_micros, saldo_usd, criado_em, movimentos, wallet, payments, onde_gastar }","url":"https://staging.commsharbor.com/api/credito","auth_detail":"Credit token in `Authorization: Bearer cred_…` or `X-Credito`. For recovered x402 funds, use the wallet credential mmw_… in Bearer or X-Wallet-Token, issued through /api/auth/wallet/agent/start and /api/auth/wallet/agent/token."},{"method":"GET","path":"/api/credito/pix","auth":"none","summary":"Credit by Pix (Brazil): the key, the fixed rate, the packs in reais and what the receipt accepts.","grupo":"Credit","retorno":{"chave":{"tipo":"string","desc":"The Pix key that receives the payment."},"brl_por_usd":{"tipo":"number","desc":"Fixed rate used for the packs."},"pacotes":{"tipo":"object[]","desc":"The packs (3, 5, 10 or 25 dollars), each with `brl_centavos` and `copia_e_cola` (the Pix copy-and-paste code for the amount, the same text as the QR: the bank app comes with the amount filled in)."},"comprovante":{"tipo":"object","desc":"Accepted types (photo or PDF) and the maximum size, in bytes."},"liberacao":{"tipo":"string","desc":"`manual`: the owner checks the Pix and releases it."}},"exemplo":"curl -s $ORIGIN/api/credito/pix","returns":"{ chave, brl_por_usd, pacotes, comprovante, liberacao }","url":"https://staging.commsharbor.com/api/credito/pix","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/credito/pix","auth":"none","summary":"Request credit paid by Pix: multipart with `usd`, `comprovante` (photo or PDF up to 2 MB) and `email`; the rest is optional.","desc":"The credit code comes back in the response and works once the owner checks the Pix and releases it (by hand, usually the same day). `email` is required: it is how the owner reaches the person. Optional: `nome`, `pagina` (the page the request came from, up to 2,000 characters) and what the person was buying when the 402 came — `recurso` (up to 2,000), `descricao` (up to 300) and `preco_usd` (decimal, e.g. `0.50`); and `navegador_id` (a UUID that links the requests from the same browser). Everything that arrives is recorded with the request — the receipt included —, with the signed-in account (checked by the session cookie), the network and browser.","grupo":"Credit","retorno":{"id":{"tipo":"string","desc":"Request id, to follow it."},"estado":{"tipo":"string","desc":"`pendente` until the decision."},"credito":{"tipo":"string","desc":"The `cred_…` token, shown ONCE; it works after the release."},"estado_em":{"tipo":"string","desc":"Where to follow the request."}},"erros":{"400":"Pack outside the list (3, 5, 10 or 25), no receipt or no valid e-mail.","413":"Receipt above 2 MB.","415":"Receipt that is neither a photo (JPEG, PNG, WebP) nor a PDF.","429":"This network already sent today's requests.","502":"The e-mail to the owner did not go out: the request is recorded as `falhou`; send it again.","503":"Review queue full, or Pix not available in this app."},"exemplo":"curl -s -XPOST $ORIGIN/api/credito/pix -F usd=5 -F email=you@company.com -F comprovante=@pix.pdf","returns":"{ id, estado, credito, estado_em }","url":"https://staging.commsharbor.com/api/credito/pix","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/pix/:id","auth":"none","summary":"Status of a Pix credit request: `pendente`, `liberado`, `recusado` or `falhou`.","grupo":"Credit","params":{"id":{"desc":"Request id (32 hex).","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":{"estado":{"tipo":"string","desc":"`pendente`, `liberado`, `recusado` or `falhou` (the e-mail to the owner did not go out; send again)."},"usd":{"tipo":"int","desc":"The requested pack."},"decidido_em":{"tipo":"string","desc":"When the owner decided, or `null`."}},"erros":{"404":"Unknown request."},"exemplo":"curl -s $ORIGIN/api/credito/pix/0123456789abcdef0123456789abcdef","returns":"{ estado, usd, decidido_em }","url":"https://staging.commsharbor.com/api/credito/pix/:id","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/credito/asaas/:id/cancelar","auth":"none","grupo":"Crédito","summary":"Cancels a pending charge when the payment dialog closes.","desc":"Requires the `cancelamento` capability returned at creation. An older credit charge accepts its token in `credito`. The product and environment must match. This does not refund payments or remove records. 202 means cancellation is pending; the scheduled worker retries provider failures.","params":{"id":{"desc":"Charge id (32 hex).","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":{"id":{"tipo":"string","desc":"Charge id."},"estado":{"tipo":"string","desc":"`cancelando`, `vencido`, or the confirmed final state."}},"erros":{"404":"Invalid charge or capability, or a different product or environment."},"exemplo":"curl -s -XPOST $ORIGIN/api/credito/asaas/0123456789abcdef0123456789abcdef/cancelar -H 'content-type: application/json' -d '{\"cancelamento\":\"<bilhete>\"}'","returns":"{ id, estado }","url":"https://staging.commsharbor.com/api/credito/asaas/:id/cancelar","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/asaas","auth":"none","summary":"Automatic Pix: whether it is available in this app, the packs in reais and the balance the product sells.","grupo":"Crédito","retorno":{"disponivel":{"tipo":"boolean","desc":"`false` when the app has no Asaas configured (use the Pix with receipt)."},"pacotes":{"tipo":"object[]","desc":"The credit packs (3, 5, 10 or 25 dollars), with `brl_centavos`."},"exatos":{"tipo":"object[]","desc":"Prices declared by the app, with `usd` and `brl_centavos`. Amounts start at R$ 5.00 and cannot exceed R$ 10,000."},"saldo":{"tipo":"object","desc":"When the product sells a balance in reais: the range and whether the account can buy."},"precisa_documento":{"tipo":"boolean","desc":"Whether the payer's CPF or CNPJ is still required."}},"exemplo":"curl -s $ORIGIN/api/credito/asaas","returns":"{ disponivel, pacotes, exatos, saldo, precisa_documento }","url":"https://staging.commsharbor.com/api/credito/asaas","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/credito/asaas","auth":"none","summary":"Creates a dynamic Pix: JSON with `oferta` (`pacote` with `usd`, or `saldo` with `centavos`) and the payer.","desc":"The payment releases what was bought by itself: the pack becomes the `cred_…` token already in the response; the balance goes to the logged-in account's organization. The first purchase needs `documento` (CPF or CNPJ, sent to the gateway and not stored here) and `nome`; `email`, `pagina` and `navegador_id` are optional. With `forma: \"cartao_boleto\"` the charge is open: the response brings `pagamento_em`, the gateway page where you pay by card, boleto or Pix (due in three days). With `forma: \"cartao\"` and `cartao` (`titular`, `numero`, `mes`, `ano`, `cvv`, `documento`, `email`, `cep`, `numero_endereco`, `telefone`), the charge is paid by card in the same request: 200 with `estado: \"pago\"`, 202 with `conferir` while the issuer reviews it, 422 when the card is declined; the card is not stored. Set `usd` to an amount from `pacotes` or `exatos` in the GET response. The server sets the amount in cents and rejects amounts that the app has not declared.","grupo":"Crédito","retorno":{"id":{"tipo":"string","desc":"Charge id, to follow up."},"credito":{"tipo":"string","desc":"For a pack: the `cred_…` token, shown ONCE; valid when the payment arrives."},"forma":{"tipo":"string","desc":"`pix` (the default), `cartao` or `cartao_boleto`."},"pix":{"tipo":"object","desc":"`copia_e_cola`, `imagem` (PNG QR, data URI) and `expira_em`; `pix` form only."},"pagamento_em":{"tipo":"string","desc":"In the `cartao_boleto` form: the gateway payment page."},"estado":{"tipo":"string","desc":"In the `cartao` form: `pago`, or `pendente` with `conferir`."},"estado_em":{"tipo":"string","desc":"Where to follow the payment."},"cancelamento":{"tipo":"string","desc":"Capability to cancel a pending Pix or boleto charge."}},"erros":{"400":"Credit amount outside `pacotes` and `exatos`, amount out of range, invalid CPF/CNPJ, name or e-mail, invalid card data (`cartao_dados`, with the `campo`), or the gateway refused the payer (`pagador_recusado`, with the reason in `detalhe`).","422":"Card declined (`cartao_recusado`, with the `campo` when the gateway says which); try another card with `POST /api/credito/asaas/:id/cartao`.","429":"Limit of 3 attempts per minute or 10 per day, per account or network, or the card limit.","502":"The gateway did not create the Pix; try again.","503":"Automatic Pix unavailable in this app, the gateway is busy (`asaas_ocupado`, wait `retry_after_s`), or too many charges from people not signed in waiting for payment."},"exemplo":"curl -s -XPOST $ORIGIN/api/credito/asaas -H 'content-type: application/json' -d '{\"oferta\":\"pacote\",\"usd\":5,\"documento\":\"000.000.000-00\",\"nome\":\"Ana\"}'","returns":"{ id, credito, forma, pix, pagamento_em, estado, estado_em, cancelamento }","url":"https://staging.commsharbor.com/api/credito/asaas","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/asaas/:id","auth":"none","summary":"State of an automatic Pix charge: `pendente`, `pago`, `vencido`, `estornado` or `falhou`.","grupo":"Crédito","params":{"id":{"desc":"Charge id (32 hex).","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":{"estado":{"tipo":"string","desc":"`pago` releases the pack token or the balance; a Pix paid after the due date counts."},"pago_em":{"tipo":"string","desc":"When the payment was confirmed, or `null`."}},"erros":{"404":"Unknown charge."},"exemplo":"curl -s $ORIGIN/api/credito/asaas/0123456789abcdef0123456789abcdef","returns":"{ estado, pago_em }","url":"https://staging.commsharbor.com/api/credito/asaas/:id","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/credito/asaas/:id/cartao","auth":"none","summary":"Pays a card charge whose card was declined with another card: the same charge, never charged twice.","desc":"JSON with the `cartao` (the same fields as `POST /api/credito/asaas`) and, without an account, the `navegador_id` that created the charge. Only a card charge waiting for payment, by whoever created it, and up to five attempts per charge.","grupo":"Crédito","params":{"id":{"desc":"Id da cobrança (32 hex).","exemplo":"0123456789abcdef0123456789abcdef"}},"retorno":{"estado":{"tipo":"string","desc":"`pago`, or `pendente` with `conferir` while the issuer reviews it."},"estado_em":{"tipo":"string","desc":"Where to follow the payment."}},"erros":{"400":"Invalid card data (`cartao_dados`, with the `campo`).","404":"Unknown charge, someone else's charge, or not a card charge.","409":"The charge expired or was closed; start the payment again.","422":"Card declined (`cartao_recusado`).","429":"Used up the card attempts for this charge or for today."},"exemplo":"curl -s -XPOST $ORIGIN/api/credito/asaas/0123456789abcdef0123456789abcdef/cartao -H 'content-type: application/json' -d '{\"cartao\":{…}}'","returns":"{ estado, estado_em }","url":"https://staging.commsharbor.com/api/credito/asaas/:id/cartao","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/credito/asaas/saude","auth":"none","summary":"Health of this app's Pix and enabled subscriptions: failures and reasons for the dashboard.","grupo":"Crédito","retorno":{"ativo":{"tipo":"boolean","desc":"`false` when Asaas and subscriptions are disabled."},"tarefas":{"tipo":"object[]","desc":"Each problem has `id`, `falhando`, and `motivo`. Includes Pix and, when enabled, subscription recovery, queue, and budget. Does not call the provider."}},"exemplo":"curl -s $ORIGIN/api/credito/asaas/saude","returns":"{ ativo, tarefas }","url":"https://staging.commsharbor.com/api/credito/asaas/saude","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/erro-cliente","auth":"none","summary":"Browser error report, sent by the interface itself. Agents need not call it.","grupo":"Operations","desc":"The interface reports on its own JS errors, unhandled rejections, scripts/CSS that failed to load and CSP blocks — once per session — and the app reports handled failures through `window.mmErro.relata`. The server validates the envelope, redacts credentials, e-mails and phone numbers, merges repeats of the same failure per minute and records an operational event; nothing is written to a database. It keeps no IP, cookie, query string or full User-Agent. Always answers 204, even for an invalid report.","corpo":{"code":{"tipo":"string","desc":"Failure code, `UI-` + letters/digits (`UI-JS-001` global error, `UI-PROMESSA-001`, `UI-RECURSO-001`, `UI-CSP-001`, `UI-APP-001` app report).","obrigatorio":true},"phase":{"tipo":"string","desc":"Where it broke, lowercase: `global`, `promessa`, `script`, `load_list`…","obrigatorio":true},"path":{"tipo":"string","desc":"Path of the open page, without query; numbers, hashes and tokens in it are kept as `:id`."},"message":{"tipo":"string","desc":"Error message, up to 2000 characters."},"stack":{"tipo":"string","desc":"Stack trace, up to 12000 characters."},"source":{"tipo":"string","desc":"Originating script; only its path is kept."},"line":{"tipo":"int","desc":"Line in the originating script."},"column":{"tipo":"int","desc":"Column in the originating script."},"visivel":{"tipo":"bool","desc":"Whether the tab was visible when it broke."},"build":{"tipo":"string","desc":"Build of the reporting page (its `<meta name=\"build\">`), up to 64 letters, digits, `.`, `_` or `-`; it dates the failure."}},"body":{"code":"UI-APP-001","phase":"carregar_lista","path":"/","message":"lista 500"},"retorno":{"_texto":"204 with no body, always — an invalid, repeated or over-cap report also gets 204."},"exemplo":"curl -s -XPOST $ORIGIN/api/erro-cliente -H 'content-type: application/json' -d '{\"code\":\"UI-APP-001\",\"phase\":\"carregar_lista\",\"path\":\"/\",\"message\":\"lista 500\"}'","returns":"204 with no body, always — an invalid, repeated or over-cap report also gets 204.","url":"https://staging.commsharbor.com/api/erro-cliente","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/pagamento/aberto","auth":"none","statusOk":202,"summary":"The interface reports a visible payment prompt. Agents must not call this route.","grupo":"Operations","desc":"An empty same-origin report, sent automatically when a payment prompt becomes visible. It starts no payment, grants no access and receives no identity or credentials. It writes no database row per report. Counts events, not unique people. The private operator dashboard separates API payment requests and browser payment views per UTC day; the two counts may overlap.","headers":{"Origin":{"tipo":"string","desc":"The page origin, identical to this route's origin.","obrigatorio":true},"Sec-Fetch-Site":{"tipo":"string","desc":"`same-origin`, set by the browser.","obrigatorio":true},"X-MM-Payment-View":{"tipo":"string","desc":"`1`, set by the shared component.","obrigatorio":true}},"retorno":{"_texto":"202 with no body when accepted; 204 when ignored. Always no-store."},"returns":"202 with no body when accepted; 204 when ignored. Always no-store.","url":"https://staging.commsharbor.com/api/pagamento/aberto","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/funil","auth":"none","statusOk":202,"summary":"The interface reports the steps of a visit (conversion funnel). Agents must not call this route.","grupo":"Operations","desc":"A same-origin batch sent by the page itself: page views, engagement, offer in view, buy click, payment window, payment sent or accepted. It keeps the browser's random id, the path without query, the referring host and the utm tags; never IP, e-mail or account. It writes no database row: one line per batch in the day's journal, with a cap. Declared robots and smoke tests are left out.","headers":{"Origin":{"tipo":"string","desc":"The page origin, identical to this route's origin.","obrigatorio":false},"Content-Type":{"tipo":"string","desc":"`application/json` or `text/plain`.","obrigatorio":true}},"corpo":{"v":{"tipo":"number","desc":"Batch version: `1`.","obrigatorio":true},"vid":{"tipo":"string","desc":"This browser's random id (UUID v4).","obrigatorio":true},"sid":{"tipo":"string","desc":"Session id (30 idle minutes end it).","obrigatorio":true},"sn":{"tipo":"number","desc":"This browser's session number.","obrigatorio":true},"pv":{"tipo":"string","desc":"Page view id.","obrigatorio":true},"e":{"tipo":"object[]","desc":"Up to 40 events `{ t, n, p? }` from the funnel vocabulary.","obrigatorio":true}},"retorno":{"_texto":"202 with no body when stored; 204 when ignored. Always no-store."},"exemplo":"curl -s -XPOST $ORIGIN/api/funil -H 'content-type: text/plain' -H 'x-mm-smoke: 1' -d '{\"v\":1,\"vid\":\"0f8b9c1e-2a3b-4c5d-8e6f-7a8b9c0d1e2f\",\"sid\":\"s1abcdefgh\",\"sn\":1,\"pv\":\"p1abcdefgh\",\"e\":[{\"t\":0,\"n\":\"pagina\"}]}'","returns":"202 with no body when stored; 204 when ignored. Always no-store.","url":"https://staging.commsharbor.com/api/funil","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/funil/arquivos","auth":"none","summary":"Operator: the funnel journal days kept by this app, with the size of each.","grupo":"Operations","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>`.","obrigatorio":true}},"retorno":{"v":{"tipo":"number","desc":"Stored batch version."},"produto":{"tipo":"string","desc":"The product."},"teto":{"tipo":"object","desc":"`bytesDia` and `dias` kept."},"dias":{"tipo":"object[]","desc":"`{ dia, bytes }`, oldest to today."}},"erros":{"401":"Unauthorized","503":"Not configured"},"exemplo":"curl -s $ORIGIN/api/funil/arquivos -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"{ v, produto, teto, dias }","url":"https://staging.commsharbor.com/api/funil/arquivos","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/funil/arquivo","auth":"none","summary":"Operator: a slice of one funnel journal day, as NDJSON, from a byte offset.","grupo":"Operations","desc":"Up to 4 MiB per response, cut at the last whole line. `X-MM-Funil-Proximo` says where to ask for the rest; `X-MM-Funil-Tamanho`, the day's size now.","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>`.","obrigatorio":true}},"query":{"dia":{"tipo":"string","desc":"The day, `YYYY-MM-DD` (UTC).","obrigatorio":true},"desde":{"tipo":"number","desc":"The byte to read from; `0` at the start.","obrigatorio":false}},"retorno":{"_texto":"JSON lines, one per stored batch."},"erros":{"400":"Invalid parameters","401":"Unauthorized","503":"Not configured"},"exemplo":"curl -s \"$ORIGIN/api/funil/arquivo?dia=2026-09-27&desde=0\" -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"JSON lines, one per stored batch.","url":"https://staging.commsharbor.com/api/funil/arquivo","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/vitrine","auth":"none","grupo":"Public stats","summary":"The product's public numbers: traffic, agents, usage and reliability, no money.","desc":"Projection published hourly by the house collector, rounded to two significant digits; `null` is a missing measurement, never zero. 15-minute cache with ETag (`If-None-Match` → 304). There is no way to send numbers through this route: publishing belongs to the collector, with its own token.","retorno":{"v":{"tipo":"int","desc":"Contract version (1)."},"produto":{"tipo":"string","desc":"Product id."},"publicado":{"tipo":"bool","desc":"`false` before the collector's first publication; then only these five keys come."},"atualizado_em":{"tipo":"string","desc":"When the collector published (ISO 8601).","nulo":true},"stale":{"tipo":"bool","desc":"`true` when the projection is older than 26 h."},"nome":{"tipo":"string","desc":"Product name.","opcional":true},"desde":{"tipo":"string","desc":"First day the series covers.","nulo":true,"opcional":true},"fuso":{"tipo":"string","desc":"Traffic time zone. Audience periods state their time zone in `pessoas.medicao`.","opcional":true},"hoje":{"tipo":"object","desc":"Today: pages by class (human, AI, bot), API calls by class, machine-surface reads and product usage.","opcional":true},"dias":{"tipo":"object[]","desc":"Up to 31 days, oldest first: `dia`, `paginas`, `api`, `api_ia`, `maquina`, `visitantes`, `uso`.","opcional":true},"janelas":{"tipo":"object","desc":"7- and 30-day sums (`d7`, `d30`).","opcional":true},"visitantes":{"tipo":"object","desc":"Unique browsers with recorded interaction over 7 days.","opcional":true},"pessoas":{"tipo":"object","desc":"First-party measurement of browsers confirmed by interaction: unique browsers, sessions and pages over 7 and 30 days, segments and coverage. `null` means no measurement. Browsers are not verified people.","nulo":true,"opcional":true},"agentes":{"tipo":"object","desc":"The AI agents and bots that read the most, 7 days.","opcional":true},"superficies":{"tipo":"object","desc":"Reads of OKF, llms, well-known, OpenAPI and MCP over 7 days.","opcional":true},"mcp":{"tipo":"object","desc":"MCP calls over 7 days.","opcional":true},"uso":{"tipo":"object","desc":"Real product usage per resource: label, today, 7 and 30 days.","opcional":true},"contas":{"tipo":"object","desc":"Users and guests.","nulo":true,"opcional":true},"confiabilidade":{"tipo":"object","desc":"Share of requests without 5xx over 7 days, and the live build.","opcional":true},"catalogo":{"tipo":"object","desc":"Size of the catalog, when the product has one.","nulo":true,"opcional":true},"apoio":{"tipo":"object","desc":"Measured sponsors: 1-second exposures and native clicks per page in confirmed sessions, 7-day CTR, observed days and coverage. Empty means no history, not zero CTR.","opcional":true}},"exemplo":"curl -s $ORIGIN/api/vitrine","returns":"{ v, produto, publicado, atualizado_em, stale, nome?, desde?, fuso?, hoje?, dias?, janelas?, visitantes?, pessoas?, agentes?, superficies?, mcp?, uso?, contas?, confiabilidade?, catalogo?, apoio? }","url":"https://staging.commsharbor.com/api/vitrine","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/vitrine/operador","auth":"none","grupo":"Public stats","summary":"The product's full document on the operator panel — operator token only.","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>` — the operator class.","obrigatorio":true}},"retorno":{"produto":{"tipo":"string","desc":"Product id."},"atualizado_em":{"tipo":"string","desc":"When the collector published.","nulo":true},"operador":{"tipo":"object","desc":"The collector's full document, with what the public projection leaves out.","nulo":true}},"erros":{"401":"No token, wrong token or a token of another class.","503":"Worker without `METRICS_TOKEN` or without the control plane."},"exemplo":"curl -s $ORIGIN/api/vitrine/operador -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"{ produto, atualizado_em, operador }","url":"https://staging.commsharbor.com/api/vitrine/operador","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/vitrine/painel","auth":"none","grupo":"Public stats","summary":"The whole house panel, in the shape the gm reads — operator token only.","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>` — the operator class.","obrigatorio":true}},"retorno":{"apps":{"tipo":"object[]","desc":"One operator document per product, ordered by id."},"updated":{"tipo":"string","desc":"When the collector closed the round.","opcional":true},"totals":{"tipo":"object","desc":"House totals.","opcional":true}},"erros":{"401":"No token, wrong token or a token of another class.","503":"Worker without `METRICS_TOKEN` or without the control plane."},"exemplo":"curl -s $ORIGIN/api/vitrine/painel -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"{ apps, updated?, totals? }","url":"https://staging.commsharbor.com/api/vitrine/painel","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/vitrine/cursores","auth":"none","grupo":"Public stats","summary":"Per-product cursors: `borda`, `borda5xx` (5xx only), and `cli`. Operator token only.","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>` — the operator class.","obrigatorio":true}},"retorno":{"_texto":"JSON: `{ [product]: { borda?: ISO, borda5xx?: ISO, cli?: ISO } }`; empty is `{}`."},"erros":{"401":"No token, wrong token or a token of another class.","503":"Worker without `METRICS_TOKEN` or without the control plane."},"exemplo":"curl -s $ORIGIN/api/vitrine/cursores -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"JSON: `{ [product]: { borda?: ISO, borda5xx?: ISO, cli?: ISO } }`; empty is `{}`.","url":"https://staging.commsharbor.com/api/vitrine/cursores","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/partners","auth":"none","grupo":"Partnership","summary":"Partnerships, integrations and contact.","desc":"Partnership ideas, public numbers and contact form. Advertising and ad purchases are unavailable. Cached for 1 hour.","retorno":{"status":{"tipo":"string","desc":"`parceria`."},"produto":{"tipo":"string","desc":"Product name."},"idioma":{"tipo":"string","desc":"Language of the texts (the product's)."},"titulo":{"tipo":"string","desc":"Title of the offer."},"descricao":{"tipo":"string","desc":"One sentence about the offer."},"publico":{"tipo":"string","desc":"Who uses the product — the audience a sponsor reaches."},"modalidades":{"tipo":"object[]","desc":"`{ id, nome }`: patrocinio, parceria, anuncio."},"placements":{"tipo":"object[]","desc":"[]"},"packages":{"tipo":"object[]","desc":"[]"},"house_bundle":{"tipo":"object","desc":"`{ disponivel: false }`."},"parcerias":{"tipo":"string[]","desc":"Partnership ideas the product is open to discuss."},"current_sponsors":{"tipo":"object[]","desc":"Sponsors in effect: `id`, `nome`, `url`, `frase`, `espacos`, `ate`."},"stats":{"tipo":"object","desc":"Excerpt of the public numbers (`hoje`, `janelas`, `agentes`, `confiabilidade`) and the `link` to `/api/vitrine`; `publicado: false` before the first publication."},"payment":{"tipo":"object","desc":"`{ disponivel: false }`."},"contact":{"tipo":"object","desc":"`email`, `form_url`, `api_url` (`POST /api/contact`, free: one message every 10 s per network), `campos` (required), `campos_proposta` (the optional proposal fields, each with its accepted values), `message_template`, `instructions`."},"politica":{"tipo":"object","desc":"Refused sectors."},"_links":{"tipo":"object","desc":"`self`, `stats`, `page` (`null` until the page exists), `contact`, `casa` (the same path on the ten products)."},"publicidade_disponivel":{"tipo":"bool","desc":"`false`."}},"exemplo":"curl -s $ORIGIN/api/partners","returns":"{ status, produto, idioma, titulo, descricao, publico, modalidades, placements, packages, house_bundle, parcerias, current_sponsors, stats, payment, contact, politica, _links, publicidade_disponivel }","url":"https://staging.commsharbor.com/api/partners","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"POST","path":"/api/contact","auth":"none","summary":"Write to the people behind the product — free, for people and agents alike.","grupo":"Contact","desc":"One route for a question and for a sponsorship, partnership or ad proposal (`tipo`, with the placements of `GET /api/partners`). No captcha, no account, no payment. One message every 10 seconds per network: one that arrives sooner waits its turn and then goes out — no error. The message reaches the team by e-mail, with `email` as the reply address. For voice, send multipart/form-data: `dados` is this JSON (up to 32 KiB), and `audio` is one WebM, Ogg or M4A audio file (up to 2 MB). Audio can replace message. The browser records up to two minutes. Audio is attached to the owner's e-mail.","corpo":{"name":{"tipo":"string","desc":"What to call the person writing.","obrigatorio":true},"email":{"tipo":"string","desc":"Where to reply.","obrigatorio":true},"message":{"tipo":"string","desc":"What you want to say.","obrigatorio":true},"whatsapp":{"tipo":"string","desc":"Optional reply number with country code, such as +5561999999999."},"prefer_whatsapp":{"tipo":"bool","desc":"Request a WhatsApp reply. Requires whatsapp."},"tipo":{"tipo":"string","desc":"Proposal: `patrocinio`, `parceria`, `anuncio` or `consultoria`. Turns on the fields below."},"empresa":{"tipo":"string","desc":"Who is proposing, when it is a company."},"site":{"tipo":"string","desc":"Website of who is proposing."},"orcamento":{"tipo":"string","desc":"Advertising: `ate_100`, `100_500`, `500_2000`, `2000_mais` or `a_combinar`. Consulting, in US dollars: `ate_2000`, `2000_5000`, `5000_10000`, `10000_mais` or `nao_sei`."},"espaco":{"tipo":"string[]","desc":"Placement ids from `GET /api/partners`, up to 6."},"duracao":{"tipo":"string","desc":"Exposure in days: `30`, `90` or `365`."},"pagamento":{"tipo":"string","desc":"`usdc`, `deposito` or `a_combinar`."},"projeto":{"tipo":"string","desc":"Consulting: the kind of project (`llm_privado`, `voz`, `dados_sensiveis`, `gpu`, `integracao` or `outro`)."},"prazo":{"tipo":"string","desc":"Consulting: when to start (`agora`, `1_mes`, `1_3_meses` or `explorando`)."},"formato":{"tipo":"string","desc":"Consulting: `projeto` (per scope), `mensal` (monthly) or `assessoria` (advisory)."},"pais":{"tipo":"string","desc":"Consulting: the country of the person asking."},"fuso":{"tipo":"string","desc":"Consulting: the IANA time zone, such as `America/New_York`."},"horarios":{"tipo":"string[]","desc":"Consulting: up to 3 times for the call, `YYYY-MM-DDTHH:MM` in that time zone."}},"body":{"name":"Agent","email":"agent@example.com","message":"hello from an agent"},"retorno":{"ok":{"tipo":"bool","desc":"Always `true` when the message was accepted."}},"erros":{"400":"Validation: `code` names the field.","503":"Contact is not configured on this server."},"exemplo":"curl -s -XPOST $ORIGIN/api/contact -H 'content-type: application/json' -d '{\"name\":\"Agent\",\"email\":\"agent@example.com\",\"message\":\"hello from an agent\"}'","returns":"{ ok }","url":"https://staging.commsharbor.com/api/contact","auth_detail":"Public endpoint. No tenant data is returned."},{"method":"GET","path":"/api/metrics","auth":"none","summary":"Last-7-day metrics for the operator dashboard; with the token, payments come along.","grupo":"Operations","desc":"Without credentials it returns product usage: deliveries per day and organization totals. With `METRICS_TOKEN` as Bearer it adds `payments` — x402 settled on Base mainnet only — and `compras`, who paid in the last 30 days.","headers":{"Authorization":{"tipo":"string","desc":"`Bearer <METRICS_TOKEN>` to include the financial block; a wrong token is 401.","obrigatorio":false}},"retorno":"Metricas","erros":{"401":"Wrong operator token.","503":"Worker without METRICS_TOKEN configured."},"exemplo":"curl -s $ORIGIN/api/metrics -H \"Authorization: Bearer $METRICS_TOKEN\"","returns":"{ app, today, today_visits, today_contacts?, days, usage, accounts, financeiro?, payments?, compras? }","url":"https://staging.commsharbor.com/api/metrics","auth_detail":"Public endpoint. No tenant data is returned."}],"mcp":{"endpoint":"https://staging.commsharbor.com/mcp","transport":"streamable-http","tools":37},"mcp_tools":["commsharbor_health","commsharbor_logout","commsharbor_me","commsharbor_context","commsharbor_organization_get","commsharbor_audit","commsharbor_platform_context","pricing","commsharbor_email_google_catalog","commsharbor_email_google_connect","commsharbor_email_google_resolve","commsharbor_email_google_disconnect","commsharbor_email_domain_products_list","commsharbor_email_domain_products_add","commsharbor_email_workspace_snapshot","commsharbor_email_plans","commsharbor_email_workspace","commsharbor_email_trial_activate","commsharbor_email_domain_setup","commsharbor_email_domain_create","commsharbor_email_domain_get","commsharbor_email_domain_verify","commsharbor_email_domain_assistance","commsharbor_email_mailbox_create","commsharbor_email_mailbox_update","commsharbor_email_mailbox_password","commsharbor_email_mailbox_suspend","commsharbor_email_mailbox_resume","commsharbor_email_alias_create","commsharbor_email_alias_update","commsharbor_email_alias_suspend","commsharbor_email_alias_resume","commsharbor_email_job_get","commsharbor_email_service_request","commsharbor_email_security_check","commsharbor_brazil_email_report","get_api_x402_email_check"]}