Base URL and version
Production base URL: https://lucionmail.com. Current API prefix: /api/v1. Responses include `X-Lucion-API-Version: 1` and `Cache-Control: no-store`.
API keys use the `Authorization: Bearer` scheme. A valid key must include the scope required by each route.
Supported endpoints
| Method | Path | Scope | Purpose |
|---|---|---|---|
| GET | /api/v1/mail/messages | mail.read | Read a page from the mailbox bound to the key. |
| POST | /api/v1/mail/messages | mail.send | Send plain-text mail from an owned address. |
Request headers
- `Authorization: Bearer …` — required on both operations.
- `Accept: application/json` — recommended.
- `Content-Type: application/json` — required for POST.
- `Idempotency-Key` — required for POST, 1–256 characters.
- `X-Lucion-API-Version: 1` — optional explicit version selection; other values return `406`.
Machine-readable contract
Download the OpenAPI 3.1 document. It describes the server-to-server API contract and bearer scopes. The live implementation remains authoritative if a generated client or example disagrees.
Not in v1
Version 1 does not expose attachment downloads, HTML message bodies, scheduled sending, mailbox changes, alias administration, or public browser CORS. Organization API keys are scoped to their one preselected shared mailbox. Unsupported fields are rejected rather than silently ignored.