--- title: "Your account" description: "Every operation in this group: what it accepts, what it returns and the errors it can answer with." url: "https://nextmail.sh/docs/api/reference/your-account" area: "API" category: "Reference" --- # Your account Every operation in this group: what it accepts, what it returns and the errors it can answer with. ## Operations The account of the person behind the key or the app: which email notifications they get, their profile photo and username, the apps they connected and the invitations waiting for them. These calls act on a person, never on a workspace: an API key acts for the workspace owner, and an app for the person who connected it. Reading needs `account:read` and every change needs `account:write`. Neither is ever limited by a role, so an app a member connected reaches the member's own account too. ### `GET /account/notifications` Read your notification settings Which kinds of email Nextmail sends the person, as Account, Notifications shows them, and the workspaces whose notifications are muted on their phone. Account and billing email cannot be turned off. Requires the `account:read` scope. - Scopes: `account:read`. **Returns** - `200` `NotificationSettings`: The notification settings. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.getNotifications()`](https://nextmail.sh/docs/sdk/reference/account#getNotifications); Python [`account.get_notifications()`](https://nextmail.sh/docs/python/reference/account#getNotifications); Ruby [`account.get_notifications`](https://nextmail.sh/docs/ruby/reference/account#getNotifications); PHP [`account->getNotifications`](https://nextmail.sh/docs/php/reference/account#getNotifications); Go [`Account.GetNotifications`](https://nextmail.sh/docs/go/reference/account#getNotifications); Java [`account().getNotifications`](https://nextmail.sh/docs/java/reference/account#getNotifications); C# [`Account.GetNotificationsAsync`](https://nextmail.sh/docs/csharp/reference/account#getNotifications); CLI [`nextmail account get-notifications`](https://nextmail.sh/docs/cli/reference/account#account-get-notifications); MCP [`getNotificationSettings`](https://nextmail.sh/docs/mcp/tools/account#getNotificationSettings). ### `PUT /account/notifications/email/{category}` Turn a kind of email on or off `enabled: false` stops Nextmail sending the person that kind of email, and `true` starts it again. `account` and `billing` cannot be turned off, and asking to is a 422 `invalid_parameter` on `category`. Requires the `account:write` scope. - Scopes: `account:write`. **Path parameters** - `category` (`string`, required, one of `"account"`, `"billing"`, `"activity"`, `"product"`): The kind of email. **Request body** - `enabled` (`boolean`, required): True to receive that email, false to stop it. **Returns** - `200` `NotificationSettings`: The notification settings as they are now. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.setEmailNotification()`](https://nextmail.sh/docs/sdk/reference/account#setEmailNotification); Python [`account.set_email_notification()`](https://nextmail.sh/docs/python/reference/account#setEmailNotification); Ruby [`account.set_email_notification`](https://nextmail.sh/docs/ruby/reference/account#setEmailNotification); PHP [`account->setEmailNotification`](https://nextmail.sh/docs/php/reference/account#setEmailNotification); Go [`Account.SetEmailNotification`](https://nextmail.sh/docs/go/reference/account#setEmailNotification); Java [`account().setEmailNotification`](https://nextmail.sh/docs/java/reference/account#setEmailNotification); C# [`Account.SetEmailNotificationAsync`](https://nextmail.sh/docs/csharp/reference/account#setEmailNotification); CLI [`nextmail account set-email-notification`](https://nextmail.sh/docs/cli/reference/account#account-set-email-notification); MCP [`setEmailNotification`](https://nextmail.sh/docs/mcp/tools/account#setEmailNotification). ### `PUT /account/notifications/push/{workspaceId}` Mute a workspace on your phone `muted: true` stops the phone app notifying the person about the mail of one workspace, and `false` lets it notify them again. It applies to every phone they signed in on. A workspace they cannot open is a 404. Requires the `account:write` scope. - Scopes: `account:write`. **Path parameters** - `workspaceId` (`string`, required): A workspace from `GET /workspaces`. **Request body** - `muted` (`boolean`, required): True to mute it, false to let it notify again. **Returns** - `200` `NotificationSettings`: The notification settings as they are now. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.setPushMuted()`](https://nextmail.sh/docs/sdk/reference/account#setPushMuted); Python [`account.set_push_muted()`](https://nextmail.sh/docs/python/reference/account#setPushMuted); Ruby [`account.set_push_muted`](https://nextmail.sh/docs/ruby/reference/account#setPushMuted); PHP [`account->setPushMuted`](https://nextmail.sh/docs/php/reference/account#setPushMuted); Go [`Account.SetPushMuted`](https://nextmail.sh/docs/go/reference/account#setPushMuted); Java [`account().setPushMuted`](https://nextmail.sh/docs/java/reference/account#setPushMuted); C# [`Account.SetPushMutedAsync`](https://nextmail.sh/docs/csharp/reference/account#setPushMuted); CLI [`nextmail account set-push-muted`](https://nextmail.sh/docs/cli/reference/account#account-set-push-muted); MCP [`setWorkspacePushMuted`](https://nextmail.sh/docs/mcp/tools/account#setWorkspacePushMuted). ### `PUT /account/photo` Set your profile photo Uploads the person's profile photo, replacing any there was, as Account, Profile does. Send the image itself as the body, not JSON, with its type in `Content-Type`: `image/png`, `image/jpeg`, `image/webp`, `image/gif`. Up to 5 MB goes in. It is fitted into a 512 pixel square and stored as WebP, and an animated image keeps its first frame. Requires the `account:write` scope. - Scopes: `account:write`. **Request body** Content type: `image/png`, `image/jpeg`, `image/webp`, `image/gif`. `binary` **Returns** - `200` `AccountPhoto`: The photo, with its new `url`. **Errors** - `422`: `invalid_image` when the body is not an image of an accepted type, is too large or cannot be read. - `502`: `image_not_stored`: the image was read but could not be stored. Try again. - `503`: `image_busy`: the image service is saturated. Try again shortly. - The errors every operation can return: `400`, `401`, `403`, `404`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.setPhoto()`](https://nextmail.sh/docs/sdk/reference/account#setPhoto); Python [`account.set_photo()`](https://nextmail.sh/docs/python/reference/account#setPhoto); Ruby [`account.set_photo`](https://nextmail.sh/docs/ruby/reference/account#setPhoto); PHP [`account->setPhoto`](https://nextmail.sh/docs/php/reference/account#setPhoto); Go [`Account.SetPhoto`](https://nextmail.sh/docs/go/reference/account#setPhoto); Java [`account().setPhoto`](https://nextmail.sh/docs/java/reference/account#setPhoto); C# [`Account.SetPhotoAsync`](https://nextmail.sh/docs/csharp/reference/account#setPhoto); CLI [`nextmail account set-photo`](https://nextmail.sh/docs/cli/reference/account#account-set-photo); MCP [`setProfilePhoto`](https://nextmail.sh/docs/mcp/tools/account#setProfilePhoto). ### `DELETE /account/photo` Remove your profile photo Removes the profile photo and deletes the stored image, so the app shows initials again. Removing it when there is none changes nothing. Requires the `account:write` scope. - Scopes: `account:write`. **Returns** - `200` `AccountPhoto`: Removed, with `url` null. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.removePhoto()`](https://nextmail.sh/docs/sdk/reference/account#removePhoto); Python [`account.remove_photo()`](https://nextmail.sh/docs/python/reference/account#removePhoto); Ruby [`account.remove_photo`](https://nextmail.sh/docs/ruby/reference/account#removePhoto); PHP [`account->removePhoto`](https://nextmail.sh/docs/php/reference/account#removePhoto); Go [`Account.RemovePhoto`](https://nextmail.sh/docs/go/reference/account#removePhoto); Java [`account().removePhoto`](https://nextmail.sh/docs/java/reference/account#removePhoto); C# [`Account.RemovePhotoAsync`](https://nextmail.sh/docs/csharp/reference/account#removePhoto); CLI [`nextmail account remove-photo`](https://nextmail.sh/docs/cli/reference/account#account-remove-photo); MCP [`removeProfilePhoto`](https://nextmail.sh/docs/mcp/tools/account#removeProfilePhoto). ### `GET /account/username` Read your username The username of the person, whether they chose it or it was made for them, and the free address it gives them. A username is made from their name the first time it is read. Requires the `account:read` scope. - Scopes: `account:read`. **Returns** - `200` `Username`: The username. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.getUsername()`](https://nextmail.sh/docs/sdk/reference/account#getUsername); Python [`account.get_username()`](https://nextmail.sh/docs/python/reference/account#getUsername); Ruby [`account.get_username`](https://nextmail.sh/docs/ruby/reference/account#getUsername); PHP [`account->getUsername`](https://nextmail.sh/docs/php/reference/account#getUsername); Go [`Account.GetUsername`](https://nextmail.sh/docs/go/reference/account#getUsername); Java [`account().getUsername`](https://nextmail.sh/docs/java/reference/account#getUsername); C# [`Account.GetUsernameAsync`](https://nextmail.sh/docs/csharp/reference/account#getUsername); CLI [`nextmail account get-username`](https://nextmail.sh/docs/cli/reference/account#account-get-username); MCP [`getUsername`](https://nextmail.sh/docs/mcp/tools/account#getUsername). ### `PUT /account/username` Choose your username Sets the username for good, and with it the free address. Once chosen it never changes: a second choice is a 409 `username_locked`. A username another account has is a 409 `username_taken`, and one that is too short, too long, reserved or not lowercase letters, numbers and single dots is a 422 `invalid_parameter` on `username`. Check one first with `GET /account/username/availability`. Requires the `account:write` scope. - Scopes: `account:write`. **Request body** - `username` (`string`, required, up to 60 characters) **Returns** - `200` `Username`: The username, now chosen. **Errors** - `409`: `username_locked`: the username was chosen before and never changes. `username_taken`: another account has it. - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.setUsername()`](https://nextmail.sh/docs/sdk/reference/account#setUsername); Python [`account.set_username()`](https://nextmail.sh/docs/python/reference/account#setUsername); Ruby [`account.set_username`](https://nextmail.sh/docs/ruby/reference/account#setUsername); PHP [`account->setUsername`](https://nextmail.sh/docs/php/reference/account#setUsername); Go [`Account.SetUsername`](https://nextmail.sh/docs/go/reference/account#setUsername); Java [`account().setUsername`](https://nextmail.sh/docs/java/reference/account#setUsername); C# [`Account.SetUsernameAsync`](https://nextmail.sh/docs/csharp/reference/account#setUsername); CLI [`nextmail account set-username`](https://nextmail.sh/docs/cli/reference/account#account-set-username); MCP [`chooseUsername`](https://nextmail.sh/docs/mcp/tools/account#chooseUsername). ### `GET /account/username/availability` Check a username Whether the person could choose a username, without choosing it. The answer says why when they could not. Requires the `account:read` scope. - Scopes: `account:read`. **Query parameters** - `username` (`string`, required, 1 to 60 characters): The username to check. It is lowercased and its spaces become dots before it is checked, as the app does. **Returns** - `200` `UsernameAvailability`: The verdict. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.checkUsername()`](https://nextmail.sh/docs/sdk/reference/account#checkUsername); Python [`account.check_username()`](https://nextmail.sh/docs/python/reference/account#checkUsername); Ruby [`account.check_username`](https://nextmail.sh/docs/ruby/reference/account#checkUsername); PHP [`account->checkUsername`](https://nextmail.sh/docs/php/reference/account#checkUsername); Go [`Account.CheckUsername`](https://nextmail.sh/docs/go/reference/account#checkUsername); Java [`account().checkUsername`](https://nextmail.sh/docs/java/reference/account#checkUsername); C# [`Account.CheckUsernameAsync`](https://nextmail.sh/docs/csharp/reference/account#checkUsername); CLI [`nextmail account check-username`](https://nextmail.sh/docs/cli/reference/account#account-check-username); MCP [`checkUsername`](https://nextmail.sh/docs/mcp/tools/account#checkUsername). ### `GET /account/connected-apps` List your connected apps Every app the person connected with OAuth, as Account, Connected apps lists them: what each may reach, until when, how many tokens it holds and whether changes are allowed without a code for it right now. `current` marks the app making the call. Changing what an app may reach is done in the app, never through an app. Requires the `account:read` scope. - Scopes: `account:read`. **Returns** - `200` `ConnectedAppList`: The connected apps. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.listConnectedApps()`](https://nextmail.sh/docs/sdk/reference/account#listConnectedApps); Python [`account.list_connected_apps()`](https://nextmail.sh/docs/python/reference/account#listConnectedApps); Ruby [`account.list_connected_apps`](https://nextmail.sh/docs/ruby/reference/account#listConnectedApps); PHP [`account->listConnectedApps`](https://nextmail.sh/docs/php/reference/account#listConnectedApps); Go [`Account.ListConnectedApps`](https://nextmail.sh/docs/go/reference/account#listConnectedApps); Java [`account().listConnectedApps`](https://nextmail.sh/docs/java/reference/account#listConnectedApps); C# [`Account.ListConnectedAppsAsync`](https://nextmail.sh/docs/csharp/reference/account#listConnectedApps); CLI [`nextmail account list-connected-apps`](https://nextmail.sh/docs/cli/reference/account#account-list-connected-apps); MCP [`listConnectedApps`](https://nextmail.sh/docs/mcp/tools/account#listConnectedApps). ### `DELETE /account/connected-apps/{clientId}` Remove a connected app Deletes every token the app holds and the access the person gave it, so its next call is refused and it has to ask again. Removing the app making the call disconnects it. An app the person never connected is a 404. Requires the `account:write` scope. - Scopes: `account:write`. **Path parameters** - `clientId` (`string`, required): The app's `clientId` from `GET /account/connected-apps`. **Returns** - `200` `RevokedConnectedApp`: Removed. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.revokeConnectedApp()`](https://nextmail.sh/docs/sdk/reference/account#revokeConnectedApp); Python [`account.revoke_connected_app()`](https://nextmail.sh/docs/python/reference/account#revokeConnectedApp); Ruby [`account.revoke_connected_app`](https://nextmail.sh/docs/ruby/reference/account#revokeConnectedApp); PHP [`account->revokeConnectedApp`](https://nextmail.sh/docs/php/reference/account#revokeConnectedApp); Go [`Account.RevokeConnectedApp`](https://nextmail.sh/docs/go/reference/account#revokeConnectedApp); Java [`account().revokeConnectedApp`](https://nextmail.sh/docs/java/reference/account#revokeConnectedApp); C# [`Account.RevokeConnectedAppAsync`](https://nextmail.sh/docs/csharp/reference/account#revokeConnectedApp); CLI [`nextmail account revoke-connected-app`](https://nextmail.sh/docs/cli/reference/account#account-revoke-connected-app); MCP [`revokeConnectedApp`](https://nextmail.sh/docs/mcp/tools/account#revokeConnectedApp). ### `GET /account/connected-apps/{clientId}/requests` Read the request log of a connected app Every REST call the app made with the access the person gave it, newest first, the CLI signed in from a browser included: the method, the path, the status, how long it took and the error code of a refusal. Never a body, a query string or the address it came from. Calls made under an earlier connection of the same app are not in it. `failedOnly`, `status`, `since` and `until` narrow it, and paging is keyset: pass `nextCursor` back as `cursor` while `hasMore` is true. An app the person never connected is a 404. Requires the `account:read` scope. - Scopes: `account:read`. **Path parameters** - `clientId` (`string`, required): The app's `clientId` from `GET /account/connected-apps`. **Query parameters** - `failedOnly` (`boolean`): True keeps the calls answered with a status of 400 or more. - `status` (`string`): Keeps the calls answered with one of these HTTP status codes, comma-separated, such as `401,403`. At most 20 codes, each from 100 to 599. Anything else is a 422 `invalid_parameter`. - `since` (`string`, format `date-time`): Keeps the calls made at or after this instant. - `until` (`string`, format `date-time`): Keeps the calls made before this instant. - `limit` (`integer`, at least 1, at most 100, default `25`): Rows per page, 1 to 100. - `cursor` (`string`): The previous page's `nextCursor`, passed back as it came. It is opaque: it holds where the last row sat in this list's order, so a row deleted or edited between pages never breaks the walk, and the next page starts at the first row that sorts after it. A value this list did not hand out is a 400 `invalid_cursor`. **Returns** - `200` `ConnectedAppRequestList`: A page of the log. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.listConnectedAppRequests()`](https://nextmail.sh/docs/sdk/reference/account#listConnectedAppRequests), [`nextmail.account.listAllConnectedAppRequests()`](https://nextmail.sh/docs/sdk/reference/account#listAllConnectedAppRequests), [`nextmail.account.iterateConnectedAppRequests()`](https://nextmail.sh/docs/sdk/reference/account#iterateConnectedAppRequests); Python [`account.list_connected_app_requests()`](https://nextmail.sh/docs/python/reference/account#listConnectedAppRequests), [`account.list_all_connected_app_requests()`](https://nextmail.sh/docs/python/reference/account#listAllConnectedAppRequests), [`account.iterate_connected_app_requests()`](https://nextmail.sh/docs/python/reference/account#iterateConnectedAppRequests); Ruby [`account.list_connected_app_requests`](https://nextmail.sh/docs/ruby/reference/account#listConnectedAppRequests), [`account.list_all_connected_app_requests`](https://nextmail.sh/docs/ruby/reference/account#listAllConnectedAppRequests), [`account.iterate_connected_app_requests`](https://nextmail.sh/docs/ruby/reference/account#iterateConnectedAppRequests); PHP [`account->listConnectedAppRequests`](https://nextmail.sh/docs/php/reference/account#listConnectedAppRequests), [`account->listAllConnectedAppRequests`](https://nextmail.sh/docs/php/reference/account#listAllConnectedAppRequests), [`account->iterateConnectedAppRequests`](https://nextmail.sh/docs/php/reference/account#iterateConnectedAppRequests); Go [`Account.ListConnectedAppRequests`](https://nextmail.sh/docs/go/reference/account#listConnectedAppRequests), [`Account.ListAllConnectedAppRequests`](https://nextmail.sh/docs/go/reference/account#listAllConnectedAppRequests), [`Account.IterateConnectedAppRequests`](https://nextmail.sh/docs/go/reference/account#iterateConnectedAppRequests); Java [`account().listConnectedAppRequests`](https://nextmail.sh/docs/java/reference/account#listConnectedAppRequests), [`account().listAllConnectedAppRequests`](https://nextmail.sh/docs/java/reference/account#listAllConnectedAppRequests), [`account().iterateConnectedAppRequests`](https://nextmail.sh/docs/java/reference/account#iterateConnectedAppRequests); C# [`Account.ListConnectedAppRequestsAsync`](https://nextmail.sh/docs/csharp/reference/account#listConnectedAppRequests), [`Account.ListAllConnectedAppRequestsAsync`](https://nextmail.sh/docs/csharp/reference/account#listAllConnectedAppRequests), [`Account.IterateConnectedAppRequestsAsync`](https://nextmail.sh/docs/csharp/reference/account#iterateConnectedAppRequests); CLI [`nextmail account list-connected-app-requests`](https://nextmail.sh/docs/cli/reference/account#account-list-connected-app-requests); MCP [`listConnectedAppRequests`](https://nextmail.sh/docs/mcp/tools/account#listConnectedAppRequests). ### `GET /account/invitations` List your invitations The invitations to join a workspace waiting for the address the person signs in with, oldest first. Expired, accepted and withdrawn ones are left out. Requires the `account:read` scope. - Scopes: `account:read`. **Returns** - `200` `ReceivedInvitationList`: The invitations. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.listInvitations()`](https://nextmail.sh/docs/sdk/reference/account#listInvitations); Python [`account.list_invitations()`](https://nextmail.sh/docs/python/reference/account#listInvitations); Ruby [`account.list_invitations`](https://nextmail.sh/docs/ruby/reference/account#listInvitations); PHP [`account->listInvitations`](https://nextmail.sh/docs/php/reference/account#listInvitations); Go [`Account.ListInvitations`](https://nextmail.sh/docs/go/reference/account#listInvitations); Java [`account().listInvitations`](https://nextmail.sh/docs/java/reference/account#listInvitations); C# [`Account.ListInvitationsAsync`](https://nextmail.sh/docs/csharp/reference/account#listInvitations); CLI [`nextmail account list-invitations`](https://nextmail.sh/docs/cli/reference/account#account-list-invitations); MCP [`listReceivedInvitations`](https://nextmail.sh/docs/mcp/tools/account#listReceivedInvitations). ### `POST /account/invitations/{invitationId}/accept` Accept an invitation Joins the workspace with the role and the addresses the invitation gives, as accepting it in the app or from its link does. `activate: true` also makes it the workspace the app opens. A workspace that asks for two-factor sign-in is a 403 `two_factor_required` until the person turns it on, and an invitation that expired, was withdrawn or went to another address is a 422. Requires the `account:write` scope. - Scopes: `account:write`. **Path parameters** - `invitationId` (`string`, required): The invitation id from `GET /account/invitations`. **Request body** - `activate` (`boolean`) **Returns** - `200` `AcceptedInvitation`: Joined. **Errors** - `403`: `two_factor_required`: the workspace asks everyone in it to sign in with two-factor authentication. `mailbox_login`: a password sign-in for one address cannot join a workspace. - The errors every operation can return: `400`, `401`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.acceptInvitation()`](https://nextmail.sh/docs/sdk/reference/account#acceptInvitation); Python [`account.accept_invitation()`](https://nextmail.sh/docs/python/reference/account#acceptInvitation); Ruby [`account.accept_invitation`](https://nextmail.sh/docs/ruby/reference/account#acceptInvitation); PHP [`account->acceptInvitation`](https://nextmail.sh/docs/php/reference/account#acceptInvitation); Go [`Account.AcceptInvitation`](https://nextmail.sh/docs/go/reference/account#acceptInvitation); Java [`account().acceptInvitation`](https://nextmail.sh/docs/java/reference/account#acceptInvitation); C# [`Account.AcceptInvitationAsync`](https://nextmail.sh/docs/csharp/reference/account#acceptInvitation); CLI [`nextmail account accept-invitation`](https://nextmail.sh/docs/cli/reference/account#account-accept-invitation); MCP [`acceptInvitation`](https://nextmail.sh/docs/mcp/tools/account#acceptInvitation). ### `POST /account/invitations/{invitationId}/decline` Decline an invitation Turns the invitation down, so its link stops working, and tells whoever sent it. It cannot be taken back: they have to invite the person again. An invitation they already accepted is a 409 `invitation_accepted`. Requires the `account:write` scope. - Scopes: `account:write`. **Path parameters** - `invitationId` (`string`, required): The invitation id from `GET /account/invitations`. **Returns** - `200` `DeclinedInvitation`: Declined. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.declineInvitation()`](https://nextmail.sh/docs/sdk/reference/account#declineInvitation); Python [`account.decline_invitation()`](https://nextmail.sh/docs/python/reference/account#declineInvitation); Ruby [`account.decline_invitation`](https://nextmail.sh/docs/ruby/reference/account#declineInvitation); PHP [`account->declineInvitation`](https://nextmail.sh/docs/php/reference/account#declineInvitation); Go [`Account.DeclineInvitation`](https://nextmail.sh/docs/go/reference/account#declineInvitation); Java [`account().declineInvitation`](https://nextmail.sh/docs/java/reference/account#declineInvitation); C# [`Account.DeclineInvitationAsync`](https://nextmail.sh/docs/csharp/reference/account#declineInvitation); CLI [`nextmail account decline-invitation`](https://nextmail.sh/docs/cli/reference/account#account-decline-invitation); MCP [`declineInvitation`](https://nextmail.sh/docs/mcp/tools/account#declineInvitation). ### `GET /account/sessions` List your signed-in devices Every browser and phone the person is signed in on, as Account, Security lists them, most recently used first: the browser and system, the country and city it was last used from, how it signed in and when. No address is ever recorded, only the place. These calls act on a person, never on a workspace: an API key acts for the workspace owner, and an app for the person who connected it. Requires the `account:read` scope. - Scopes: `account:read`. **Returns** - `200` `SessionList`: The signed-in devices. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.listSessions()`](https://nextmail.sh/docs/sdk/reference/account#listSessions); Python [`account.list_sessions()`](https://nextmail.sh/docs/python/reference/account#listSessions); Ruby [`account.list_sessions`](https://nextmail.sh/docs/ruby/reference/account#listSessions); PHP [`account->listSessions`](https://nextmail.sh/docs/php/reference/account#listSessions); Go [`Account.ListSessions`](https://nextmail.sh/docs/go/reference/account#listSessions); Java [`account().listSessions`](https://nextmail.sh/docs/java/reference/account#listSessions); C# [`Account.ListSessionsAsync`](https://nextmail.sh/docs/csharp/reference/account#listSessions); CLI [`nextmail account list-sessions`](https://nextmail.sh/docs/cli/reference/account#account-list-sessions); MCP [`listSessions`](https://nextmail.sh/docs/mcp/tools/account#listSessions). ### `DELETE /account/sessions` Sign out everywhere Signs the person out of every browser and phone at once. Each one is refused on its next request. With `connectedApps=true` every connected app is removed as well, except the app making this call. A key or an app is not a signed-in device, so the call never ends its own access. Requires the `account:write` scope. - Scopes: `account:write`. **Query parameters** - `connectedApps` (`boolean`, default `false`): Also remove every connected app, apart from the one making the call. **Returns** - `200` `SessionSweep`: How many devices and apps were signed out. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.revokeSessions()`](https://nextmail.sh/docs/sdk/reference/account#revokeSessions); Python [`account.revoke_sessions()`](https://nextmail.sh/docs/python/reference/account#revokeSessions); Ruby [`account.revoke_sessions`](https://nextmail.sh/docs/ruby/reference/account#revokeSessions); PHP [`account->revokeSessions`](https://nextmail.sh/docs/php/reference/account#revokeSessions); Go [`Account.RevokeSessions`](https://nextmail.sh/docs/go/reference/account#revokeSessions); Java [`account().revokeSessions`](https://nextmail.sh/docs/java/reference/account#revokeSessions); C# [`Account.RevokeSessionsAsync`](https://nextmail.sh/docs/csharp/reference/account#revokeSessions); CLI [`nextmail account revoke-sessions`](https://nextmail.sh/docs/cli/reference/account#account-revoke-sessions); MCP [`revokeOtherSessions`](https://nextmail.sh/docs/mcp/tools/account#revokeOtherSessions). ### `DELETE /account/sessions/{sessionId}` Sign out one device Signs one browser or phone out. Its next request is refused at once, and a phone stops getting notifications. A device that is not signed in to the account is a 404. Requires the `account:write` scope. - Scopes: `account:write`. **Path parameters** - `sessionId` (`string`, required): The device's `id` from `GET /account/sessions`. **Returns** - `200` `RevokedSession`: Signed out. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.revokeSession()`](https://nextmail.sh/docs/sdk/reference/account#revokeSession); Python [`account.revoke_session()`](https://nextmail.sh/docs/python/reference/account#revokeSession); Ruby [`account.revoke_session`](https://nextmail.sh/docs/ruby/reference/account#revokeSession); PHP [`account->revokeSession`](https://nextmail.sh/docs/php/reference/account#revokeSession); Go [`Account.RevokeSession`](https://nextmail.sh/docs/go/reference/account#revokeSession); Java [`account().revokeSession`](https://nextmail.sh/docs/java/reference/account#revokeSession); C# [`Account.RevokeSessionAsync`](https://nextmail.sh/docs/csharp/reference/account#revokeSession); CLI [`nextmail account revoke-session`](https://nextmail.sh/docs/cli/reference/account#account-revoke-session); MCP [`revokeSession`](https://nextmail.sh/docs/mcp/tools/account#revokeSession). ### `GET /account/security-events` Read your security log What happened to the sign-in of the account, newest first: each sign-in with its device and place, devices signed out, password changes and resets, two-factor turned on or off, and passkeys added or removed. Nothing is ever removed from it. Paging is keyset: pass `nextCursor` back as `cursor` while `hasMore` is true. Requires the `account:read` scope. - Scopes: `account:read`. **Query parameters** - `limit` (`integer`, at least 1, at most 100, default `25`): Rows per page, 1 to 100. - `cursor` (`string`): The previous page's `nextCursor`, passed back as it came. It is opaque: it holds where the last row sat in this list's order, so a row deleted or edited between pages never breaks the walk, and the next page starts at the first row that sorts after it. A value this list did not hand out is a 400 `invalid_cursor`. **Returns** - `200` `SecurityEventList`: A page of the log. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.listSecurityEvents()`](https://nextmail.sh/docs/sdk/reference/account#listSecurityEvents), [`nextmail.account.listAllSecurityEvents()`](https://nextmail.sh/docs/sdk/reference/account#listAllSecurityEvents), [`nextmail.account.iterateSecurityEvents()`](https://nextmail.sh/docs/sdk/reference/account#iterateSecurityEvents); Python [`account.list_security_events()`](https://nextmail.sh/docs/python/reference/account#listSecurityEvents), [`account.list_all_security_events()`](https://nextmail.sh/docs/python/reference/account#listAllSecurityEvents), [`account.iterate_security_events()`](https://nextmail.sh/docs/python/reference/account#iterateSecurityEvents); Ruby [`account.list_security_events`](https://nextmail.sh/docs/ruby/reference/account#listSecurityEvents), [`account.list_all_security_events`](https://nextmail.sh/docs/ruby/reference/account#listAllSecurityEvents), [`account.iterate_security_events`](https://nextmail.sh/docs/ruby/reference/account#iterateSecurityEvents); PHP [`account->listSecurityEvents`](https://nextmail.sh/docs/php/reference/account#listSecurityEvents), [`account->listAllSecurityEvents`](https://nextmail.sh/docs/php/reference/account#listAllSecurityEvents), [`account->iterateSecurityEvents`](https://nextmail.sh/docs/php/reference/account#iterateSecurityEvents); Go [`Account.ListSecurityEvents`](https://nextmail.sh/docs/go/reference/account#listSecurityEvents), [`Account.ListAllSecurityEvents`](https://nextmail.sh/docs/go/reference/account#listAllSecurityEvents), [`Account.IterateSecurityEvents`](https://nextmail.sh/docs/go/reference/account#iterateSecurityEvents); Java [`account().listSecurityEvents`](https://nextmail.sh/docs/java/reference/account#listSecurityEvents), [`account().listAllSecurityEvents`](https://nextmail.sh/docs/java/reference/account#listAllSecurityEvents), [`account().iterateSecurityEvents`](https://nextmail.sh/docs/java/reference/account#iterateSecurityEvents); C# [`Account.ListSecurityEventsAsync`](https://nextmail.sh/docs/csharp/reference/account#listSecurityEvents), [`Account.ListAllSecurityEventsAsync`](https://nextmail.sh/docs/csharp/reference/account#listAllSecurityEvents), [`Account.IterateSecurityEventsAsync`](https://nextmail.sh/docs/csharp/reference/account#iterateSecurityEvents); CLI [`nextmail account list-security-events`](https://nextmail.sh/docs/cli/reference/account#account-list-security-events); MCP [`listSecurityEvents`](https://nextmail.sh/docs/mcp/tools/account#listSecurityEvents). ### `GET /account/passkeys` List your passkeys The passkeys that can sign in to the account, oldest first, each with its name, whether it is synced between the person's devices and when it was last used. A passkey is added on the device that holds it, in Account, Security, never through the API. Requires the `account:read` scope. - Scopes: `account:read`. **Returns** - `200` `PasskeyList`: The passkeys. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.listPasskeys()`](https://nextmail.sh/docs/sdk/reference/account#listPasskeys); Python [`account.list_passkeys()`](https://nextmail.sh/docs/python/reference/account#listPasskeys); Ruby [`account.list_passkeys`](https://nextmail.sh/docs/ruby/reference/account#listPasskeys); PHP [`account->listPasskeys`](https://nextmail.sh/docs/php/reference/account#listPasskeys); Go [`Account.ListPasskeys`](https://nextmail.sh/docs/go/reference/account#listPasskeys); Java [`account().listPasskeys`](https://nextmail.sh/docs/java/reference/account#listPasskeys); C# [`Account.ListPasskeysAsync`](https://nextmail.sh/docs/csharp/reference/account#listPasskeys); CLI [`nextmail account list-passkeys`](https://nextmail.sh/docs/cli/reference/account#account-list-passkeys); MCP [`listPasskeys`](https://nextmail.sh/docs/mcp/tools/account#listPasskeys). ### `PATCH /account/passkeys/{passkeyId}` Rename a passkey Gives a passkey a name the person will recognise, 1 to 60 characters. A passkey that is not on the account is a 404. Requires the `account:write` scope. - Scopes: `account:write`. **Path parameters** - `passkeyId` (`string`, required): The passkey's `id` from `GET /account/passkeys`. **Request body** - `name` (`string`, required, 1 to 60 characters) **Returns** - `200` `Passkey`: The passkey with its new name. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.renamePasskey()`](https://nextmail.sh/docs/sdk/reference/account#renamePasskey); Python [`account.rename_passkey()`](https://nextmail.sh/docs/python/reference/account#renamePasskey); Ruby [`account.rename_passkey`](https://nextmail.sh/docs/ruby/reference/account#renamePasskey); PHP [`account->renamePasskey`](https://nextmail.sh/docs/php/reference/account#renamePasskey); Go [`Account.RenamePasskey`](https://nextmail.sh/docs/go/reference/account#renamePasskey); Java [`account().renamePasskey`](https://nextmail.sh/docs/java/reference/account#renamePasskey); C# [`Account.RenamePasskeyAsync`](https://nextmail.sh/docs/csharp/reference/account#renamePasskey); CLI [`nextmail account rename-passkey`](https://nextmail.sh/docs/cli/reference/account#account-rename-passkey); MCP [`renamePasskey`](https://nextmail.sh/docs/mcp/tools/account#renamePasskey). ### `DELETE /account/passkeys/{passkeyId}` Remove a passkey Removes a passkey, so it can no longer sign in or confirm a change. The person is told by email, and it is written to their security log. The passkey stays on the device until they delete it there. A passkey that is not on the account is a 404. Requires the `account:write` scope. - Scopes: `account:write`. **Path parameters** - `passkeyId` (`string`, required): The passkey's `id` from `GET /account/passkeys`. **Returns** - `200` `RemovedPasskey`: Removed. **Errors** - The errors every operation can return: `400`, `401`, `403`, `404`, `422`, `429`, `500`, described in the [error catalog](https://nextmail.sh/docs/api/errors). Also available in: TypeScript [`nextmail.account.removePasskey()`](https://nextmail.sh/docs/sdk/reference/account#removePasskey); Python [`account.remove_passkey()`](https://nextmail.sh/docs/python/reference/account#removePasskey); Ruby [`account.remove_passkey`](https://nextmail.sh/docs/ruby/reference/account#removePasskey); PHP [`account->removePasskey`](https://nextmail.sh/docs/php/reference/account#removePasskey); Go [`Account.RemovePasskey`](https://nextmail.sh/docs/go/reference/account#removePasskey); Java [`account().removePasskey`](https://nextmail.sh/docs/java/reference/account#removePasskey); C# [`Account.RemovePasskeyAsync`](https://nextmail.sh/docs/csharp/reference/account#removePasskey); CLI [`nextmail account remove-passkey`](https://nextmail.sh/docs/cli/reference/account#account-remove-passkey); MCP [`removePasskey`](https://nextmail.sh/docs/mcp/tools/account#removePasskey). ### Objects #### `AcceptedInvitation` `object` - `object` (`string`, required, one of `"invitation"`) - `id` (`string`, required) - `accepted` (`boolean`, required, one of `true`) - `workspaceId` (`string`, required) - `workspaceName` (`string`, required) - `addressesGranted` (`integer`, required, at least 0) - `domainsGranted` (`integer`, required, at least 0) - `activated` (`boolean`, required): Whether the app now opens the workspace, after `activate: true`. #### `AccountPhoto` `object` - `object` (`string`, required, one of `"account_photo"`) - `url` (`string`, required, nullable) #### `ConnectedApp` `object` - `object` (`string`, required, one of `"connected_app"`) - `clientId` (`string`, required) - `name` (`string`, required, nullable) - `kind` (`string`, required, one of `"app"`, `"cli"`): `cli` for a sign-in of the command line tool, `app` for every other app. - `cliDevice` (`string`, nullable) - `current` (`boolean`, required): Whether it is the app making this call. - `registeredByAccount` (`boolean`) - `redirectUris` (`string[]`) - `connectedAt` (`string`, nullable, format `date-time`) - `accessUntil` (`string`, nullable, format `date-time`): When its last token runs out. - `tokenCount` (`integer`, required, at least 0) - `status` (`string`, required, one of `"active"`, `"expired"`, `"needs-approval"`, `"access-lost"`) - `usablePermissions` (`integer`, nullable): How many of the permissions it was given the person still holds. - `elevatedUntil` (`string`, nullable, format `date-time`): Until when it may make changes that ask for a verification code without one. - `grant` (`object`, nullable): What the person gave it, or null for an app that has to ask again. - `workspaceId` (`string`, required): The one workspace the app acts for. - `workspaceName` (`string`, required, nullable) - `permissions` (`string[]`, required) - `addressAllowlist` (`string[]`, required, nullable) - `domainAllowlist` (`string[]`, required, nullable) - `expiresAt` (`string`, required, nullable, format `date-time`): When the access ends, or null when it lasts until it is removed. - `updatedAt` (`string`, required, format `date-time`) #### `ConnectedAppList` `object` - `object` (`string`, one of `"list"`) - `data` (`ConnectedApp[]`) #### `ConnectedAppRequest` `object` - `object` (`string`, required, one of `"connected_app_request"`) - `id` (`string`, required) - `clientId` (`string`, required) - `workspaceId` (`string`, required): The workspace the call acted on. - `requestId` (`string`, required, nullable): The `X-Request-Id` the call was answered with. - `method` (`string`, required) - `path` (`string`, required): The path that was called, without its query string. - `status` (`integer`, required) - `errorCode` (`string`, required, nullable): The `code` of the error the call was answered with, or null. - `durationMs` (`integer`, required, at least 0) - `userAgent` (`string`, required, nullable) - `createdAt` (`string`, required, format `date-time`) #### `ConnectedAppRequestList` `object` - `object` (`string`, one of `"list"`) - `data` (`ConnectedAppRequest[]`) - `hasMore` (`boolean`): True when another page follows. Pass `nextCursor` back as `cursor` to read it. - `nextCursor` (`string`, nullable): An opaque cursor for the next page, or null on the last page. Pass it back unchanged. #### `DeclinedInvitation` `object` - `object` (`string`, required, one of `"invitation"`) - `id` (`string`, required) - `declined` (`boolean`, required, one of `true`) #### `EmailNotificationSetting` `object` - `category` (`string`, required, one of `"account"`, `"billing"`, `"activity"`, `"product"`) - `label` (`string`, required) - `description` (`string`, required) - `required` (`boolean`, required): Whether it can never be turned off. - `enabled` (`boolean`, required) #### `NotificationSettings` `object` - `object` (`string`, required, one of `"notification_settings"`) - `email` (`EmailNotificationSetting[]`, required): Every kind of email Nextmail sends. - `mutedWorkspaces` (`string[]`, required): The workspaces whose notifications are muted on the phone. #### `Passkey` `object` - `object` (`string`, required, one of `"passkey"`) - `id` (`string`, required) - `name` (`string`, required) - `synced` (`boolean`, required): Whether it is backed up and shared between the person's devices. - `transports` (`string[]`, required, one of `"internal"`, `"hybrid"`, `"usb"`, `"nfc"`, `"ble"`, `"smart-card"`, `"cable"`): How the device that holds it is reached, such as `internal` or `usb`. - `createdAt` (`string`, required, format `date-time`) - `lastUsedAt` (`string`, required, nullable, format `date-time`): When it last signed in or confirmed a change. #### `PasskeyList` `object` - `object` (`string`, one of `"list"`) - `data` (`Passkey[]`) #### `ReceivedInvitation` `object` - `object` (`string`, required, one of `"invitation"`) - `id` (`string`, required) - `workspaceId` (`string`, required) - `workspaceName` (`string`, required) - `roleName` (`string`, required) - `inviterName` (`string`, nullable) - `addresses` (`integer`, required, at least 0): How many addresses and whole domains it gives. - `expiresAt` (`string`, required, format `date-time`) - `createdAt` (`string`, required, format `date-time`) #### `ReceivedInvitationList` `object` - `object` (`string`, one of `"list"`) - `data` (`ReceivedInvitation[]`) #### `RemovedPasskey` `object` - `object` (`string`, required, one of `"passkey"`) - `id` (`string`, required) - `removed` (`boolean`, required, one of `true`) #### `RevokedConnectedApp` `object` - `object` (`string`, required, one of `"connected_app"`) - `clientId` (`string`, required) - `revoked` (`boolean`, required, one of `true`) - `tokensRevoked` (`integer`, required, at least 0) #### `RevokedSession` `object` - `object` (`string`, required, one of `"session"`) - `id` (`string`, required) - `revoked` (`boolean`, required, one of `true`) #### `SecurityEvent` `object` - `object` (`string`, required, one of `"security_event"`) - `id` (`string`, required) - `scope` (`string`, required, one of `"account"`, `"workspace"`): `account` for the person's own log, `workspace` for the workspace's. - `kind` (`string`, required, one of `"sign-in"`, `"session-revoked"`, `"sessions-revoked"`, `"password-changed"`, `"password-reset"`, `"two-factor-enabled"`, `"two-factor-disabled"`, `"passkey-added"`, `"passkey-removed"`, `"member-added"`, `"member-removed"`, `"member-role-changed"`, `"invitation-sent"`, `"invitation-revoked"`, `"role-created"`, `"role-changed"`, `"role-deleted"`, `"two-factor-requirement-changed"`, `"address-password-set"`, `"address-password-removed"`, `"directory-sync-connected"`, `"directory-sync-disconnected"`, `"directory-sync-token-rotated"`, `"directory-sync-changed"`, `"connector-connected"`, `"connector-disconnected"`, `"connector-changed"`, `"ownership-offered"`, `"ownership-transferred"`) - `at` (`string`, required, format `date-time`) - `actor` (`object`, required, nullable): Who made a workspace change, or null for the person's own log. - `name` (`string`, required, nullable) - `email` (`string`, required, nullable) - `member` (`object`, required, nullable): The person a workspace change was about. - `name` (`string`, required, nullable) - `email` (`string`, required, nullable) - `device` (`object`, required, nullable): The device it happened on, when one was known. - `kind` (`string`, required, one of `"browser"`, `"app"`, `"unknown"`): `browser`, `app` for the Nextmail phone app, or `unknown`. - `browser` (`string`, required, nullable): Such as `Chrome`. - `os` (`string`, required, nullable): Such as `macOS` or `iOS`. - `name` (`string`, required, nullable): The name of the phone, when the phone app reported one. - `appVersion` (`string`, required, nullable) - `authMethod` (`string`, required, nullable, one of `"password"`, `"totp"`, `"backup-code"`, `"passkey"`, `"email-link"`, `"handoff"`): How a sign-in was made. - `country` (`string`, required, nullable) - `city` (`string`, required, nullable) - `detail` (`SecurityEventDetail`, required) #### `SecurityEventDetail` `object` What the event was about. Only the fields that apply to its `kind` are present. - `byKey` (`boolean`): True when an API key made the change. - `byDirectory` (`boolean`): True when directory sync made the change. - `role` (`string`, nullable) - `previousRole` (`string`, nullable) - `passkey` (`string`, nullable): The name of the passkey. - `device` (`string`, nullable): The device that was signed out, as an English label. - `deviceInfo` (`object`, nullable): The same device in parts, so a client can word it itself. Absent on entries recorded before it was added. - `kind` (`string`, required, one of `"browser"`, `"app"`, `"unknown"`): `browser`, `app` for the Nextmail phone app, or `unknown`. - `browser` (`string`, required, nullable): Such as `Chrome`. - `os` (`string`, required, nullable): Such as `macOS` or `iOS`. - `name` (`string`, required, nullable): The name of the phone, when the phone app reported one. - `appVersion` (`string`, required, nullable) - `sessions` (`integer`): How many devices were signed out. - `apps` (`integer`): How many connected apps were removed. - `newDevice` (`boolean`): True for a sign-in from a device not seen before. - `address` (`string`, nullable) - `required` (`boolean`) - `enabled` (`boolean`) - `connector` (`string`, nullable): The name of the app a connector entry is about. - `access` (`string`, nullable): What the connector lets the assistant do, `read` or `full`. - `paused` (`boolean`): Whether the connector is paused. #### `SecurityEventList` `object` - `object` (`string`, one of `"list"`) - `data` (`SecurityEvent[]`) - `hasMore` (`boolean`): True when another page follows. Pass `nextCursor` back as `cursor` to read it. - `nextCursor` (`string`, nullable): An opaque cursor for the next page, or null on the last page. Pass it back unchanged. #### `Session` `object` - `object` (`string`, required, one of `"session"`) - `id` (`string`, required) - `current` (`boolean`, required): Whether it is the device making the call. Always false for a key or an app. - `device` (`SessionDevice`, required) - `authMethod` (`string`, required, nullable, one of `"password"`, `"totp"`, `"backup-code"`, `"passkey"`, `"email-link"`, `"handoff"`): How it signed in, or null for a device signed in before this was recorded. - `country` (`string`, required, nullable): The two-letter country it was last used from. - `city` (`string`, required, nullable) - `createdAt` (`string`, required, format `date-time`): When it signed in. - `lastActiveAt` (`string`, required, format `date-time`): When it was last used, to within ten minutes. - `expiresAt` (`string`, required, format `date-time`): When it is signed out by itself. #### `SessionDevice` `object` - `kind` (`string`, required, one of `"browser"`, `"app"`, `"unknown"`): `browser`, `app` for the Nextmail phone app, or `unknown`. - `browser` (`string`, required, nullable): Such as `Chrome`. - `os` (`string`, required, nullable): Such as `macOS` or `iOS`. - `name` (`string`, required, nullable): The name of the phone, when the phone app reported one. - `appVersion` (`string`, required, nullable) #### `SessionList` `object` - `object` (`string`, one of `"list"`) - `data` (`Session[]`) #### `SessionSweep` `object` - `object` (`string`, required, one of `"session_sweep"`) - `sessionsRevoked` (`integer`, required, at least 0) - `appsRevoked` (`integer`, required, at least 0) #### `Username` `object` - `object` (`string`, required, one of `"username"`) - `username` (`string`, required, nullable) - `chosen` (`boolean`, required): Whether the person chose it. A chosen username never changes. - `address` (`string`, required, nullable): The free address that comes with the username, or null when there is none. #### `UsernameAvailability` `object` - `object` (`string`, required, one of `"username_availability"`) - `username` (`string`, required): The username as it was checked. - `status` (`string`, required, one of `"available"`, `"current"`, `"taken"`, `"reserved"`, `"invalid"`, `"too_short"`, `"too_long"`): `current` when it is the username the person already has. - `available` (`boolean`, required) - `message` (`string`, required)