Every command
All 593, one row each, with the endpoint each resource command calls.
Every command
There are 593 commands, each on its own row in the order openemail --help lists them. 46 are written by hand for people: they ask for what is missing, format what they print and combine several API calls where that helps, so their row names no single endpoint. The other 547 are the resource commands, openemail <namespace> <verb> across 53 namespaces, and each one calls the endpoint its row names.
The resource commands are not written one by one. The CLI reads the SDK's method manifest, which describes every method with its parameters, endpoint and scopes, and turns each method into a verb named after the namespace and the method in kebab case, so domains.createAddress is openemail domains create-address. A list and the listAll and iterate that walk it become one list verb with --all and --max, which is why there are fewer commands than SDK methods.
The package's parity check proves it before every release. For every SDK method it builds the command line three ways, with the required values only, with them in a --data file, and with every flag set, runs the command against a recording fetch, and fails when a method has no command or when a command sends anything other than the method, path, query, body and credential the manifest names. It then runs the same command lines through the real parser and dispatcher, and fails on any request that differs from the direct call.
Each row shows the first usage line of its command. openemail <command> --help shows the rest: every argument and flag with what it takes, and examples, and for a resource command its scopes, its endpoint, what it returns and the notes from the API reference. Add --json for the same page as one JSON document, and openemail --help --json prints every command, argument and flag at once. Every command also takes the global flags, --json, --yes, --dry-run, --profile, --api-key, --base-url, --no-input, --no-color and --debug, so no row repeats them.
Scope names what every run of the command needs. With a saved sign-in the CLI checks it before the command does anything, and a missing scope stops it with exit code 4. api and mcp call name none, because what they need depends on the endpoint or the tool you call, and the server checks that. The temp-mail rows that say "inbox token" send the oe_inbox_ token that temp-mail create or temp-mail extend returned, which the CLI saves, and --inbox-token passes one it did not create.
6 commands need a browser sign-in, the kind openemail login saves when you choose the browser: ai compose, ai summarize, mcp tools, mcp call, mcp serve and verify. The AI and MCP ones run on the MCP server, which accepts no API key, and verify enters the verification codes that only a browser sign-in is asked for.
19 hand-written commands need no sign-in at all: login, temp new, temp list, temp read, temp watch, temp delete, mcp config, docs ask, docs open, docs read, agents, logout, profile list, profile use, profile remove, profile current, open, update and completion. Neither do the temp-mail rows. ai languages works signed in or not.
108 commands are destructive, such as deleting, revoking, rotating, cancelling or emptying, so they ask you to confirm first and stop with exit code 2 when nobody can answer. --yes confirms for you, and --dry-run runs the reads and prints the request that would change something instead of sending it.
openemail --help leaves out a few commands, and so does this table. help is the long form of --help, version prints the CLI, SDK and runtime versions, and verify covers the security verbs.