---
title: "$client->account"
description: "Every method in this namespace: its signature, its parameters, what it returns and an example."
url: "https://nextmail.sh/docs/php/reference/account"
area: "PHP"
category: "Reference"
---

# $client->account

Every method in this namespace: its signature, its parameters, what it returns and an example.

## Methods

The account of the person behind the key or the app: the email notifications they get and the workspaces muted on their phone, their profile photo and username, the apps they connected, the invitations waiting for them, the devices they are signed in on, their passkeys and their security log. An API key acts for the workspace owner, and an app for the person who connected it.

### `account->getNotifications`

Read your notification settings

```php
getNotifications(?string $apiKey = null): array
```

Returns which kinds of email Nextmail sends the person, as Account, Notifications shows them, and the workspaces whose notifications are muted on their phone. An API key answers for the workspace owner, and an app for the person who connected it.

Scopes: `account:read`.

**Parameters**

- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with `email`, a list with one array for each kind of email (`category`, `label`, `description`, `required` and `enabled`), and `mutedWorkspaces`, a list of workspace ids.

**Example**

```php
$settings = $client->account->getNotifications();

foreach ($settings['email'] as $setting) {
    echo $setting['category'], ': ', $setting['enabled'] ? 'on' : 'off', $setting['required'] ? ', always on' : '', PHP_EOL;
}

echo count($settings['mutedWorkspaces']), ' workspaces muted on the phone', PHP_EOL;
```

**Notes**

- `account` and `billing` email are always on, and `required` says so.

Also available in: API [`GET /account/notifications`](https://nextmail.sh/docs/api/reference/your-account#get-account-notifications); TypeScript [`nextmail.account.getNotifications()`](https://nextmail.sh/docs/sdk/reference/account#getNotifications); Python [`account.get_notifications()`](https://nextmail.sh/docs/python/reference/account#getNotifications); Ruby [`account.get_notifications`](https://nextmail.sh/docs/ruby/reference/account#getNotifications); Go [`Account.GetNotifications`](https://nextmail.sh/docs/go/reference/account#getNotifications); Java [`account().getNotifications`](https://nextmail.sh/docs/java/reference/account#getNotifications); C# [`Account.GetNotificationsAsync`](https://nextmail.sh/docs/csharp/reference/account#getNotifications); CLI [`nextmail account get-notifications`](https://nextmail.sh/docs/cli/reference/account#account-get-notifications).

### `account->setEmailNotification`

Turn a kind of email on or off

```php
setEmailNotification(string $category, array $body, ?string $apiKey = null): array
```

`'enabled' => false` stops Nextmail sending the person that kind of email, and `true` starts it again. `activity` and `product` can be turned off. `account` and `billing` cannot, and asking to is a 422 `invalid_parameter` on `category`.

Scopes: `account:write`.

**Parameters**

- `category` (`string`, required): `account`, `billing`, `activity` or `product`, also in `Nextmail\Constants\EmailNotificationCategories`.
- `enabled` (`bool`, required): True to receive that email, false to stop it.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

The same array as `account->getNotifications`, as it is after the change.

**Example**

```php
use Nextmail\Constants\EmailNotificationCategories;

$settings = $client->account->setEmailNotification(EmailNotificationCategories::PRODUCT, ['enabled' => false]);

foreach ($settings['email'] as $setting) {
    echo $setting['label'], ': ', $setting['enabled'] ? 'on' : 'off', PHP_EOL;
}
```

**Notes**

- Retried automatically on network failure, since the same setting sent twice changes nothing.

Also available in: API [`PUT /account/notifications/email/{category}`](https://nextmail.sh/docs/api/reference/your-account#put-account-notifications-email-category); TypeScript [`nextmail.account.setEmailNotification()`](https://nextmail.sh/docs/sdk/reference/account#setEmailNotification); Python [`account.set_email_notification()`](https://nextmail.sh/docs/python/reference/account#setEmailNotification); Ruby [`account.set_email_notification`](https://nextmail.sh/docs/ruby/reference/account#setEmailNotification); Go [`Account.SetEmailNotification`](https://nextmail.sh/docs/go/reference/account#setEmailNotification); Java [`account().setEmailNotification`](https://nextmail.sh/docs/java/reference/account#setEmailNotification); C# [`Account.SetEmailNotificationAsync`](https://nextmail.sh/docs/csharp/reference/account#setEmailNotification); CLI [`nextmail account set-email-notification`](https://nextmail.sh/docs/cli/reference/account#account-set-email-notification).

### `account->setPushMuted`

Mute a workspace on your phone

```php
setPushMuted(string $workspaceId, array $body, ?string $apiKey = null): array
```

`'muted' => true` stops the phone app notifying the person about the mail of one workspace, on every phone they signed in on, and `false` lets it notify them again.

Scopes: `account:write`.

**Parameters**

- `workspaceId` (`string`, required): A workspace id from `workspaces->list`.
- `muted` (`bool`, required): True to mute it, false to let it notify again.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

The same array as `account->getNotifications`, with the new `mutedWorkspaces`.

**Example**

```php
$settings = $client->account->setPushMuted('10417196-e324-4283-af98-66ec62167c47', ['muted' => true]);

echo 'Muted on the phone: ', implode(', ', $settings['mutedWorkspaces']), PHP_EOL;
```

**Notes**

- A workspace the person cannot open is a 404 `resource_not_found`.
- Retried automatically on network failure, since the same setting sent twice changes nothing.

Also available in: API [`PUT /account/notifications/push/{workspaceId}`](https://nextmail.sh/docs/api/reference/your-account#put-account-notifications-push-workspaceid); TypeScript [`nextmail.account.setPushMuted()`](https://nextmail.sh/docs/sdk/reference/account#setPushMuted); Python [`account.set_push_muted()`](https://nextmail.sh/docs/python/reference/account#setPushMuted); Ruby [`account.set_push_muted`](https://nextmail.sh/docs/ruby/reference/account#setPushMuted); Go [`Account.SetPushMuted`](https://nextmail.sh/docs/go/reference/account#setPushMuted); Java [`account().setPushMuted`](https://nextmail.sh/docs/java/reference/account#setPushMuted); C# [`Account.SetPushMutedAsync`](https://nextmail.sh/docs/csharp/reference/account#setPushMuted); CLI [`nextmail account set-push-muted`](https://nextmail.sh/docs/cli/reference/account#account-set-push-muted).

### `account->setPhoto`

Set your profile photo

```php
setPhoto(mixed $data, ?string $contentType = null, ?string $apiKey = null): array
```

Sends the image bytes as the request body, replacing the person's profile photo, as Account, Profile does. PNG, JPEG, WebP and GIF are accepted, up to 5 MB. The server fits the image into a 512 pixel square, stores it as WebP and keeps the first frame of an animation.

`data` is a string of bytes, a stream resource, an `SplFileInfo` or a PSR-7 stream or uploaded file. The type is read from `contentType:`, or when that is left out from the media type a PSR-7 uploaded file declares, or from the extension of the file an `SplFileInfo` or a stream points at. Without any of these the bytes go as `application/octet-stream` and the server refuses them with 422 `invalid_image`.

Scopes: `account:write`.

**Parameters**

- `data` (`string|resource|SplFileInfo|StreamInterface`, required): The image: a string of bytes, a stream resource, an `SplFileInfo` or a PSR-7 stream or uploaded file.
- `contentType` (`string`): `image/png`, `image/jpeg`, `image/webp` or `image/gif`. Required for a string of bytes, and for a file or stream whose name does not end in `.png`, `.jpg`, `.jpeg`, `.webp` or `.gif`.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with the new `url`.

**Example**

```php
$photo = $client->account->setPhoto(file_get_contents('photo.jpg'), contentType: 'image/jpeg');

echo 'New photo at ', $photo['url'], PHP_EOL;

$photo = $client->account->setPhoto(new \SplFileInfo('avatar.png'));

echo 'Replaced by ', $photo['url'], PHP_EOL;
```

**Notes**

- A busy image service answers 503 `image_busy`, which the SDK retries like any other 503.
- Every upload gets a new URL, so a cached old photo never shows under the new one.

Also available in: API [`PUT /account/photo`](https://nextmail.sh/docs/api/reference/your-account#put-account-photo); TypeScript [`nextmail.account.setPhoto()`](https://nextmail.sh/docs/sdk/reference/account#setPhoto); Python [`account.set_photo()`](https://nextmail.sh/docs/python/reference/account#setPhoto); Ruby [`account.set_photo`](https://nextmail.sh/docs/ruby/reference/account#setPhoto); Go [`Account.SetPhoto`](https://nextmail.sh/docs/go/reference/account#setPhoto); Java [`account().setPhoto`](https://nextmail.sh/docs/java/reference/account#setPhoto); C# [`Account.SetPhotoAsync`](https://nextmail.sh/docs/csharp/reference/account#setPhoto); CLI [`nextmail account set-photo`](https://nextmail.sh/docs/cli/reference/account#account-set-photo).

### `account->removePhoto`

Remove your profile photo

```php
removePhoto(?string $apiKey = null): array
```

Removes the profile photo and deletes the stored image, so the app shows the person's initials again. Removing it when there is none changes nothing.

Scopes: `account:write`.

**Parameters**

- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with `url` null.

**Example**

```php
$photo = $client->account->removePhoto();

echo $photo['url'] ?? 'No photo, the app shows initials', PHP_EOL;
```

**Notes**

- Safe to replay, so the SDK retries it after a network failure.

Also available in: API [`DELETE /account/photo`](https://nextmail.sh/docs/api/reference/your-account#delete-account-photo); TypeScript [`nextmail.account.removePhoto()`](https://nextmail.sh/docs/sdk/reference/account#removePhoto); Python [`account.remove_photo()`](https://nextmail.sh/docs/python/reference/account#removePhoto); Ruby [`account.remove_photo`](https://nextmail.sh/docs/ruby/reference/account#removePhoto); Go [`Account.RemovePhoto`](https://nextmail.sh/docs/go/reference/account#removePhoto); Java [`account().removePhoto`](https://nextmail.sh/docs/java/reference/account#removePhoto); C# [`Account.RemovePhotoAsync`](https://nextmail.sh/docs/csharp/reference/account#removePhoto); CLI [`nextmail account remove-photo`](https://nextmail.sh/docs/cli/reference/account#account-remove-photo).

### `account->getUsername`

Read your username

```php
getUsername(?string $apiKey = null): array
```

Returns the person's username, whether they chose it or it was made for them from their name, and the free address that comes with it, when there is one. A username the person chose never changes.

Scopes: `account:read`.

**Parameters**

- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with `username`, `chosen` and `address`.

**Example**

```php
$username = $client->account->getUsername();

echo $username['username'], $username['chosen'] ? ', chosen' : ', made from the name', PHP_EOL;

if ($username['address'] !== null) {
    echo 'Free address: ', $username['address'], PHP_EOL;
}
```

**Notes**

- The first read makes a username for an account that has none.

Also available in: API [`GET /account/username`](https://nextmail.sh/docs/api/reference/your-account#get-account-username); TypeScript [`nextmail.account.getUsername()`](https://nextmail.sh/docs/sdk/reference/account#getUsername); Python [`account.get_username()`](https://nextmail.sh/docs/python/reference/account#getUsername); Ruby [`account.get_username`](https://nextmail.sh/docs/ruby/reference/account#getUsername); Go [`Account.GetUsername`](https://nextmail.sh/docs/go/reference/account#getUsername); Java [`account().getUsername`](https://nextmail.sh/docs/java/reference/account#getUsername); C# [`Account.GetUsernameAsync`](https://nextmail.sh/docs/csharp/reference/account#getUsername); CLI [`nextmail account get-username`](https://nextmail.sh/docs/cli/reference/account#account-get-username).

### `account->checkUsername`

Check a username

```php
checkUsername(string $username, ?string $apiKey = null): array
```

Says whether the person could choose a username, without choosing it, and why not when they could not. The username is lowercased and its spaces become dots before it is checked, as the app does, and `username` in the answer is the form that was checked.

Scopes: `account:read`.

**Parameters**

- `username` (`string`, required): Up to 60 characters before it is tidied.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with `username`, `status`, `available` and a `message` that says why.

**Example**

```php
use Nextmail\Constants\UsernameStatuses;

$check = $client->account->checkUsername('Ada Lovelace');

if ($check['available']) {
    echo $check['username'], ' is free', PHP_EOL;
} elseif ($check['status'] === UsernameStatuses::CURRENT) {
    echo 'That is already your username', PHP_EOL;
} else {
    echo $check['message'], PHP_EOL;
}
```

**Notes**

- `status` is `current` for the username the person already has, and `available` is false for it.

Also available in: API [`GET /account/username/availability`](https://nextmail.sh/docs/api/reference/your-account#get-account-username-availability); TypeScript [`nextmail.account.checkUsername()`](https://nextmail.sh/docs/sdk/reference/account#checkUsername); Python [`account.check_username()`](https://nextmail.sh/docs/python/reference/account#checkUsername); Ruby [`account.check_username`](https://nextmail.sh/docs/ruby/reference/account#checkUsername); Go [`Account.CheckUsername`](https://nextmail.sh/docs/go/reference/account#checkUsername); Java [`account().checkUsername`](https://nextmail.sh/docs/java/reference/account#checkUsername); C# [`Account.CheckUsernameAsync`](https://nextmail.sh/docs/csharp/reference/account#checkUsername); CLI [`nextmail account check-username`](https://nextmail.sh/docs/cli/reference/account#account-check-username).

### `account->setUsername`

Choose your username

```php
setUsername(string $username, ?string $apiKey = null): array
```

Sets the person's username for good, and with it their free address. Once chosen it never changes: a second choice is refused with 409 `username_locked`. A username another account has is a 409 `username_taken`, and one that is too short, too long, reserved or not lowercase letters, numbers and single dots is a 422 `invalid_parameter` on `username`. Check one first with `account->checkUsername`.

Scopes: `account:write`.

**Parameters**

- `username` (`string`, required): 3 to 30 lowercase letters, numbers and single dots once it is tidied.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with `username`, `chosen` set to true and `address`.

**Example**

```php
use Nextmail\Exception\ConflictException;

try {
    $username = $client->account->setUsername('ada.lovelace');

    echo 'You are ', $username['username'], ', with the address ', $username['address'] ?? 'none', PHP_EOL;
} catch (ConflictException $error) {
    echo $error->errorCode === 'username_locked' ? 'Your username is already chosen' : 'That username is taken', PHP_EOL;
}
```

**Notes**

- Not retried automatically: a retry after a lost response would be refused with `username_locked`, because the first call already chose it.

Also available in: API [`PUT /account/username`](https://nextmail.sh/docs/api/reference/your-account#put-account-username); TypeScript [`nextmail.account.setUsername()`](https://nextmail.sh/docs/sdk/reference/account#setUsername); Python [`account.set_username()`](https://nextmail.sh/docs/python/reference/account#setUsername); Ruby [`account.set_username`](https://nextmail.sh/docs/ruby/reference/account#setUsername); Go [`Account.SetUsername`](https://nextmail.sh/docs/go/reference/account#setUsername); Java [`account().setUsername`](https://nextmail.sh/docs/java/reference/account#setUsername); C# [`Account.SetUsernameAsync`](https://nextmail.sh/docs/csharp/reference/account#setUsername); CLI [`nextmail account set-username`](https://nextmail.sh/docs/cli/reference/account#account-set-username).

### `account->listConnectedApps`

List your connected apps

```php
listConnectedApps(?string $apiKey = null): array
```

Returns every app the person connected with OAuth, as Account, Connected apps lists them: the workspace and the permissions each may reach, until when, how many tokens it holds, and until when it may make changes that ask for a verification code without one. `current` marks the app making the call.

What an app may reach is changed in the app, never through an app.

Scopes: `account:read`.

**Parameters**

- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

A list of arrays, each with `clientId`, `name`, `kind`, `status`, `current`, `grant`, `tokenCount` and `elevatedUntil`.

**Example**

```php
foreach ($client->account->listConnectedApps() as $app) {
    echo $app['name'], $app['current'] ? ' (this app)' : '', ': ', $app['status'], ', ', $app['tokenCount'], ' tokens', PHP_EOL;
    echo '  reaches ', $app['grant']['workspaceName'] ?? 'nothing', ' until ', $app['accessUntil'] ?? 'it is removed', PHP_EOL;
}
```

**Notes**

- A sign-in of the command line tool shows with `kind` set to `cli`, and its device in `cliDevice`.

Also available in: API [`GET /account/connected-apps`](https://nextmail.sh/docs/api/reference/your-account#get-account-connected-apps); TypeScript [`nextmail.account.listConnectedApps()`](https://nextmail.sh/docs/sdk/reference/account#listConnectedApps); Python [`account.list_connected_apps()`](https://nextmail.sh/docs/python/reference/account#listConnectedApps); Ruby [`account.list_connected_apps`](https://nextmail.sh/docs/ruby/reference/account#listConnectedApps); Go [`Account.ListConnectedApps`](https://nextmail.sh/docs/go/reference/account#listConnectedApps); Java [`account().listConnectedApps`](https://nextmail.sh/docs/java/reference/account#listConnectedApps); C# [`Account.ListConnectedAppsAsync`](https://nextmail.sh/docs/csharp/reference/account#listConnectedApps); CLI [`nextmail account list-connected-apps`](https://nextmail.sh/docs/cli/reference/account#account-list-connected-apps).

### `account->listConnectedAppRequests`

Read the request log of a connected app

```php
listConnectedAppRequests(
    string $clientId,
    ?bool $failedOnly = null,
    array|string|null $statuses = null,
    DateTimeInterface|string|null $since = null,
    DateTimeInterface|string|null $until = null,
    ?int $limit = null,
    ?string $cursor = null,
    ?string $apiKey = null,
): Page
```

Returns one page of the REST calls an app the person connected made with the access they gave it, newest first, as Request log in the menu of the app under Account, Connected apps shows them. Each call has its method, path, status, how long it took and the error code of a refusal, and never a body, a query string or the address it came from. The command line tool signed in from a browser is in it too. Calls made under an earlier connection of the same app are not: connecting it again starts a new log. `failedOnly:`, `statuses:`, `since:` and `until:` narrow it, and they combine.

Scopes: `account:read`.

**Parameters**

- `clientId` (`string`, required): The app's `clientId` from `account->listConnectedApps`.
- `failedOnly` (`bool`): Only calls answered with a status of 400 or more.
- `statuses` (`string|int[]`): Only calls answered with one of these HTTP status codes, such as `[401, 403]`, as an array or one comma-separated string. At most 20, each from 100 to 599, sent comma-separated as `status`.
- `since` (`string|DateTimeInterface`): Only calls at or after this instant. A `DateTimeInterface` is sent as ISO 8601 in UTC, and a string must already be ISO 8601.
- `until` (`string|DateTimeInterface`): Only calls before this instant. It has to be later than `since`, or the server answers 400 `invalid_parameter`.
- `limit` (`int`): Calls per page, a whole number from 1 to 100. The server defaults to 25.
- `cursor` (`string`): The `nextCursor` of the previous page, passed back unchanged. Leave it out for the first page.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

A `Page` of arrays with `items`, `hasMore` and `nextCursor`. Each item has `id`, `clientId`, `workspaceId`, `requestId`, `method`, `path`, `status`, `errorCode`, `durationMs`, `userAgent` and `createdAt`.

**Example**

```php
$page = $client->account->listConnectedAppRequests('kZ3mQ9vT2xR7pL4wN8bY1cF6hJ5sD0aE', failedOnly: true, limit: 50);

foreach ($page as $call) {
    echo $call['createdAt'], ' ', $call['method'], ' ', $call['path'], ' ', $call['status'], ' ', $call['errorCode'] ?? '', PHP_EOL;
}
```

**Notes**

- An app the person never connected is a 404 `resource_not_found`, and a cursor this log did not hand out is a 400 `invalid_cursor`.
- Calls made with an API key are in the request log of that key, `keys->listRequests`, not here.

Also available in: API [`GET /account/connected-apps/{clientId}/requests`](https://nextmail.sh/docs/api/reference/your-account#get-account-connected-apps-clientid-requests); TypeScript [`nextmail.account.listConnectedAppRequests()`](https://nextmail.sh/docs/sdk/reference/account#listConnectedAppRequests); Python [`account.list_connected_app_requests()`](https://nextmail.sh/docs/python/reference/account#listConnectedAppRequests); Ruby [`account.list_connected_app_requests`](https://nextmail.sh/docs/ruby/reference/account#listConnectedAppRequests); Go [`Account.ListConnectedAppRequests`](https://nextmail.sh/docs/go/reference/account#listConnectedAppRequests); Java [`account().listConnectedAppRequests`](https://nextmail.sh/docs/java/reference/account#listConnectedAppRequests); C# [`Account.ListConnectedAppRequestsAsync`](https://nextmail.sh/docs/csharp/reference/account#listConnectedAppRequests); CLI [`nextmail account list-connected-app-requests`](https://nextmail.sh/docs/cli/reference/account#account-list-connected-app-requests).

### `account->listAllConnectedAppRequests`

Collect the whole request log of a connected app into one array

```php
listAllConnectedAppRequests(
    string $clientId,
    ?bool $failedOnly = null,
    array|string|null $statuses = null,
    DateTimeInterface|string|null $since = null,
    DateTimeInterface|string|null $until = null,
    ?int $limit = null,
    ?string $cursor = null,
    ?string $apiKey = null,
): array
```

Walks every page of `account->listConnectedAppRequests` under the same filters. The log is never pruned, so give it a window unless you mean to read a busy app's whole history, or use `account->iterateConnectedAppRequests` to stop early.

Scopes: `account:read`.

**Parameters**

- `clientId` (`string`, required): The app's `clientId` from `account->listConnectedApps`.
- `failedOnly` (`bool`): Only calls answered with a status of 400 or more.
- `statuses` (`string|int[]`): Only calls answered with one of these HTTP status codes, such as `[401, 403]`, as an array or one comma-separated string. At most 20, each from 100 to 599, sent comma-separated as `status`.
- `since` (`string|DateTimeInterface`): Only calls at or after this instant. A `DateTimeInterface` is sent as ISO 8601 in UTC, and a string must already be ISO 8601.
- `until` (`string|DateTimeInterface`): Only calls before this instant. It has to be later than `since`, or the server answers 400 `invalid_parameter`.
- `limit` (`int`): Page size for each request, from 1 to 100. The server defaults to 25.
- `cursor` (`string`): Starts the walk from this cursor instead of the newest call.
- `apiKey` (`string`): Overrides the client API key for every page of this walk.

**Returns**

A list of arrays holding every call, newest first.

**Example**

```php
$today = $client->account->listAllConnectedAppRequests('kZ3mQ9vT2xR7pL4wN8bY1cF6hJ5sD0aE', since: new \DateTimeImmutable('-1 day'), limit: 100);

echo count($today), ' calls in the last day', PHP_EOL;
```

**Notes**

- If any page fails the call throws and the calls already fetched are discarded.

Also available in: API [`GET /account/connected-apps/{clientId}/requests`](https://nextmail.sh/docs/api/reference/your-account#get-account-connected-apps-clientid-requests); TypeScript [`nextmail.account.listAllConnectedAppRequests()`](https://nextmail.sh/docs/sdk/reference/account#listAllConnectedAppRequests); Python [`account.list_all_connected_app_requests()`](https://nextmail.sh/docs/python/reference/account#listAllConnectedAppRequests); Ruby [`account.list_all_connected_app_requests`](https://nextmail.sh/docs/ruby/reference/account#listAllConnectedAppRequests); Go [`Account.ListAllConnectedAppRequests`](https://nextmail.sh/docs/go/reference/account#listAllConnectedAppRequests); Java [`account().listAllConnectedAppRequests`](https://nextmail.sh/docs/java/reference/account#listAllConnectedAppRequests); C# [`Account.ListAllConnectedAppRequestsAsync`](https://nextmail.sh/docs/csharp/reference/account#listAllConnectedAppRequests).

### `account->iterateConnectedAppRequests`

Stream the request log of a connected app one call at a time

```php
iterateConnectedAppRequests(
    string $clientId,
    ?bool $failedOnly = null,
    array|string|null $statuses = null,
    DateTimeInterface|string|null $since = null,
    DateTimeInterface|string|null $until = null,
    ?int $limit = null,
    ?string $cursor = null,
    ?string $apiKey = null,
): Generator
```

A `Generator` over `account->listConnectedAppRequests` under the same filters, fetching a page only when the one before is drained. Nothing is fetched until you consume it.

Scopes: `account:read`.

**Parameters**

- `clientId` (`string`, required): The app's `clientId` from `account->listConnectedApps`.
- `failedOnly` (`bool`): Only calls answered with a status of 400 or more.
- `statuses` (`string|int[]`): Only calls answered with one of these HTTP status codes, such as `[401, 403]`, as an array or one comma-separated string. At most 20, each from 100 to 599, sent comma-separated as `status`.
- `since` (`string|DateTimeInterface`): Only calls at or after this instant. A `DateTimeInterface` is sent as ISO 8601 in UTC, and a string must already be ISO 8601.
- `until` (`string|DateTimeInterface`): Only calls before this instant. It has to be later than `since`, or the server answers 400 `invalid_parameter`.
- `limit` (`int`): Page size for each request, from 1 to 100. The server defaults to 25.
- `cursor` (`string`): Starts the walk from this cursor instead of the newest call.
- `apiKey` (`string`): Overrides the client API key for every page of this walk.

**Returns**

A `Generator` that yields one call array per step, newest first.

**Example**

```php
foreach ($client->account->iterateConnectedAppRequests('kZ3mQ9vT2xR7pL4wN8bY1cF6hJ5sD0aE', failedOnly: true) as $call) {
    echo 'Latest refused call at ', $call['createdAt'], ' to ', $call['path'], PHP_EOL;

    break;
}
```

**Notes**

- Breaking out of the loop stops the walk, and no further page is fetched.

Also available in: API [`GET /account/connected-apps/{clientId}/requests`](https://nextmail.sh/docs/api/reference/your-account#get-account-connected-apps-clientid-requests); TypeScript [`nextmail.account.iterateConnectedAppRequests()`](https://nextmail.sh/docs/sdk/reference/account#iterateConnectedAppRequests); Python [`account.iterate_connected_app_requests()`](https://nextmail.sh/docs/python/reference/account#iterateConnectedAppRequests); Ruby [`account.iterate_connected_app_requests`](https://nextmail.sh/docs/ruby/reference/account#iterateConnectedAppRequests); Go [`Account.IterateConnectedAppRequests`](https://nextmail.sh/docs/go/reference/account#iterateConnectedAppRequests); Java [`account().iterateConnectedAppRequests`](https://nextmail.sh/docs/java/reference/account#iterateConnectedAppRequests); C# [`Account.IterateConnectedAppRequestsAsync`](https://nextmail.sh/docs/csharp/reference/account#iterateConnectedAppRequests).

### `account->revokeConnectedApp`

Remove a connected app

```php
revokeConnectedApp(string $clientId, ?string $apiKey = null): array
```

Deletes every token the app holds and the access the person gave it, so its next call is refused and it has to ask again, as removing it in Account, Connected apps does. Removing the app making the call disconnects it.

Scopes: `account:write`.

**Parameters**

- `clientId` (`string`, required): The app's `clientId` from `account->listConnectedApps`.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with `clientId`, `revoked` set to true and `tokensRevoked`.

**Example**

```php
foreach ($client->account->listConnectedApps() as $app) {
    if ($app['tokenCount'] === 0 && !$app['current']) {
        $revoked = $client->account->revokeConnectedApp($app['clientId']);

        echo 'Removed ', $app['name'], ', ', $revoked['tokensRevoked'], ' tokens revoked', PHP_EOL;
    }
}
```

**Notes**

- An app the person never connected is a 404 `resource_not_found`.
- Not retried automatically. A retry after a lost response is a 404, since the app is already gone.

Also available in: API [`DELETE /account/connected-apps/{clientId}`](https://nextmail.sh/docs/api/reference/your-account#delete-account-connected-apps-clientid); TypeScript [`nextmail.account.revokeConnectedApp()`](https://nextmail.sh/docs/sdk/reference/account#revokeConnectedApp); Python [`account.revoke_connected_app()`](https://nextmail.sh/docs/python/reference/account#revokeConnectedApp); Ruby [`account.revoke_connected_app`](https://nextmail.sh/docs/ruby/reference/account#revokeConnectedApp); Go [`Account.RevokeConnectedApp`](https://nextmail.sh/docs/go/reference/account#revokeConnectedApp); Java [`account().revokeConnectedApp`](https://nextmail.sh/docs/java/reference/account#revokeConnectedApp); C# [`Account.RevokeConnectedAppAsync`](https://nextmail.sh/docs/csharp/reference/account#revokeConnectedApp); CLI [`nextmail account revoke-connected-app`](https://nextmail.sh/docs/cli/reference/account#account-revoke-connected-app).

### `account->listSessions`

List your signed-in devices

```php
listSessions(?string $apiKey = null): array
```

Returns every browser and phone the person is signed in on, as Account, Security lists them, most recently used first: the browser and system, the country and city it was last used from, how it signed in and when.

No address is ever recorded, only the place. A key or an app is not a signed-in device, so `current` is always false here.

Scopes: `account:read`.

**Parameters**

- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

A list of arrays, each with `id`, `current`, `device`, `authMethod`, `country`, `city`, `createdAt`, `lastActiveAt` and `expiresAt`. `device` is an array with `kind`, `browser`, `os`, `name` and `appVersion`.

**Example**

```php
foreach ($client->account->listSessions() as $session) {
    echo $session['device']['browser'] ?? $session['device']['os'] ?? 'Unknown device', ', ', $session['city'] ?? 'place unknown', PHP_EOL;
    echo '  signed in with ', $session['authMethod'] ?? 'an older sign-in', ', last used ', $session['lastActiveAt'], PHP_EOL;
}
```

**Notes**

- `lastActiveAt` is accurate to within ten minutes.
- `authMethod` is null for a device that signed in before it was recorded. Its values are in `Nextmail\Constants\SessionAuthMethods`, and the kinds of device in `Nextmail\Constants\SessionDeviceKinds`.

Also available in: API [`GET /account/sessions`](https://nextmail.sh/docs/api/reference/your-account#get-account-sessions); TypeScript [`nextmail.account.listSessions()`](https://nextmail.sh/docs/sdk/reference/account#listSessions); Python [`account.list_sessions()`](https://nextmail.sh/docs/python/reference/account#listSessions); Ruby [`account.list_sessions`](https://nextmail.sh/docs/ruby/reference/account#listSessions); Go [`Account.ListSessions`](https://nextmail.sh/docs/go/reference/account#listSessions); Java [`account().listSessions`](https://nextmail.sh/docs/java/reference/account#listSessions); C# [`Account.ListSessionsAsync`](https://nextmail.sh/docs/csharp/reference/account#listSessions); CLI [`nextmail account list-sessions`](https://nextmail.sh/docs/cli/reference/account#account-list-sessions).

### `account->revokeSession`

Sign out one device

```php
revokeSession(string $sessionId, ?string $apiKey = null): array
```

Signs one browser or phone out, as Sign out next to it in Account, Security does. Its next request is refused at once, and a phone stops getting notifications. It is written to the person's security log.

Scopes: `account:write`.

**Parameters**

- `sessionId` (`string`, required): The device's `id` from `account->listSessions`.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with the device `id` and `revoked` set to true.

**Example**

```php
use Nextmail\Constants\SessionDeviceKinds;

foreach ($client->account->listSessions() as $session) {
    if ($session['device']['kind'] === SessionDeviceKinds::BROWSER) {
        $client->account->revokeSession($session['id']);

        echo 'Signed out ', $session['device']['browser'] ?? 'a browser', ', last used ', $session['lastActiveAt'], PHP_EOL;
    }
}
```

**Notes**

- A device that is not signed in to the account is a 404 `resource_not_found`.
- Not retried automatically. A retry after a lost response is a 404, since the device is already signed out.

Also available in: API [`DELETE /account/sessions/{sessionId}`](https://nextmail.sh/docs/api/reference/your-account#delete-account-sessions-sessionid); TypeScript [`nextmail.account.revokeSession()`](https://nextmail.sh/docs/sdk/reference/account#revokeSession); Python [`account.revoke_session()`](https://nextmail.sh/docs/python/reference/account#revokeSession); Ruby [`account.revoke_session`](https://nextmail.sh/docs/ruby/reference/account#revokeSession); Go [`Account.RevokeSession`](https://nextmail.sh/docs/go/reference/account#revokeSession); Java [`account().revokeSession`](https://nextmail.sh/docs/java/reference/account#revokeSession); C# [`Account.RevokeSessionAsync`](https://nextmail.sh/docs/csharp/reference/account#revokeSession); CLI [`nextmail account revoke-session`](https://nextmail.sh/docs/cli/reference/account#account-revoke-session).

### `account->revokeSessions`

Sign out everywhere

```php
revokeSessions(?bool $connectedApps = null, ?string $apiKey = null): array
```

Signs the person out of every browser and phone at once, for when a device is lost or a password may have leaked. Each one is refused on its next request.

With `connectedApps: true` every connected app is removed as well, except the app making the call. A key or an app is not a signed-in device, so the call never ends its own access.

Scopes: `account:write`.

**Parameters**

- `connectedApps` (`bool`): True also removes every connected app, apart from the one making the call. Left out, apps stay.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with `sessionsRevoked` and `appsRevoked`.

**Example**

```php
$swept = $client->account->revokeSessions(connectedApps: true);

echo $swept['sessionsRevoked'], ' devices and ', $swept['appsRevoked'], ' apps signed out', PHP_EOL;
```

**Notes**

- Safe to repeat: a second call finds nothing left and answers zero for both counts.

Also available in: API [`DELETE /account/sessions`](https://nextmail.sh/docs/api/reference/your-account#delete-account-sessions); TypeScript [`nextmail.account.revokeSessions()`](https://nextmail.sh/docs/sdk/reference/account#revokeSessions); Python [`account.revoke_sessions()`](https://nextmail.sh/docs/python/reference/account#revokeSessions); Ruby [`account.revoke_sessions`](https://nextmail.sh/docs/ruby/reference/account#revokeSessions); Go [`Account.RevokeSessions`](https://nextmail.sh/docs/go/reference/account#revokeSessions); Java [`account().revokeSessions`](https://nextmail.sh/docs/java/reference/account#revokeSessions); C# [`Account.RevokeSessionsAsync`](https://nextmail.sh/docs/csharp/reference/account#revokeSessions); CLI [`nextmail account revoke-sessions`](https://nextmail.sh/docs/cli/reference/account#account-revoke-sessions).

### `account->listSecurityEvents`

Read your security log

```php
listSecurityEvents(?int $limit = null, ?string $cursor = null, ?string $apiKey = null): Page
```

Returns one page of what happened to the sign-in of the account, newest first: each sign-in with its device and place, devices signed out, password changes and resets, two-factor turned on or off, and passkeys added or removed. Nothing is ever removed from it.

Scopes: `account:read`.

**Parameters**

- `limit` (`int`): Page size, from 1 to 100. The server defaults to 25.
- `cursor` (`string`): The `nextCursor` of the previous page. Leave it out for the first page.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

A `Page` of arrays with `items`, `hasMore` and `nextCursor`. Each item has `kind`, `at`, `device`, `country`, `city`, `authMethod` and `detail`.

**Example**

```php
$page = $client->account->listSecurityEvents(limit: 50);

foreach ($page as $event) {
    echo $event['at'], ' ', $event['kind'], ' ', $event['city'] ?? '', PHP_EOL;
}

if ($page->hasMore) {
    $older = $client->account->listSecurityEvents(limit: 50, cursor: $page->nextCursor);

    echo count($older), ' older entries', PHP_EOL;
}
```

**Notes**

- The values of `kind` are in `Nextmail\Constants\SecurityEventKinds`.
- A sign-in from a device not seen before has `newDevice` set to true in `detail`, and the person is told by email.
- A cursor that names nothing in this list is 400 `invalid_cursor`.

Also available in: API [`GET /account/security-events`](https://nextmail.sh/docs/api/reference/your-account#get-account-security-events); TypeScript [`nextmail.account.listSecurityEvents()`](https://nextmail.sh/docs/sdk/reference/account#listSecurityEvents); Python [`account.list_security_events()`](https://nextmail.sh/docs/python/reference/account#listSecurityEvents); Ruby [`account.list_security_events`](https://nextmail.sh/docs/ruby/reference/account#listSecurityEvents); Go [`Account.ListSecurityEvents`](https://nextmail.sh/docs/go/reference/account#listSecurityEvents); Java [`account().listSecurityEvents`](https://nextmail.sh/docs/java/reference/account#listSecurityEvents); C# [`Account.ListSecurityEventsAsync`](https://nextmail.sh/docs/csharp/reference/account#listSecurityEvents); CLI [`nextmail account list-security-events`](https://nextmail.sh/docs/cli/reference/account#account-list-security-events).

### `account->listAllSecurityEvents`

Collect your whole security log into one array

```php
listAllSecurityEvents(?int $limit = null, ?string $cursor = null, ?string $apiKey = null): array
```

Walks every page of `account->listSecurityEvents` and returns the whole log. The log is never pruned, so use `account->iterateSecurityEvents` to stop early on an old account.

Scopes: `account:read`.

**Parameters**

- `limit` (`int`): Page size for each request, from 1 to 100. The server defaults to 25.
- `cursor` (`string`): Starts the walk from this cursor instead of the newest entry.
- `apiKey` (`string`): Overrides the client API key for every page of this walk.

**Returns**

A list of arrays holding every entry, newest first.

**Example**

```php
use Nextmail\Constants\SecurityEventKinds;

$events = $client->account->listAllSecurityEvents(limit: 100);
$signIns = array_filter($events, static fn(array $event): bool => $event['kind'] === SecurityEventKinds::SIGN_IN);

echo count($signIns), ' sign-ins on record', PHP_EOL;
```

**Notes**

- If any page fails the call throws and the entries already fetched are discarded.

Also available in: API [`GET /account/security-events`](https://nextmail.sh/docs/api/reference/your-account#get-account-security-events); TypeScript [`nextmail.account.listAllSecurityEvents()`](https://nextmail.sh/docs/sdk/reference/account#listAllSecurityEvents); Python [`account.list_all_security_events()`](https://nextmail.sh/docs/python/reference/account#listAllSecurityEvents); Ruby [`account.list_all_security_events`](https://nextmail.sh/docs/ruby/reference/account#listAllSecurityEvents); Go [`Account.ListAllSecurityEvents`](https://nextmail.sh/docs/go/reference/account#listAllSecurityEvents); Java [`account().listAllSecurityEvents`](https://nextmail.sh/docs/java/reference/account#listAllSecurityEvents); C# [`Account.ListAllSecurityEventsAsync`](https://nextmail.sh/docs/csharp/reference/account#listAllSecurityEvents).

### `account->iterateSecurityEvents`

Stream your security log one entry at a time

```php
iterateSecurityEvents(?int $limit = null, ?string $cursor = null, ?string $apiKey = null): Generator
```

A `Generator` over `account->listSecurityEvents`, fetching a page only when the one before is drained. Nothing is fetched until you consume it.

Scopes: `account:read`.

**Parameters**

- `limit` (`int`): Page size for each request, from 1 to 100. The server defaults to 25.
- `cursor` (`string`): Starts the walk from this cursor instead of the newest entry.
- `apiKey` (`string`): Overrides the client API key for every page of this walk.

**Returns**

A `Generator` that yields one entry array per step, newest first.

**Example**

```php
use Nextmail\Constants\SecurityEventKinds;

foreach ($client->account->iterateSecurityEvents() as $event) {
    if ($event['kind'] === SecurityEventKinds::PASSWORD_CHANGED) {
        echo 'Password last changed ', $event['at'], PHP_EOL;

        break;
    }
}
```

**Notes**

- Breaking out of the loop stops the walk, and no further page is fetched.

Also available in: API [`GET /account/security-events`](https://nextmail.sh/docs/api/reference/your-account#get-account-security-events); TypeScript [`nextmail.account.iterateSecurityEvents()`](https://nextmail.sh/docs/sdk/reference/account#iterateSecurityEvents); Python [`account.iterate_security_events()`](https://nextmail.sh/docs/python/reference/account#iterateSecurityEvents); Ruby [`account.iterate_security_events`](https://nextmail.sh/docs/ruby/reference/account#iterateSecurityEvents); Go [`Account.IterateSecurityEvents`](https://nextmail.sh/docs/go/reference/account#iterateSecurityEvents); Java [`account().iterateSecurityEvents`](https://nextmail.sh/docs/java/reference/account#iterateSecurityEvents); C# [`Account.IterateSecurityEventsAsync`](https://nextmail.sh/docs/csharp/reference/account#iterateSecurityEvents).

### `account->listPasskeys`

List your passkeys

```php
listPasskeys(?string $apiKey = null): array
```

Returns the passkeys that can sign in to the account, oldest first, each with its name, whether it is synced between the person's devices and when it was last used.

A passkey is added on the device that holds it, in Account, Security, never through the API.

Scopes: `account:read`.

**Parameters**

- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

A list of arrays, each with `id`, `name`, `synced`, `transports`, `createdAt` and `lastUsedAt`.

**Example**

```php
foreach ($client->account->listPasskeys() as $passkey) {
    echo $passkey['name'], $passkey['synced'] ? ', synced' : ', on one device', ', last used ', $passkey['lastUsedAt'] ?? 'never', PHP_EOL;
}
```

**Notes**

- The key itself is never returned, only its name and when it was used.
- The values of `transports` are in `Nextmail\Constants\PasskeyTransports`.

Also available in: API [`GET /account/passkeys`](https://nextmail.sh/docs/api/reference/your-account#get-account-passkeys); TypeScript [`nextmail.account.listPasskeys()`](https://nextmail.sh/docs/sdk/reference/account#listPasskeys); Python [`account.list_passkeys()`](https://nextmail.sh/docs/python/reference/account#listPasskeys); Ruby [`account.list_passkeys`](https://nextmail.sh/docs/ruby/reference/account#listPasskeys); Go [`Account.ListPasskeys`](https://nextmail.sh/docs/go/reference/account#listPasskeys); Java [`account().listPasskeys`](https://nextmail.sh/docs/java/reference/account#listPasskeys); C# [`Account.ListPasskeysAsync`](https://nextmail.sh/docs/csharp/reference/account#listPasskeys); CLI [`nextmail account list-passkeys`](https://nextmail.sh/docs/cli/reference/account#account-list-passkeys).

### `account->renamePasskey`

Rename a passkey

```php
renamePasskey(string $passkeyId, string $name, ?string $apiKey = null): array
```

Gives a passkey a name the person will recognise, such as the device that holds it.

Scopes: `account:write`.

**Parameters**

- `passkeyId` (`string`, required): The passkey's `id` from `account->listPasskeys`.
- `name` (`string`, required): The new name, 1 to 60 characters.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with the passkey as `account->listPasskeys` returns it, under its new `name`.

**Example**

```php
$passkey = $client->account->listPasskeys()[0] ?? null;

if ($passkey !== null) {
    $renamed = $client->account->renamePasskey($passkey['id'], 'Work laptop');

    echo 'Now called ', $renamed['name'], PHP_EOL;
}
```

**Notes**

- A passkey that is not on the account is a 404 `resource_not_found`.
- A name that is empty or longer than 60 characters is a 422 `invalid_parameter`.
- Retried automatically on network failure, since the same name sent twice changes nothing.

Also available in: API [`PATCH /account/passkeys/{passkeyId}`](https://nextmail.sh/docs/api/reference/your-account#patch-account-passkeys-passkeyid); TypeScript [`nextmail.account.renamePasskey()`](https://nextmail.sh/docs/sdk/reference/account#renamePasskey); Python [`account.rename_passkey()`](https://nextmail.sh/docs/python/reference/account#renamePasskey); Ruby [`account.rename_passkey`](https://nextmail.sh/docs/ruby/reference/account#renamePasskey); Go [`Account.RenamePasskey`](https://nextmail.sh/docs/go/reference/account#renamePasskey); Java [`account().renamePasskey`](https://nextmail.sh/docs/java/reference/account#renamePasskey); C# [`Account.RenamePasskeyAsync`](https://nextmail.sh/docs/csharp/reference/account#renamePasskey); CLI [`nextmail account rename-passkey`](https://nextmail.sh/docs/cli/reference/account#account-rename-passkey).

### `account->removePasskey`

Remove a passkey

```php
removePasskey(string $passkeyId, ?string $apiKey = null): array
```

Removes a passkey, so it can no longer sign in or confirm a change. The person is told by email, and it is written to their security log. The passkey stays on the device until they delete it there.

Scopes: `account:write`.

**Parameters**

- `passkeyId` (`string`, required): The passkey's `id` from `account->listPasskeys`.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with the passkey `id` and `removed` set to true.

**Example**

```php
use Nextmail\Exception\NotFoundException;

try {
    $removed = $client->account->removePasskey('pk_2b6f0c1e-7a54-4d0b-9c3e-8f1a5d2e4b70');

    echo 'Removed ', $removed['id'], ', it can no longer sign in', PHP_EOL;
} catch (NotFoundException) {
    echo 'That passkey is not on the account', PHP_EOL;
}
```

**Notes**

- A passkey that is not on the account is a 404 `resource_not_found`.
- Not retried automatically. A retry after a lost response is a 404, since the passkey is already gone.

Also available in: API [`DELETE /account/passkeys/{passkeyId}`](https://nextmail.sh/docs/api/reference/your-account#delete-account-passkeys-passkeyid); TypeScript [`nextmail.account.removePasskey()`](https://nextmail.sh/docs/sdk/reference/account#removePasskey); Python [`account.remove_passkey()`](https://nextmail.sh/docs/python/reference/account#removePasskey); Ruby [`account.remove_passkey`](https://nextmail.sh/docs/ruby/reference/account#removePasskey); Go [`Account.RemovePasskey`](https://nextmail.sh/docs/go/reference/account#removePasskey); Java [`account().removePasskey`](https://nextmail.sh/docs/java/reference/account#removePasskey); C# [`Account.RemovePasskeyAsync`](https://nextmail.sh/docs/csharp/reference/account#removePasskey); CLI [`nextmail account remove-passkey`](https://nextmail.sh/docs/cli/reference/account#account-remove-passkey).

### `account->listInvitations`

List your invitations

```php
listInvitations(?string $apiKey = null): array
```

Returns the invitations to join a workspace that are waiting for the address the person signs in with, oldest first. Expired, accepted and withdrawn ones are left out. The invitations a workspace sent are `members->listInvitations` instead.

Scopes: `account:read`.

**Parameters**

- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

A list of arrays, each with `id`, `workspaceId`, `workspaceName`, `roleName`, `inviterName`, `addresses`, `expiresAt` and `createdAt`.

**Example**

```php
foreach ($client->account->listInvitations() as $invitation) {
    echo $invitation['inviterName'], ' invited you to ', $invitation['workspaceName'], ' as ', $invitation['roleName'], PHP_EOL;
    echo '  ', $invitation['addresses'], ' addresses, answer by ', $invitation['expiresAt'], PHP_EOL;
}
```

**Notes**

- `addresses` counts the addresses and the whole domains the invitation gives together.

Also available in: API [`GET /account/invitations`](https://nextmail.sh/docs/api/reference/your-account#get-account-invitations); TypeScript [`nextmail.account.listInvitations()`](https://nextmail.sh/docs/sdk/reference/account#listInvitations); Python [`account.list_invitations()`](https://nextmail.sh/docs/python/reference/account#listInvitations); Ruby [`account.list_invitations`](https://nextmail.sh/docs/ruby/reference/account#listInvitations); Go [`Account.ListInvitations`](https://nextmail.sh/docs/go/reference/account#listInvitations); Java [`account().listInvitations`](https://nextmail.sh/docs/java/reference/account#listInvitations); C# [`Account.ListInvitationsAsync`](https://nextmail.sh/docs/csharp/reference/account#listInvitations); CLI [`nextmail account list-invitations`](https://nextmail.sh/docs/cli/reference/account#account-list-invitations).

### `account->acceptInvitation`

Accept an invitation

```php
acceptInvitation(string $invitationId, ?bool $activate = null, ?string $apiKey = null): array
```

Joins the workspace with the role and the addresses the invitation gives, as accepting it in the app or from its link does. `activate:` also makes it the workspace the app opens for the person.

A workspace that asks everyone in it to sign in with two-factor authentication is refused with 403 `two_factor_required` until the person turns it on. An invitation that expired, was withdrawn or went to another address is a 422, and one that is not waiting any more a 404 `invitation_not_found`.

Scopes: `account:write`.

**Parameters**

- `invitationId` (`string`, required): An invitation id from `account->listInvitations`.
- `activate` (`bool`): True to make it the workspace the app opens. Defaults to false.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with `workspaceId`, `workspaceName`, `addressesGranted`, `domainsGranted` and `activated`.

**Example**

```php
use Nextmail\Exception\PermissionException;

try {
    $joined = $client->account->acceptInvitation('winv_6bb640f5b99e47deb758f1f5', activate: true);

    echo 'Joined ', $joined['workspaceName'], ' with ', $joined['addressesGranted'], ' addresses and ', $joined['domainsGranted'], ' domains', PHP_EOL;
} catch (PermissionException $error) {
    echo $error->errorCode === 'two_factor_required' ? 'Turn on two-factor sign-in first' : $error->getMessage(), PHP_EOL;
}
```

**Notes**

- Retried automatically on network failure, since accepting an invitation the person already accepted succeeds again and changes nothing.

Also available in: API [`POST /account/invitations/{invitationId}/accept`](https://nextmail.sh/docs/api/reference/your-account#post-account-invitations-invitationid-accept); TypeScript [`nextmail.account.acceptInvitation()`](https://nextmail.sh/docs/sdk/reference/account#acceptInvitation); Python [`account.accept_invitation()`](https://nextmail.sh/docs/python/reference/account#acceptInvitation); Ruby [`account.accept_invitation`](https://nextmail.sh/docs/ruby/reference/account#acceptInvitation); Go [`Account.AcceptInvitation`](https://nextmail.sh/docs/go/reference/account#acceptInvitation); Java [`account().acceptInvitation`](https://nextmail.sh/docs/java/reference/account#acceptInvitation); C# [`Account.AcceptInvitationAsync`](https://nextmail.sh/docs/csharp/reference/account#acceptInvitation); CLI [`nextmail account accept-invitation`](https://nextmail.sh/docs/cli/reference/account#account-accept-invitation).

### `account->declineInvitation`

Decline an invitation

```php
declineInvitation(string $invitationId, ?string $apiKey = null): array
```

Turns the invitation down, so its link stops working, and tells whoever sent it. It cannot be taken back: they have to invite the person again. An invitation the person already accepted is refused with 409 `invitation_accepted`.

Scopes: `account:write`.

**Parameters**

- `invitationId` (`string`, required): An invitation id from `account->listInvitations`.
- `apiKey` (`string`): Overrides the client's API key for this call only.

**Returns**

An array with the invitation `id` and `declined` set to true.

**Example**

```php
$declined = $client->account->declineInvitation('winv_6bb640f5b99e47deb758f1f5');

if ($declined['declined']) {
    echo 'Declined, and the sender has been told', PHP_EOL;
}
```

**Notes**

- Retried automatically on network failure, since declining twice changes nothing.

Also available in: API [`POST /account/invitations/{invitationId}/decline`](https://nextmail.sh/docs/api/reference/your-account#post-account-invitations-invitationid-decline); TypeScript [`nextmail.account.declineInvitation()`](https://nextmail.sh/docs/sdk/reference/account#declineInvitation); Python [`account.decline_invitation()`](https://nextmail.sh/docs/python/reference/account#declineInvitation); Ruby [`account.decline_invitation`](https://nextmail.sh/docs/ruby/reference/account#declineInvitation); Go [`Account.DeclineInvitation`](https://nextmail.sh/docs/go/reference/account#declineInvitation); Java [`account().declineInvitation`](https://nextmail.sh/docs/java/reference/account#declineInvitation); C# [`Account.DeclineInvitationAsync`](https://nextmail.sh/docs/csharp/reference/account#declineInvitation); CLI [`nextmail account decline-invitation`](https://nextmail.sh/docs/cli/reference/account#account-decline-invitation).