Every action in the console has an endpoint behind it (buying domains, cutting mailbox rosters, rotating patterns, reading reputation), plus signed webhooks, so your pipeline never has to poll for a job it started itself.
- 0.00%
- API uptime, trailing 90 days
- 0ms
- Median response time
- 0
- Requests per minute on the standard plan
From token to finished job.
Four stages, and the long ones hand you a job ID and get out of the way.
Step 1: Generate a scoped token
Issue a token limited to exactly the resources one integration touches: six scopes, granted individually rather than as a bundle.
Step 2: Make the call
One authenticated request registers a domain, queues a mailbox batch, or reads reputation across the whole fleet.
Step 3: Long jobs return a job ID
A 200-mailbox batch answers immediately with an ID and finishes in the background, so nothing in your deploy blocks on provisioning.
Step 4: The webhook closes the loop
A signed webhook fires the moment the job lands, carrying the same payload the console renders for the same event.
What you can build around.
The numbers you would otherwise have to discover in production.
Requests per minute
- Standard plan
- 600
- Notes
- Returned in the X-RateLimit-Remaining header
Max batch size per request
- Standard plan
- 600 mailboxes
- Notes
- Larger rosters split into multiple jobs
Webhook retry attempts
- Standard plan
- 5
- Notes
- Exponential backoff over 24 hours
Token scopes
- Standard plan
- 6
- Notes
- Domains, mailboxes, DNS, reputation, billing, webhooks
Idempotency key window
- Standard plan
- 24 hours
- Notes
- Duplicate requests return the original result
| Limit | Standard plan | Notes |
|---|---|---|
| Requests per minute | 600 | Returned in the X-RateLimit-Remaining header |
| Max batch size per request | 600 mailboxes | Larger rosters split into multiple jobs |
| Webhook retry attempts | 5 | Exponential backoff over 24 hours |
| Token scopes | 6 | Domains, mailboxes, DNS, reputation, billing, webhooks |
| Idempotency key window | 24 hours | Duplicate requests return the original result |
No endpoint the console has that you do not.
One surface, predictable resource paths, and events pushed the moment state changes. The console is simply another client of it.
The console's own endpoints
Buying domains, generating mailboxes, rotating naming patterns and reading reputation scores are all calls here, not screens somebody has to click.
Stop polling for job status
Job completion and reputation changes push to your endpoint as they happen, signed, with five retry attempts backing off over 24 hours.
Paths you can guess correctly
Domains, mailboxes, DNS records and reputation each follow the same resource shape, which is why the second integration takes an afternoon.
The limit is in every response
Remaining budget comes back in a header on every call, so backoff is something you compute rather than something you discover at 600 requests a minute.
One authenticated call, a whole fleet on the other side.
A single request can register a domain, write its DNS records and queue a mailbox batch: the same job the console runs, called from your deploy pipeline instead of from a browser tab.
Scoped tokens, signed requests
A token issued for provisioning cannot read billing. Scopes are granted per resource, so a leaked CI token has a bounded blast radius rather than a total one.
Idempotency keys, 24-hour window
A retry after a timeout returns the original result instead of cutting a second batch of mailboxes you then have to delete.
Signed webhook payloads
Every payload carries a signature, so your endpoint can verify it came from Infrabox before it acts on the event.
Test mode that is safe in CI
A test-mode token exercises the whole surface against fake domains and mailboxes, so integration tests never touch real infrastructure.
What comes up in an integration review
600 requests per minute on the standard plan, with the remaining budget in an X-RateLimit-Remaining header on every response. Headroom scales with the plan rather than being negotiated case by case.
Yes. The console is a client of these endpoints, so there is no UI-only action hiding behind a screen you would have to automate with a headless browser.
Send an idempotency key with any provisioning request. A retry inside the 24-hour window returns the original result instead of creating a second roster.
Yes. Tokens are scoped per resource and can be limited to read across six scopes: domains, mailboxes, DNS, reputation, billing and webhooks.
Check the signature on the payload against your webhook secret before acting on the event. Failed deliveries retry five times with exponential backoff over 24 hours.
Turn client onboarding into a deploy.
Issue a scoped token and provision your first domain from your own pipeline in minutes.