# Confirm Inbox Display

> Record that the logo was seen in a mailbox

**Endpoint:** `POST /v1/applications/{application_id}/inbox-display`  
**Access:** Paid plan required (scope `applications:write`)  
**MCP tool:** `confirm_inbox_display`

## cURL example

```bash
curl -X POST "https://api.verifiedinbox.ai/v1/applications/0192a5e0-1234-7000-8000-000000000001/inbox-display" \
  -H "Authorization: Bearer vi_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mailbox": "string",
    "observed": true
  }'
```

## Parameters

| Parameter | Type | Description |
|---|---|---|
| `application_id` (path, required) | `string (uuid)` | Application id. |
| `VI-Environment` (header) | `string` | `live` (default) or `test`. Used for anonymous callers and OAuth access tokens; API keys and web sessions carry their own environment. |

## Request body

| Field | Type | Description |
|---|---|---|
| `mailbox` | `string` | gmail (default), yahoo, apple_mail, … |
| `observed` | `boolean` | Default true. |

```json
{
  "mailbox": "string",
  "observed": true
}
```

## Responses

### 200 OK

Recorded.

```json
{
  "bimi": {
    "assets_match": true,
    "certificate_reachable": true,
    "certificate_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
    "host": "string",
    "logo_reachable": true,
    "logo_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain",
    "record": "string",
    "status": "not_published"
  },
  "inbox_display": {
    "expects_checkmark": true,
    "mailbox": "string",
    "observed_at": "2026-10-31T12:00:00Z",
    "status": "not_observed"
  },
  "monitoring": {
    "enabled": true,
    "last_checked_at": "2026-10-31T12:00:00Z"
  },
  "renewal": {
    "auto_renew": true,
    "not_after": "2026-10-31T12:00:00Z",
    "renewal_starts_on": "2026-10-31"
  },
  "test_message": {
    "address": "string",
    "bimi_selector": "string",
    "created_at": "2026-10-31T12:00:00Z",
    "dkim": [],
    "dmarc": {
      "aligned_via": [],
      "result": "pass"
    },
    "expires_at": "2026-10-31T12:00:00Z",
    "findings": [],
    "from": "string",
    "from_domain": "acme.com",
    "id": "0192a5e0-1234-7000-8000-000000000001",
    "instructions": "string",
    "received_at": "2026-10-31T12:00:00Z",
    "spf": {
      "aligned": true,
      "domain": "acme.com",
      "result": "pass"
    },
    "status": "waiting"
  }
}
```

### 400 (invalid_request)

`invalid_request` — the request is malformed.

```json
{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}
```

### 401 (unauthenticated)

`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

```json
{
  "error": {
    "code": "unauthenticated",
    "message": "Sign in or provide an API key to continue.",
    "next_action": {
      "kind": "sign_in",
      "title": "Sign in or create an account",
      "url": "/login"
    }
  }
}
```

### 402 (payment_required)

`payment_required` — this step needs a paid plan. `next_action.kind = checkout`.

```json
{
  "error": {
    "code": "payment_required",
    "message": "This step requires an active paid plan for this domain.",
    "next_action": {
      "kind": "checkout",
      "title": "Continue to checkout"
    }
  }
}
```

### 403 (insufficient_scope)

`forbidden` / `insufficient_scope` — the credential lacks permission.

```json
{
  "error": {
    "code": "insufficient_scope",
    "message": "This API key does not have the required scope for this action."
  }
}
```

### 404 (not_found)

`not_found` — doesn't exist or isn't accessible to you (never 403).

```json
{
  "error": {
    "code": "not_found",
    "message": "We couldn't find that resource."
  }
}
```

### 422 (unprocessable)

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

```json
{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}
```

### 429 (rate_limited)

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}
```