API Reference · Test messages

Create Test Message

Get an address to send a real test email to

POST/v1/applications/{application_id}/test-messages

Free (guest token or account)MCP:create_test_message

Free. When the email arrives we check SPF, DKIM and DMARC on it, and a DKIM signature aligned with the domain is added to the email security report (so a key under an unusual selector is found).

cURL example

cURL request

curl -X POST "https://api.verifiedinbox.ai/v1/applications/0192a5e0-1234-7000-8000-000000000001/test-messages" \
  -H "VI-Guest-Token: vi_guest_YOUR_TOKEN"

Parameters

Parameter	Type	Description
application_idpathrequired	string (uuid)	Application id.
VI-Environmentheader	string	`live` (default) or `test`. Used for anonymous callers and OAuth access tokens; API keys and web sessions carry their own environment.

Response

201 OKAddress.

application/json

Field	Type	Description
addressrequired	string	Send a real email from the domain to this address.
bimi_selectoroptional	string \| null	—
created_atrequired	string (date-time)	—
dkimoptional	object[]	— Nested fields (4) `aligned` (boolean) `domain` (string) `result` (string) `selector` (string)
dmarcoptional	object	— Nested fields (2) `aligned_via` (string[]) `result` (string)
expires_atrequired	string (date-time)	—
findingsoptional	Finding[]	— Nested fields (7) `area` (string) `detail` (string): Plain English. `fix` (RecordFix) `id` (string) `severity` (string) `technical` (string): Exact technical description. `title` (string): Plain English.
fromoptional	string \| null	—
from_domainoptional	string \| null	—
idrequired	string (uuid)	—
instructionsoptional	string	—
received_atrequired	string (date-time) \| null	—
spfoptional	object	— Nested fields (3) `aligned` (boolean) `domain` (string) `result` (string)
statusrequired	string	— Allowed: `waiting`, `received`, `expired`

Example 201 response (TestMessage)

{
  "address": "string",
  "bimi_selector": "string",
  "created_at": "2026-10-31T12:00:00Z",
  "dkim": [
    {
      "aligned": true,
      "domain": "acme.com",
      "result": "pass",
      "selector": "string"
    }
  ],
  "dmarc": {
    "aligned_via": [],
    "result": "pass"
  },
  "expires_at": "2026-10-31T12:00:00Z",
  "findings": [
    {
      "area": "mx",
      "detail": "string",
      "fix": {
        "host": "string",
        "note": "string",
        "type": "string",
        "value": "string"
      },
      "id": "0192a5e0-1234-7000-8000-000000000001",
      "severity": "info",
      "technical": "string",
      "title": "string"
    }
  ],
  "from": "string",
  "from_domain": "acme.com",
  "id": "0192a5e0-1234-7000-8000-000000000001",
  "instructions": "string",
  "received_at": "2026-10-31T12:00:00Z",
  "spf": {
    "aligned": true,
    "domain": "acme.com",
    "result": "pass"
  },
  "status": "waiting"
}

Other responses & possible errors

Expand a status code below to see the error code, description, and example error payload.

400 (invalid_request)`invalid_request` — the request is malformed.

`invalid_request` — the request is malformed.

Example 400 error response

{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}

401 (unauthenticated)`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

`unauthenticated` — sign in / send a valid credential. `next_action.kind = sign_in`.

Example 401 error response

{
  "error": {
    "code": "unauthenticated",
    "message": "Sign in or provide an API key to continue.",
    "next_action": {
      "kind": "sign_in",
      "title": "Sign in or create an account",
      "url": "/login"
    }
  }
}

404 (not_found)`not_found` — doesn't exist or isn't accessible to you (never 403).

`not_found` — doesn't exist or isn't accessible to you (never 403).

Example 404 error response

{
  "error": {
    "code": "not_found",
    "message": "We couldn't find that resource."
  }
}

422 (unprocessable)`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

Example 422 error response

{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}

429 (rate_limited)`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

Example 429 error response

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}

Was it helpful?