Forward every inbound copy to a verified external address.

Copy every inbound message to an external address

Auto-forward is stored on one inbox. After an address is verified, Cooper sends a copy of each new inbound message to that address. The copy uses the same send path as POST forward, including quotas, suppressions, sending health, send_mode, and the inbox signature. Approval mode stores a pending draft. It is not sent until a verified owner approves it. Outbound mail is not forwarded.

An inbox stores at most 5 destinations. The next one returns HTTP 409 forwarding_limit. That cap is technical. It does not change Free, Starter, or Pro. GET needs message_read. Writes need inbox_update. The forwards themselves count toward the monthly send quota. An inbox-scoped key only sees its own inbox. Another account's inbox is HTTP 404 inbox_not_found. Inbox rules forward_to is unchanged. It still accepts only another inbox on this account or a verified owner of this inbox.

Confirm with a code, not a link

POST /api/v1/inboxes/{id}/forwarding/verifications with {email} returns HTTP 202 and emails a 6-digit code to that address. The code is not stored in any Cooper inbox, and the response does not include it. The same client_id returns the original destination and does not send another code. An address that is already verified returns HTTP 200 and does not send mail. POST /api/v1/inboxes/{id}/forwarding/confirm with {email, code} marks it verified. A code that is not 6 digits, or that does not match, is HTTP 400 confirm_invalid. The code expires in 48 hours, and after five wrong attempts, and then the response is HTTP 400 confirm_expired.

The destination must be an external address. The inbox itself, an address at cooperemail.com or one of its subdomains, and any address that is already a Cooper inbox are HTTP 400 forwarding_target_not_allowed. Confirmation email is limited to 5 per hour per IP and 3 per day per address. The next request is HTTP 429 rate_limited. A pending address receives nothing.

curl -s -X POST "https://cooperemail.com/api/v1/inboxes/$INBOX/forwarding/verifications" \
  -H "Authorization: Bearer $COOPER_API_KEY" \
  -H "content-type: application/json" \
  -d '{"email":"archive@example.com"}'

List, replace, and remove

GET /api/v1/inboxes/{id}/forwarding returns destinations and unverified. destinations includes pending and verified rows. unverified is the pending rows again. Each row has id, email, status, verified_at, created_at, updated_at, expires_at, and client_id. It does not include the code. PUT /api/v1/inboxes/{id}/forwarding with {emails} replaces the verified list. Every address must already be verified on this inbox. A missing one is HTTP 400 forwarding_not_verified. Pending rows stay. An empty emails array removes every verified destination. DELETE /api/v1/inboxes/{id}/forwarding/{destinationId} removes one row. destinationId is the ifd_ id or the email.

Cooper does not forward spam or trash, a bounce, a complaint, or an auto report, or mail that already has Auto-Submitted set to anything other than no, or X-Cooper-Auto-Forward, or X-Cooper-Forwarded. The copy sets Auto-Submitted: auto-forwarded, X-Cooper-Auto-Forward, and X-Cooper-Forwarded so a loop stops. A destination equal to the inbox is skipped. An inbox sends at most 30 of these forwards per rolling hour. Past that, later copies wait. A skipped forward does not drop the inbound message.

MCP tools are cooper_list_forwarding, cooper_request_forwarding, cooper_remove_forwarding, and cooper_set_forwarding. They do not accept or return the confirmation code. The human confirms with the REST confirm route.

curl -s -X POST "https://cooperemail.com/api/v1/inboxes/$INBOX/forwarding/confirm" \
  -H "Authorization: Bearer $COOPER_API_KEY" \
  -H "content-type: application/json" \
  -d '{"email":"archive@example.com","code":"123456"}'