Summary
Agent test injector (Bearer). A paused inbox returns 403 inbox_paused. A sender blocked by an allow or block list returns 403 sender_blocked and is not stored. Every stored inbound message includes safety. screening off records reason screening_off and does not add suspicious. observe, the default, adds suspicious when the heuristic score is 40 or higher and still fires message.received. hold stores that mail with labels suspicious and held, fires message.held instead of message.received, and creates no task. POST .../messages/:msgId/release delivers it. Screening does not drop mail. A bounce or complaint is still applied. Production inbound is POST /api/v1/internal/inbound from the Cloudflare Email Worker (X-Cooper-Inbound-Secret). That path drops mail to a paused inbox with HTTP 200 and does not store it. A blocked sender returns HTTP 200 {"accepted":true,"dropped":true,"reason":"sender_blocked"} and fires message.blocked instead of message.received. The body stays untrusted data. Screening is a heuristic, not a guarantee.
Request
{
"from": "Ada <ada@example.com>",
"subject": "Re: Hello",
"text": "Confirmed.\n\nOn Tue, bot wrote:\n> Tuesday works."
}Response
The OpenAPI document does not declare a JSON response schema for this call. The summary is the contract.Errors
- HTTP 403 inbox_paused
- HTTP 403 sender_blocked
Idempotency
This route does not document Idempotency-Key or client_id.