Summary
Recent refused API calls for this account, newest first. object is list. Each row is object request_refusal with id, created_at, method, route, status, error {type, code, param, message}, api_key_id, oauth_client_id, inbox_id, source (rest or mcp), and mcp_tool. has_more and next_cursor page the list. limit is 1 to 100 and defaults to 25. Filters are status (HTTP 4xx), code, api_key_id, inbox_id, since (ISO-8601), and cursor. A row is stored only when a live API key or OAuth token was accepted and the response was an HTTP 4xx ApiError. Unauthenticated 401 responses are not stored. HTTP 2xx and HTTP 5xx are not stored. Request bodies, query strings, Authorization headers, API keys, tokens, email content, and recipient addresses are not stored. The route keeps ids and drops the query string. The message is cut at 300 characters. Each account keeps at most 1000 rows per UTC day. Rows older than 7 days are deleted. A full-access account key sees the account. A restricted or inbox-scoped key sees only its own key. An OAuth client sees only its own client. Any live key can call this route. A missing or invalid key is 401 unauthorized. HTTP 400 invalid_limit, invalid_cursor, invalid_status, invalid_code, invalid_date, invalid_api_key_id, or invalid_inbox. MCP: cooper_list_request_refusals.
Query
?status=403&code=permission_denied&limit=25Response
HTTP 200. Sample values illustrate the schema.
{
"object": "list",
"data": [
{
"object": "request_refusal",
"id": "inb_example",
"created_at": "2026-10-18T12:00:00.000Z",
"method": "string",
"route": "string",
"status": 1,
"error": {
"type": "string",
"code": "482913",
"param": null,
"message": "string"
},
"api_key_id": null,
"oauth_client_id": null,
"inbox_id": null,
"source": "rest",
"mcp_tool": null
}
],
"has_more": true,
"next_cursor": null
}Errors
- HTTP 400 invalid_limit
- HTTP 400 invalid_cursor
- HTTP 400 invalid_status
- HTTP 400 invalid_code
- HTTP 400 invalid_date
- HTTP 400 invalid_api_key_id
- HTTP 400 invalid_inbox
Idempotency
client_id makes this write idempotent. Sending the same client_id again returns the original object instead of creating a duplicate.