Activity Log

​

What is recorded

• clientIp: the client’s IP address, from a source Inbound trusts (see allowed IP addresses). null when Inbound has no trusted address.
• client: the client’s name and version from the IMAP ID command (for example Thunderbird/128.0), or the first part of the HTTP User-Agent. At most 100 characters. A sign-in event only has it when the client sends ID before LOGIN; some clients, such as Apple Mail, send it afterwards, and then the session’s later events (such as session_ended) carry it.
• count and lastOccurredAt: how many times the event repeated, and when it last did (see repeats and caps).
• detail: a few small fields when they help, such as the HTTP or SMTP status, a short error message, a session’s durationMs and commands, the sentEmailId of a failed send, or the limit that was reached.

​

What is never recorded

• Message content, subjects, headers or attachments
• Passwords or API keys
• Recipient or sender addresses. Error messages are shortened, and anything that looks like an email address is replaced with [address]
• Sign-in attempts for an address no credential uses: they don’t belong to any mailbox

​

Repeats and caps

• A successful sign-in from the same IP address and protocol within 10 minutes adds to the existing event’s count instead of creating a new event. HTTP requests authenticated with the mailbox password are recorded at most once per IP address per 10 minutes, without counting each request.
• Wrong passwords and refused sign-ins from the same IP address are grouped per minute, and IMAP command errors per session per minute.
• Inbound stores at most 600 events per credential per hour. Further events in that hour are counted in a single events_dropped event, so a client retrying a wrong password many times can’t flood the log.
• Inbound re-checks open IMAP sessions every few minutes; those checks aren’t recorded as sign-ins.

​

Read the activity log

curl "https://inbound.new/api/e2/mailboxes/$MAILBOX_ID/activity?event=login_refused&limit=20" \
  -H "Authorization: Bearer $INBOUND_API_KEY"

{
  "data": [
    {
      "id": "Jx2kq8VnR4pL0aB7cD9eF",
      "mailboxId": "mbx_123",
      "occurredAt": "2026-10-29T14:02:11.000Z",
      "lastOccurredAt": "2026-10-29T14:02:40.000Z",
      "protocol": "imap",
      "event": "login_refused",
      "reason": "ip_not_allowed",
      "clientIp": "198.51.100.7",
      "client": "Thunderbird/128.0",
      "count": 3,
      "detail": null
    }
  ],
  "pagination": { "limit": 20, "offset": 0, "total": 1, "hasMore": false }
}

curl "https://inbound.new/api/e2/mailboxes/activity?event=send_failed&since=2026-10-28T00:00:00Z" \
  -H "Authorization: Bearer $INBOUND_API_KEY"

​

Let mailbox users read their own activity

curl -X PUT "https://inbound.new/api/e2/mailboxes/$MAILBOX_ID" \
  -H "Authorization: Bearer $INBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "selfService": { "activity": true } }'

curl "https://inbound.new/api/e2/mailboxes/me/activity" \
  -H "Authorization: Bearer $MAILBOX_PASSWORD"