# Create an inbox (/docs/api-reference/inboxes/create-inbox)

Gives an agent (or anyone) its own email address in the API key's environment: `username@<the environment's inbound domain>`, which needs no DNS setup, or an address at one of the environment's receiving domains (`domain`). Mail to it is kept as threads, and each message that arrives sends an `inbox.message.received` webhook. With a `client_id` that already has an inbox, that inbox is returned (200) instead of a new one.

`POST https://api.coss.com/v1/inboxes`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Request body

- `username` (string, at most 64 characters): The part before the @. Omit it for a random one. Mail to `username+anything@domain` reaches the inbox too.
- `domain` (string, 1-253 characters): One of the environment's receiving domains (its hostname). Omit it for the environment's own domain under coss.com's inbound domain, which needs no DNS setup.
- `display_name` (string, 1-64 characters): The name messages from the inbox are sent with.
- `client_id` (string): Your own id for the inbox (unique per environment). Creating an inbox with a `client_id` that already has one returns that inbox instead (200), so retries and "one inbox per user" need no bookkeeping.

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.inboxes.create({
  username: "support-agent",
  display_name: "Acme Support",
  client_id: "agent-42",
});
```

HTTP:

```sh
curl -X POST "https://api.coss.com/v1/inboxes" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "username": "support-agent",
  "display_name": "Acme Support",
  "client_id": "agent-42"
}'
```

## Response 200

The environment's inbox with this `client_id`.

- `object` ("inbox", required)
- `id` (string, required)
- `address` (string, required): The inbox's email address (`username@domain`).
- `username` (string, required)
- `domain` (string, required)
- `kind` ("managed" | "domain", required): `managed`: at the environment's own domain under coss.com's inbound domain (no DNS setup). `domain`: at one of the environment's receiving domains.
- `display_name` (string | null, required): The name messages from the inbox are sent with.
- `client_id` (string | null, required): Your own id for the inbox, e.g. your agent's or user's (unique per environment).
- `can_send` (boolean, required): Whether messages can be sent from the inbox. Inboxes at coss.com's inbound domain only receive in live environments: create the inbox at a receiving domain under one of your verified domains to send from it.
- `sandbox` (boolean, required): Whether it belongs to a sandbox environment.
- `created_at` (string, required, date-time)
- `updated_at` (string, required, date-time)

Example:

```json
{
  "object": "inbox",
  "id": "inbox_01k7c8m4q2f3e9v6t5r1n0p8yz",
  "address": "support-agent@k3j9x2m7qp4l.inbound.coss.com",
  "username": "support-agent",
  "domain": "k3j9x2m7qp4l.inbound.coss.com",
  "kind": "managed",
  "display_name": "Acme Support",
  "client_id": "agent-42",
  "can_send": true,
  "sandbox": true,
  "created_at": "2026-10-10T12:00:00.000Z",
  "updated_at": "2026-10-10T12:00:00.000Z"
}
```

## Response 201

The new inbox.

- `object` ("inbox", required)
- `id` (string, required)
- `address` (string, required): The inbox's email address (`username@domain`).
- `username` (string, required)
- `domain` (string, required)
- `kind` ("managed" | "domain", required): `managed`: at the environment's own domain under coss.com's inbound domain (no DNS setup). `domain`: at one of the environment's receiving domains.
- `display_name` (string | null, required): The name messages from the inbox are sent with.
- `client_id` (string | null, required): Your own id for the inbox, e.g. your agent's or user's (unique per environment).
- `can_send` (boolean, required): Whether messages can be sent from the inbox. Inboxes at coss.com's inbound domain only receive in live environments: create the inbox at a receiving domain under one of your verified domains to send from it.
- `sandbox` (boolean, required): Whether it belongs to a sandbox environment.
- `created_at` (string, required, date-time)
- `updated_at` (string, required, date-time)

Example:

```json
{
  "object": "inbox",
  "id": "inbox_01k7c8m4q2f3e9v6t5r1n0p8yz",
  "address": "support-agent@k3j9x2m7qp4l.inbound.coss.com",
  "username": "support-agent",
  "domain": "k3j9x2m7qp4l.inbound.coss.com",
  "kind": "managed",
  "display_name": "Acme Support",
  "client_id": "agent-42",
  "can_send": true,
  "sandbox": true,
  "created_at": "2026-10-10T12:00:00.000Z",
  "updated_at": "2026-10-10T12:00:00.000Z"
}
```

## Errors

- `400`: The `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `422`: The body failed validation (`validation_error`), the address is already an inbox (`address_taken`), `domain` is not a receiving domain of the environment (`unknown_domain`), the environment has its maximum of inboxes (`too_many_inboxes`), or the deployment doesn't receive email at coss.com's inbound domain (`receiving_unavailable`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).