Changelog

Nothing below is deployed yet: every entry is built and tested, and none of it is available to customers.

Unreleased

Fixes (6 Nov 2026)

• wait?extract= now extracts first and marks the messages as returned only after that: a failed extraction no longer hides them from the next wait with exclude_returned=true.
• The extraction cap applies to a flagged account that is not claimed (sandbox, expired or suspended). A message that can no longer be read no longer uses a unit of the budget.
• Signup: a failed write can no longer lose the shown-once api_key.
• Receiving: an unparseable mail is stored once when it is delivered again; snippets never end on half an emoji.

Rejection text (6 Nov 2026)

• Every rejected inbound mail gets the text mailbox unavailable; sending servers see 555 5.7.1 mailbox unavailable. (Cloudflare puts its own code in front). A temporary failure on Replyz’s side gives senders 421 4.3.0, and they retry.

Extraction (6 Nov 2026)

• Added POST /v1/messages/{id}/extract: the most likely one-time code (otp, with the code as written, a value ready to type and a confidence), other plausible codes, the main verify, magic sign-in or reset link (primary_link) and the classified links. Links are only read, never fetched. See Get a verification code.
• Added extract=otp|link|otp,link to wait: each returned message carries extracted.
• An account that receives more than 20 verification-code mails from at least 5 sender domains in an hour is flagged for 24 hours (otp_flagged_until). A flagged account may run 10 extractions per hour (extract_limit). Mail is never rejected for this.

Hardening (6 Nov 2026)

• Error links point to https://docs.replyz.io/errors/<code>. Error responses are never cached; 401 carries WWW-Authenticate; every 429 answer and signups_disabled carry Retry-After.
• A sandbox account past its 7 days is treated as expired at once: writes are refused, waits do not hold, mail is rejected.
• The daily inbox-creation cap counts the signup inbox and cannot be exceeded by parallel requests.
• Role words such as support, admin, billing and noreply are refused anywhere in a name as a whole word (support-bot).
• Reading mail: include=html no longer fails with a server error (it returns html_error instead), attachments keep their email order, snippets never cut a character in half.
• Hidden-HTML detection follows CSS inheritance: font-size:0 wrappers in email layouts no longer hide visible text.
• Privacy: the internal queue no longer carries the sender address; spam_score is read only from Cloudflare’s own header.

Reading mail (6 Nov 2026)

• Added GET /v1/inboxes/{id}/messages, GET /v1/inboxes/{id}/wait, GET /v1/messages/{id} (include=html,raw), GET /v1/messages/{id}/attachments/{att}, GET /v1/threads/{id} and GET /v1/events.
• wait returns mail from the last 10 minutes at once (returned_before tells whether it was seen), holds up to 60 seconds (default 25), and an account can hold at most 5 long-polls at once (shared with events?wait=). A message counts as read once returned.
• Deleting an inbox hides its mail from every read route at once.
• IPv6 signup limits apply per /64; daily inbox-creation cap (sandbox 3; claimed 10, not available yet); Idempotency-Key on POST /v1/inboxes.

Receiving mail (6 Nov 2026)

• Mail to an inbox address is accepted, stored in the EU and parsed: text, reply_text, safety signals, attachments and threads.
• One generic rejection (mailbox unavailable) for unknown addresses, inactive accounts, messages over 10 MiB and the monthly receive cap (sandbox 1,000; claimed 5,000, not available yet).

Signup and inboxes (6 Nov 2026)

• Added GET /v1/signup/challenge, POST /v1/signup (proof of work), GET /v1/account and inbox management at /v1/inboxes.
• Sandbox accounts last 7 days and have 1 inbox. Addresses are never reused. API keys are shown once.