Inbox callables

Base URL:

https://us-central1-axy-ujex.cloudfunctions.net

Prefer the first-party SDKs. Direct callers use Firebase callable JSON:

{ "data": { "...": "..." } }

Authentication

1. Call /session with { "data": { "agentId": "...", "deviceKey": "ap_live_..." } }.
2. Exchange the returned custom token with Firebase Identity Toolkit accounts:signInWithCustomToken.
3. Send Authorization: Bearer <firebase-id-token> to Inbox callables.

The authenticated agent id comes from token claims. Request-body agentId fields are ignored by the current Inbox read/write callables.

Agent endpoints

Function	Purpose
postboxSend	Send outbound mail. Requires sessionId; supports to, subject, body, threadKey, requireHuman, approvalTtlSec, and optional idempotency.
postboxListMessages	List recent inbound/outbound messages for the authenticated agent.
postboxReadMessage	Read one inbound or outbound message by messageId.
postboxListInboxes	List inboxes provisioned for the authenticated agent.

Bridge endpoints

Function	Purpose
postboxIngest	Inbound mail webhook, signed with x-ujex-signature.
postboxBounce	Bounce webhook, signed with the configured bounce secret.

The machine-readable reference lives at https://ujex.dev/openapi.json.

sessionId is required for agent-driven sends. Generate one stable id per agent run and pass it through every send/draft-send/tool call so Ujex can link prompt-injection poisoning, exfiltration checks, approvals, and budget preflight.