Optional HTML body
\"\n }'\n```\n\nOptional fields: `cc`, `bcc` (string arrays), `inReplyTo`, `references` (strings for threading), `attachments` (array of `{filename, contentType, content}` where content is base64).\n\n### Read inbox\n\n```bash\n# List messages\ncurl https://api.theagentmail.net/v1/accounts/{accountId}/messages \\\n -H \"Authorization: Bearer am_...\"\n\n# Get full message (with body and attachments)\ncurl https://api.theagentmail.net/v1/accounts/{accountId}/messages/{messageId} \\\n -H \"Authorization: Bearer am_...\"\n```\n\n### Check karma\n\n```bash\ncurl https://api.theagentmail.net/v1/karma \\\n -H \"Authorization: Bearer am_...\"\n```\n\nResponse: `{\"data\": {\"balance\": 90, \"events\": [...]}}`\n\n### Register webhook (real-time inbound)\n\n```bash\ncurl -X POST https://api.theagentmail.net/v1/accounts/{accountId}/webhooks \\\n -H \"Authorization: Bearer am_...\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"url\": \"https://my-agent.example.com/inbox\"}'\n```\n\nWebhook deliveries include two security headers:\n- `X-AgentMail-Signature` -- HMAC-SHA256 hex digest of the request body, signed with the webhook secret\n- `X-AgentMail-Timestamp` -- millisecond timestamp of when the delivery was sent\n\nVerify the signature and reject requests with timestamps older than 5 minutes to prevent replay attacks:\n\n```typescript\nimport { createHmac } from \"crypto\";\n\nconst verifyWebhook = (body: string, signature: string, timestamp: string, secret: string) => {\n if (Date.now() - Number(timestamp) > 5 * 60 * 1000) return false;\n return createHmac(\"sha256\", secret).update(body).digest(\"hex\") === signature;\n};\n```\n\n### Download attachment\n\n```bash\ncurl https://api.theagentmail.net/v1/accounts/{accountId}/messages/{messageId}/attachments/{attachmentId} \\\n -H \"Authorization: Bearer am_...\"\n```\n\nReturns `{\"data\": {\"url\": \"https://signed-download-url...\"}}`.\n\n## Full API reference\n\n| Method | Path | Description | Karma |\n|--------|------|-------------|-------|\n| POST | `/v1/accounts` | Create email account | -10 |\n| GET | `/v1/accounts` | List all accounts | |\n| GET | `/v1/accounts/:id` | Get account details | |\n| DELETE | `/v1/accounts/:id` | Delete account | +10 |\n| POST | `/v1/accounts/:id/messages` | Send email | -1 |\n| GET | `/v1/accounts/:id/messages` | List messages | |\n| GET | `/v1/accounts/:id/messages/:msgId` | Get full message | |\n| GET | `/v1/accounts/:id/messages/:msgId/attachments/:attId` | Get attachment URL | |\n| POST | `/v1/accounts/:id/webhooks` | Register webhook | |\n| GET | `/v1/accounts/:id/webhooks` | List webhooks | |\n| DELETE | `/v1/accounts/:id/webhooks/:whId` | Delete webhook | |\n| GET | `/v1/karma` | Get balance + events | |\n\n## Karma system\n\nEvery action has a karma cost or reward:\n\n| Event | Karma | Why |\n|---|---|---|\n| `money_paid` | +100 | Purchase credits |\n| `email_received` | +2 | Someone replied from a trusted domain |\n| `account_deleted` | +10 | Karma refunded when you delete an address |\n| `email_sent` | -1 | Sending costs karma |\n| `account_created` | -10 | Creating addresses costs karma |\n\n**Important rules:**\n- Karma is only awarded for inbound emails from trusted providers (Gmail, Outlook, Yahoo, iCloud, ProtonMail, Fastmail, Hey, etc.). Emails from unknown/throwaway domains don't earn karma.\n- You only earn karma once per sender until the agent replies. If sender X emails you 5 times without a reply, only the first earns karma. Reply to X, and the next email from X earns karma again.\n- Deleting an account refunds the 10 karma it cost to create.\n\nWhen karma reaches 0, sends and account creation return HTTP 402. Always check balance before operations that cost karma.\n\n## TypeScript SDK\n\n```typescript\nimport { createClient } from \"@agentmail/sdk\";\n\nconst mail = createClient({ apiKey: \"am_...\" });\n\n// Create account\nconst account = await mail.accounts.create({\n address: \"my-agent@theagentmail.net\",\n});\n\n// Send email\nawait mail.messages.send(account.id, {\n to: [\"human@example.com\"],\n subject: \"Hello\",\n text: \"Sent by an AI agent.\",\n});\n\n// Read inbox\nconst messages = await mail.messages.list(account.id);\nconst detail = await mail.messages.get(account.id, messages[0].id);\n\n// Attachments\nconst att = await mail.attachments.getUrl(accountId, messageId, attachmentId);\n// att.url is a signed download URL\n\n// Webhooks\nawait mail.webhooks.create(account.id, {\n url: \"https://my-agent.example.com/inbox\",\n});\n\n// Karma\nconst karma = await mail.karma.getBalance();\nconsole.log(karma.balance);\n```\n\n## Error handling\n\n```typescript\nimport { AgentMailError } from \"@agentmail/sdk\";\n\ntry {\n await mail.messages.send(accountId, { to: [\"a@b.com\"], subject: \"Hi\", text: \"Hey\" });\n} catch (e) {\n if (e instanceof AgentMailError) {\n console.log(e.status); // 402, 404, 401, etc.\n console.log(e.code); // \"INSUFFICIENT_KARMA\", \"NOT_FOUND\", etc.\n console.log(e.message);\n }\n}\n```\n\n## Common patterns\n\n### Sign up for a service and read verification email\n\n```typescript\nconst account = await mail.accounts.create({\n address: \"signup-bot@theagentmail.net\",\n});\n\n// Use the address to sign up (browser automation, API, etc.)\n\n// Poll for verification email\nfor (let i = 0; i < 30; i++) {\n const messages = await mail.messages.list(account.id);\n const verification = messages.find(m =>\n m.subject.toLowerCase().includes(\"verify\") ||\n m.subject.toLowerCase().includes(\"confirm\")\n );\n if (verification) {\n const detail = await mail.messages.get(account.id, verification.id);\n // Parse verification link/code from detail.bodyText or detail.bodyHtml\n break;\n }\n await new Promise(r => setTimeout(r, 2000));\n}\n```\n\n### Send email and wait for reply\n\n```typescript\nconst sent = await mail.messages.send(account.id, {\n to: [\"human@company.com\"],\n subject: \"Question about order #12345\",\n text: \"Can you check the status?\",\n});\n\nfor (let i = 0; i < 60; i++) {\n const messages = await mail.messages.list(account.id);\n const reply = messages.find(m =>\n m.direction === \"inbound\" && m.timestamp > sent.timestamp\n );\n if (reply) {\n const detail = await mail.messages.get(account.id, reply.id);\n // Process reply\n break;\n }\n await new Promise(r => setTimeout(r, 5000));\n}\n```\n\n## Types\n\n```typescript\ntype Account = { id: string; address: string; displayName: string | null; createdAt: number };\ntype Message = { id: string; from: string; to: string[]; subject: string; direction: \"inbound\" | \"outbound\"; status: string; timestamp: number };\ntype MessageDetail = Message & { cc: string[] | null; bcc: string[] | null; bodyText: string | null; bodyHtml: string | null; inReplyTo: string | null; references: string | null; attachments: AttachmentMeta[] };\ntype AttachmentMeta = { id: string; filename: string; contentType: string; size: number };\ntype KarmaBalance = { balance: number; events: KarmaEvent[] };\ntype KarmaEvent = { id: string; type: string; amount: number; timestamp: number; metadata?: Record