| Verified domains | organization-domain create/list/get/verify/delete, identity domain-affiliation get/set/remove, and a2a directory --public --verified-domain. Attached domains follow agent visibility. Guide | | | | |
| Auth & runtime | --api-key / INKBOX_API_KEY / ~/.inkbox/config, --vault-key / INKBOX_VAULT_KEY, --base-url, --json for parseable output | | | | |
| Install modes | Global (npm install -g @inkbox/cli), one-shot (npx @inkbox/cli <command>), local repo dev (npm --prefix cli run dev -- <command>) | | | | |
| High-risk operations | Commands that send real traffic or mutate resources — signup create, email send, phone call, text send, mailbox imports run / cancel, identity delete, email delete, vault delete, number release, identity update --mail-filter-mode / --phone-filter-mode, identity signing-key rotate (and the deprecated mailbox update --filter-mode / number update --filter-mode / signing-key create) | | | | |
| Agent self-signup | inkbox signup create, signup verify, signup resend-verification, signup status — with the issued API key passed back via --api-key or INKBOX_API_KEY | | | | |
| Identities | identity list / get / create <handle> [--display-name] [--description] [--email-local-part] [--tls-mode edge|passthrough] / delete / update <handle> [--display-name] [--description] [--clear-description] [--mail-filter-mode whitelist|blacklist] [--phone-filter-mode whitelist|blacklist] / refresh. Handles are fixed at creation. | | | | |
| Tunnels | tunnel list / tunnel get <id-or-handle> / tunnel update <id> [--metadata] / tunnel sign-csr <id> --csr <path-or-pem> [--out <path>] — tunnels are provisioned and destroyed via the identity surface | | | | |
| Identity-scoped secrets | identity create-secret / get-secret / delete-secret / revoke-access / set-totp / remove-totp / totp-code (requires vault key) | | | | |
| Email | email send / list / get / search / unread / mark-read / delete / delete-thread / star / unstar / thread — all identity-scoped via -i <handle> | | | | |
| Phone | phone call / calls / hangup <call-id> / transcripts / search-transcripts — identity-scoped | | | | |
| Text messages | text send (--to <number[,number...]> | --conversation-id <uuid>) [--text] [--media-url] for 1:1 SMS/MMS, beta group MMS, and conversation replies; list / get / conversations --include-groups / conversation <conversation-key> / search / mark-read / mark-conversation-read <conversation-key> — identity-scoped. Some carriers may reject group chats or MMS from 10DLC numbers | | | | |
| iMessage | imessage send (--to <number[,number...]> | --conversation-id <uuid>) [--media-url <url>] [--send-style <style>] for 1:1 messages, dedicated-line groups, canonical replies, and failed-creation retries. Group creation and replies support expressive styles, including with media. list --include-groups / conversations --include-groups opt groups into existing lists; conversation rows expose groupCreationStatus. imessage react <message-id> supports inbound group messages, and imessage unreact <reaction-id> takes back a tapback this identity sent. Group read receipts and typing are not supported | | | | |
| Vault | vault init / info / secrets / get / create / delete / keys / grant-access / revoke-access / access-list; per-type listings (logins, api-keys, ssh-keys, key-pairs) | | | | |
| Vault secret types | login, api_key, key_pair, ssh_key, other — with per-type flag sets (e.g. --password, --key, --private-key, --data) | | | | |
| Mailboxes (admin) | mailbox list / get; manage names with identity update --display-name. Mailboxes are created and deleted with identities. mailbox update --filter-mode is deprecated; use identity update --mail-filter-mode instead | | | | |
| Email — signatures | inkbox mailbox update saves a custom signature from text, HTML, or file contents, clears formats, and toggles insertion on paid plans | | | | |
| Mailbox imports | `mailbox imports run | get | list | wait | cancelfor MBOX, EML, and ZIP archives; original-address direction hints, read state,—no-wait`, non-cancelling timeouts, configurable polling, JSON output, counters, and nonzero failed/cancelled exits |
| Identity contact rules | identity mail-rules, identity phone-rules, and slack contact-rule list/get/create/update/delete; mutations require admin credentials. Phone rules also govern iMessage and can be configured without a dedicated number | | | | |
| Mailbox contact rules (deprecated) | mailbox rules list / get / create / update / delete — superseded by identity mail-rules | | | | |
| Phone numbers (admin) | number list / get / provision / update (incoming-call action; the --filter-mode flip is deprecated — set identity update --phone-filter-mode instead) / release | | | | |
| Number contact rules (deprecated) | number rules list / get / create / update / delete — superseded by identity phone-rules | | | | |
| Contacts | contacts access get/set separates group visibility from per-address communication; set validates a partial JSON access file. contacts create --json accepts nested initial access. Boolean contacts permissions and advanced contacts communication-policy remain supported; list-management includes hidden contacts and optional access settings | | | | |
| Notes | notes list / get / create / update / delete / access list / grant / revoke | | | | |
| Whoami, signing keys, webhooks | inkbox whoami, identity signing-key status/rotation, and webhook verification. Contact enrichment requires Profile access; Memories can further hide memory text. See webhooks | | | | |
| Output conventions | --json preserves existing result shapes; optional response notices go to stderr. Use --json --with-response-metadata for a finite JSON result with data and optional notices | | | | |
