# Inbound API

Narrative guide: [Inbound mail](/inbound). MX belongs on `in.<domain>` only.

## Mailbox

| Method | Path |
| --- | --- |
| `GET` | `/api/practices/{id}/inbound` |
| `POST` | `/api/practices/{id}/inbound/enable` |
| `POST` | `/api/practices/{id}/inbound/disable` |
| `POST` | `/api/practices/{id}/inbound/check` |
| `POST` | `/api/practices/{id}/inbound/apply-dns` |
| `PATCH` | `/api/practices/{id}/inbound` |
| `GET` | `/api/practices/{id}/inbound/messages` |
| `GET` | `/api/practices/{id}/inbound/messages/{messageID}` |

`enable` returns the MX records to publish. `apply-dns` writes them when Cloudflare apply is enabled for the tenant.

## Send hooks

| Method | Path |
| --- | --- |
| `GET` | `/api/practices/{id}/inbound-hooks` |
| `POST` | `/api/practices/{id}/inbound-hooks` |
| `DELETE` | `/api/practices/{id}/inbound-hooks/{hookID}` |
| `POST` | `/api/practices/{id}/inbound-hooks/{hookID}/rotate` |
| `POST` | `/api/practices/{id}/inbound-hooks/{hookID}/test` |

Public send:

```
POST /api/public/hooks/{practiceID}/send
X-Werkmail-Hook-Secret: hooksec_…
```

Body matches [Send](/api/send) (to, subject, text/html, `message_kind`, optional attachments). Idempotency headers are honoured.

The path uses the **workspace id**, not the hook row id.