Documentation

Three endpoints and no account. There is not much to learn, so there is not much to read.

Start here

A working mailbox and a message read back, in four commands. Start here if you have never called the API.

All three endpoints with parameters, examples and status codes. The contract, in full.

Rate limit, message size, retention and everything else that is capped. Short page, no surprises.

A mailbox is not created: There is no “create address” call. An address exists the moment mail arrives at it, and stops existing when the last message expires.
The address is the credential: On a public domain, whoever knows the address can read it — through the API exactly as through the site. Use your own domain when that is not acceptable.
Everything expires: Messages are deleted 5 days after they arrive. expires_at is on every message so you never compute it.
Receive only: No endpoint sends mail. That is deliberate: it is what keeps a free, unauthenticated service from becoming a spam relay.

If a call behaves differently from this documentation, the documentation is the bug — tell us and it gets fixed.

Mail never arrives: Check the MX record first: smtp.grabmail.io and nothing else. A leftover MX from a previous provider takes part of your traffic silently.
The API answers 404: Either the domain is not pointed here, or the message has passed its retention window. The two cases are distinguished by the error slug.
Mail claims to come from us: It is forged. Nothing here can send email — our SPF is v=spf1 -all and our DMARC is p=reject, which tells every receiving server on earth to bin it.