Personal account
A personal Mail account is owned by a single Lucion Identity subject. API key records point to that account. Message reads and sends always use the server-resolved account context.
Address ownership
A Mail account may have owned addresses and aliases. A send is authorized only when the requested sender address belongs to that account. The key holder cannot submit an account ID to borrow another user’s address.
Message representation
Read responses include common headers, body text, preview, message flags, delivery status, and lifecycle timestamps. Missing lifecycle values can be null. Attachment data is metadata only.
Organization mailbox boundary
Shared and organization mailboxes are not accessible through API keys in v1. This is an explicit product boundary. Organization access in interactive Mail follows separate Identity organization authorization.
Data handling
API responses may contain personal data and confidential correspondence. Store only what the integration needs, define a retention period, restrict staff access, and delete or anonymize copies when they are no longer required.