lockally 0.1.0 → 0.3.0

data/spec/api/domains_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com
@@ -32,59 +32,107 @@ describe 'DomainsApi' do
     end
   end
 
-  # unit tests for v1_domains_domain_delete
+  # unit tests for create_domain
+  # Register a domain
+  # Registers a new domain for the calling tenant. Generates a DKIM keypair and verification token. Returns DNS instructions the tenant must publish under their own DNS (verification TXT, SPF include, DKIM TXT, MX records to &#x60;mx1&#x60;/&#x60;mx2.lockally.com&#x60;, DMARC seed).  **Idempotent** — re-posting the same domain returns the existing record with the same DKIM keys and token (regenerating would break the tenant&#39;s published DNS). Returns 200 on idempotent hit, 201 on first create.  Returns 409 if the domain is already claimed by a different tenant. 
+  # @param create_domain_request 
+  # @param [Hash] opts the optional parameters
+  # @return [Domain]
+  describe 'create_domain test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for delete_domain
   # Delete a domain
   # Removes the domain registration. Refuses with 409 if any mailbox is still attached — delete the mailboxes first. 
   # @param domain 
   # @param [Hash] opts the optional parameters
   # @return [nil]
-  describe 'v1_domains_domain_delete test' do
+  describe 'delete_domain test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for disable_return_path
+  # Turn off the custom Return-Path
+  # API mail uses the sender&#39;s own address as the envelope sender again, from the next message. 
+  # @param domain 
+  # @param [Hash] opts the optional parameters
+  # @return [nil]
+  describe 'disable_return_path test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_domains_domain_get
+  # unit tests for enable_return_path
+  # Turn on the custom Return-Path
+  # Moves it to &#x60;pending&#x60; and returns the two records to publish on &#x60;bounces.&lt;domain&gt;&#x60;. Nothing changes for mail until they are confirmed with the verify call. The domain must be verified. Available on every plan except Free. 
+  # @param domain 
+  # @param [Hash] opts the optional parameters
+  # @return [ReturnPath]
+  describe 'enable_return_path test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_domain
   # Get a domain
   # @param domain 
   # @param [Hash] opts the optional parameters
   # @return [Domain]
-  describe 'v1_domains_domain_get test' do
+  describe 'get_domain test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_domains_domain_verify_post
-  # Force-poll DNS verification
-  # Synchronously checks the &#x60;_lockally-verify.&lt;domain&gt;&#x60; TXT record against the stored verification token. Returns 200 either way: the returned &#x60;verified&#x60; boolean tells you whether DNS now confirms. Caller polls until &#x60;verified: true&#x60;. In v2 a background worker auto-polls and fires a &#x60;domain.verified&#x60; webhook. 
+  # unit tests for get_return_path
+  # Get the custom Return-Path
+  # A custom Return-Path moves the envelope sender of mail sent through the API from this domain onto &#x60;bounces.&lt;domain&gt;&#x60;. Bounce reports then come back to Lockally instead of the sending mailbox, and a bounce that arrives after delivery marks the message bounced, suppresses the address and fires &#x60;delivery.bounced&#x60;. Mail sent from webmail or mail apps is not affected. DKIM stays signed by the domain itself. &#x60;status&#x60; is &#x60;off&#x60;, &#x60;pending&#x60; (records not confirmed yet) or &#x60;active&#x60;. 
   # @param domain 
   # @param [Hash] opts the optional parameters
-  # @return [Domain]
-  describe 'v1_domains_domain_verify_post test' do
+  # @return [ReturnPath]
+  describe 'get_return_path test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_domains_get
+  # unit tests for list_domains
   # List domains
   # Returns every domain registered under the calling tenant.
   # @param [Hash] opts the optional parameters
-  # @return [V1DomainsGet200Response]
-  describe 'v1_domains_get test' do
+  # @return [ListDomains200Response]
+  describe 'list_domains test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_domains_post
-  # Register a domain
-  # Registers a new domain for the calling tenant. Generates a DKIM keypair and verification token. Returns DNS instructions the tenant must publish under their own DNS (verification TXT, SPF include, DKIM TXT, MX records to &#x60;mx1&#x60;/&#x60;mx2.lockally.com&#x60;, DMARC seed).  **Idempotent** — re-posting the same domain returns the existing record with the same DKIM keys and token (regenerating would break the tenant&#39;s published DNS). Returns 200 on idempotent hit, 201 on first create.  Returns 409 if the domain is already claimed by a different tenant. 
-  # @param v1_domains_post_request 
+  # unit tests for verify_domain
+  # Force-poll DNS verification
+  # Synchronously checks the &#x60;_lockally-verify.&lt;domain&gt;&#x60; TXT record against the stored verification token. Returns 200 either way: the returned &#x60;verified&#x60; boolean tells you whether DNS now confirms. Caller polls until &#x60;verified: true&#x60;. In v2 a background worker auto-polls and fires a &#x60;domain.verified&#x60; webhook. 
+  # @param domain 
   # @param [Hash] opts the optional parameters
   # @return [Domain]
-  describe 'v1_domains_post test' do
+  describe 'verify_domain test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for verify_return_path
+  # Check the custom Return-Path records
+  # Looks up the MX and SPF records on &#x60;bounces.&lt;domain&gt;&#x60;. Returns 200 either way: while a record is missing the status stays &#x60;pending&#x60; and &#x60;check&#x60; says which one. Once both are found the Return-Path becomes &#x60;active&#x60; and the send path starts using it. 
+  # @param domain 
+  # @param [Hash] opts the optional parameters
+  # @return [ReturnPath]
+  describe 'verify_return_path test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end

data/spec/api/drafts_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com
@@ -32,87 +32,87 @@ describe 'DraftsApi' do
     end
   end
 
-  # unit tests for v1_drafts_draft_id_approve_post
+  # unit tests for approve_draft
   # Approve a pending draft (human)
   # Sends the draft exactly as reviewed, through the agent stream (loop detector included). Fires draft.approved.
   # @param draft_id 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_drafts_draft_id_approve_post test' do
+  # @return [DraftResult]
+  describe 'approve_draft test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_drafts_draft_id_cancel_post
+  # unit tests for cancel_draft
   # Withdraw a pending draft
   # Only the API key that created the draft may cancel it.
   # @param draft_id 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_drafts_draft_id_cancel_post test' do
+  # @return [Draft]
+  describe 'cancel_draft test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_drafts_draft_id_get
-  # Get a draft
-  # @param draft_id 
+  # unit tests for create_conversation_draft
+  # Propose a new conversation as a draft
+  # New-conversation drafts ALWAYS require human approval (policy flag new_thread). Idempotency-Key required.
+  # @param mailbox 
+  # @param idempotency_key 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_drafts_draft_id_get test' do
+  # @return [DraftResult]
+  describe 'create_conversation_draft test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_drafts_draft_id_reject_post
-  # Reject a pending draft (human)
-  # Body: {\&quot;reason\&quot;: \&quot;...\&quot;} (optional). Fires draft.rejected.
-  # @param draft_id 
+  # unit tests for create_reply_draft
+  # Propose a reply as a draft
+  # The safe default over /reply: the deterministic policy engine auto-sends clean in-thread replies and holds anything risky (PII, new recipients, injection-flagged threads, always-approve mailboxes) for human approval. Fires draft.pending_approval when held. Idempotency-Key required.
+  # @param thread_id 
+  # @param idempotency_key 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_drafts_draft_id_reject_post test' do
+  # @return [DraftResult]
+  describe 'create_reply_draft test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_drafts_get
-  # List drafts
-  # Filter with ?status&#x3D;pending_approval|sent|rejected|cancelled. Keys see drafts of granted mailboxes; admin sessions see all.
+  # unit tests for get_draft
+  # Get a draft
+  # @param draft_id 
   # @param [Hash] opts the optional parameters
-  # @option opts [String] :status 
-  # @option opts [Integer] :limit 
-  # @return [Object]
-  describe 'v1_drafts_get test' do
+  # @return [Draft]
+  describe 'get_draft test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_inboxes_mailbox_drafts_post
-  # Propose a new conversation as a draft
-  # New-conversation drafts ALWAYS require human approval (policy flag new_thread). Idempotency-Key required.
-  # @param mailbox 
-  # @param idempotency_key 
+  # unit tests for list_drafts
+  # List drafts
+  # Filter with ?status&#x3D;pending_approval|sent|rejected|cancelled. Keys see drafts of granted mailboxes; admin sessions see all.
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_inboxes_mailbox_drafts_post test' do
+  # @option opts [String] :status 
+  # @option opts [Integer] :limit 
+  # @return [DraftList]
+  describe 'list_drafts test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_threads_thread_id_drafts_post
-  # Propose a reply as a draft
-  # The safe default over /reply: the deterministic policy engine auto-sends clean in-thread replies and holds anything risky (PII, new recipients, injection-flagged threads, always-approve mailboxes) for human approval. Fires draft.pending_approval when held. Idempotency-Key required.
-  # @param thread_id 
-  # @param idempotency_key 
+  # unit tests for reject_draft
+  # Reject a pending draft (human)
+  # Body: {\&quot;reason\&quot;: \&quot;...\&quot;} (optional). Fires draft.rejected.
+  # @param draft_id 
   # @param [Hash] opts the optional parameters
-  # @return [Object]
-  describe 'v1_threads_thread_id_drafts_post test' do
+  # @return [Draft]
+  describe 'reject_draft test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end

data/spec/api/encryption_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com

data/spec/api/health_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com
@@ -32,12 +32,12 @@ describe 'HealthApi' do
     end
   end
 
-  # unit tests for healthz_get
+  # unit tests for health_check
   # Liveness check
   # Returns 200 if the process is up and the database pings cleanly. No authentication required.
   # @param [Hash] opts the optional parameters
-  # @return [HealthzGet200Response]
-  describe 'healthz_get test' do
+  # @return [HealthCheck200Response]
+  describe 'health_check test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end

data/spec/api/ip_pools_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com

data/spec/api/mailboxes_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com
@@ -44,157 +44,157 @@ describe 'MailboxesApi' do
     end
   end
 
-  # unit tests for list_shared_members
-  # List shared mailbox members
-  # @param email 
+  # unit tests for create_mailbox
+  # Create a mailbox
+  # Creates a mailbox on a tenant-verified domain. If &#x60;password&#x60; is omitted, lockally generates a 16-char password and returns it in the response — shown once.  **Gate.** The mailbox&#39;s domain must already be registered AND verified for this tenant (via &#x60;/v1/domains&#x60; + &#x60;/v1/domains/{domain}/verify&#x60;).  **Idempotent.** Re-posting the same email returns the existing mailbox UNTOUCHED — password is NOT regenerated. To change a password, use PATCH instead. 
+  # @param create_mailbox_request 
   # @param [Hash] opts the optional parameters
-  # @return [ListSharedMembers200Response]
-  describe 'list_shared_members test' do
+  # @return [Mailbox]
+  describe 'create_mailbox test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for remove_shared_member
-  # Remove a shared mailbox member
+  # unit tests for delete_mailbox
+  # Soft-delete a mailbox
+  # Sets &#x60;soft_deleted_at &#x3D; now()&#x60; and &#x60;hard_delete_after &#x3D; now() + 90d&#x60; per design D25. A background sweep (planned) will hard-delete after the window. The mailbox is also disabled immediately. 
   # @param email 
-  # @param member_email 
   # @param [Hash] opts the optional parameters
   # @return [nil]
-  describe 'remove_shared_member test' do
+  describe 'delete_mailbox test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_mailboxes_email_delete
-  # Soft-delete a mailbox
-  # Sets &#x60;soft_deleted_at &#x3D; now()&#x60; and &#x60;hard_delete_after &#x3D; now() + 90d&#x60; per design D25. A background sweep (planned) will hard-delete after the window. The mailbox is also disabled immediately. 
+  # unit tests for delete_vacation_responder
+  # Remove the vacation responder
+  # Idempotent — 204 whether or not a row existed.
   # @param email 
   # @param [Hash] opts the optional parameters
   # @return [nil]
-  describe 'v1_mailboxes_email_delete test' do
+  describe 'delete_vacation_responder test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_mailboxes_email_export_download_get
+  # unit tests for download_mailbox_export
   # Download a previously-issued mailbox export
   # Public endpoint (no Authorization header). Validates the one-shot token from the URL, marks it used, and streams an mbox file. Second GET with the same token returns 404 — tokens are single-use. 
   # @param email 
   # @param token 
   # @param [Hash] opts the optional parameters
   # @return [File]
-  describe 'v1_mailboxes_email_export_download_get test' do
+  describe 'download_mailbox_export test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_mailboxes_email_export_post
+  # unit tests for export_mailbox
   # Request a mailbox export
-  # Issues a one-shot \&quot;presigned\&quot; download URL for the mailbox&#39;s content in mbox format. The URL works without an Authorization header — the token in the query string is the authz. TTL is 5 minutes; the token is consumed on first GET.  **v1 caveat:** the synthesized mbox only contains outbound mail (from &#x60;lockally.messages&#x60;). v2 swaps in Stalwart&#39;s export primitive for full inbox + folder structure + flags. The endpoint contract stays unchanged. 
+  # Issues a one-shot \&quot;presigned\&quot; download URL for the mailbox&#39;s content in mbox format. The URL works without an Authorization header — the token in the query string is the authz. TTL is 5 minutes; the token is consumed on first GET.  **v1 caveat:** the synthesized mbox only contains outbound mail (from &#x60;lockally.messages&#x60;). v2 swaps in Stalwart&#39;s export primitive for full inbox + folder structure + flags. The endpoint contract stays unchanged.  **Scope changed:** this used to accept &#x60;mailboxes:read&#x60;. It takes any mailbox in the tenant and returns that mailbox&#39;s mail, so it now requires &#x60;tenant:admin&#x60;, matching &#x60;POST /v1/ediscovery/export&#x60;. A key scoped &#x60;mailboxes:read&#x60; gets 403 and has to be reissued; admin console sessions are unaffected. 
   # @param email 
   # @param [Hash] opts the optional parameters
-  # @return [V1MailboxesEmailExportPost201Response]
-  describe 'v1_mailboxes_email_export_post test' do
+  # @return [ExportMailbox201Response]
+  describe 'export_mailbox test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_mailboxes_email_get
+  # unit tests for get_mailbox
   # Get a mailbox
   # @param email 
   # @param [Hash] opts the optional parameters
   # @return [Mailbox]
-  describe 'v1_mailboxes_email_get test' do
+  describe 'get_mailbox test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_mailboxes_email_patch
-  # Update a mailbox
-  # Supply at least one of &#x60;password&#x60;, &#x60;quota_bytes&#x60;, &#x60;disabled&#x60;. Returns the updated mailbox. 
+  # unit tests for get_vacation_responder
+  # Get the vacation responder
+  # Returns the stored vacation rule or 404 if none is set.
   # @param email 
-  # @param v1_mailboxes_email_patch_request 
   # @param [Hash] opts the optional parameters
-  # @return [Mailbox]
-  describe 'v1_mailboxes_email_patch test' do
+  # @return [VacationResponder]
+  describe 'get_vacation_responder test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_mailboxes_email_vacation_delete
-  # Remove the vacation responder
-  # Idempotent — 204 whether or not a row existed.
-  # @param email 
+  # unit tests for list_mailboxes
+  # List mailboxes
+  # Returns mailboxes under the calling tenant — active and soft-deleted. &#x60;?limit&#x3D;N&#x60; between 1 and 200 (default 50). 
   # @param [Hash] opts the optional parameters
-  # @return [nil]
-  describe 'v1_mailboxes_email_vacation_delete test' do
+  # @option opts [Integer] :limit 
+  # @return [ListMailboxes200Response]
+  describe 'list_mailboxes test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_mailboxes_email_vacation_get
-  # Get the vacation responder
-  # Returns the stored vacation rule or 404 if none is set.
+  # unit tests for list_shared_members
+  # List shared mailbox members
   # @param email 
   # @param [Hash] opts the optional parameters
-  # @return [VacationResponder]
-  describe 'v1_mailboxes_email_vacation_get test' do
+  # @return [ListSharedMembers200Response]
+  describe 'list_shared_members test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_mailboxes_email_vacation_put
-  # Set the vacation responder
-  # Upsert — same endpoint creates or replaces the rule. Clears &#x60;synced_at&#x60;; the rule is staged on lockally until a sync worker pushes it to the mail server. 
-  # @param email 
-  # @param v1_mailboxes_email_vacation_put_request 
+  # unit tests for list_vacation_responders
+  # List all vacation responders
+  # Returns every vacation responder for the calling tenant.
   # @param [Hash] opts the optional parameters
-  # @return [VacationResponder]
-  describe 'v1_mailboxes_email_vacation_put test' do
+  # @return [ListVacationResponders200Response]
+  describe 'list_vacation_responders test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_mailboxes_get
-  # List mailboxes
-  # Returns mailboxes under the calling tenant — active and soft-deleted. &#x60;?limit&#x3D;N&#x60; between 1 and 200 (default 50). 
+  # unit tests for remove_shared_member
+  # Remove a shared mailbox member
+  # @param email 
+  # @param member_email 
   # @param [Hash] opts the optional parameters
-  # @option opts [Integer] :limit 
-  # @return [V1MailboxesGet200Response]
-  describe 'v1_mailboxes_get test' do
+  # @return [nil]
+  describe 'remove_shared_member test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_mailboxes_post
-  # Create a mailbox
-  # Creates a mailbox on a tenant-verified domain. If &#x60;password&#x60; is omitted, lockally generates a 16-char password and returns it in the response — shown once.  **Gate.** The mailbox&#39;s domain must already be registered AND verified for this tenant (via &#x60;/v1/domains&#x60; + &#x60;/v1/domains/{domain}/verify&#x60;).  **Idempotent.** Re-posting the same email returns the existing mailbox UNTOUCHED — password is NOT regenerated. To change a password, use PATCH instead. 
-  # @param v1_mailboxes_post_request 
+  # unit tests for set_vacation_responder
+  # Set the vacation responder
+  # Upsert — same endpoint creates or replaces the rule. Clears &#x60;synced_at&#x60;; the rule is staged on lockally until a sync worker pushes it to the mail server. 
+  # @param email 
+  # @param set_vacation_responder_request 
   # @param [Hash] opts the optional parameters
-  # @return [Mailbox]
-  describe 'v1_mailboxes_post test' do
+  # @return [VacationResponder]
+  describe 'set_vacation_responder test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end
   end
 
-  # unit tests for v1_vacation_get
-  # List all vacation responders
-  # Returns every vacation responder for the calling tenant.
+  # unit tests for update_mailbox
+  # Update a mailbox
+  # Supply at least one of &#x60;password&#x60;, &#x60;quota_bytes&#x60;, &#x60;disabled&#x60;. Returns the updated mailbox. 
+  # @param email 
+  # @param update_mailbox_request 
   # @param [Hash] opts the optional parameters
-  # @return [V1VacationGet200Response]
-  describe 'v1_vacation_get test' do
+  # @return [Mailbox]
+  describe 'update_mailbox test' do
     it 'should work' do
       # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
     end

data/spec/api/migrations_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com

data/spec/api/resources_api_spec.rb

@@ -1,7 +1,7 @@
 =begin
 #lockally control plane
 
-#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`. Generate the first key for a tenant via `cmd/seed`; subsequent keys via `POST /v1/api-keys`.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
 
 The version of the OpenAPI document: 0.1.0
 Contact: support@lockally.com