emailengine-app 2.68.1 → 2.70.0

package/workers/api.js

@@ -1,8 +1,6 @@
 'use strict';
 
-// NB! This file is processed by gettext parser and can not use newer syntax like ?.
-
-const { parentPort } = require('worker_threads');
+const { parentPort, workerData } = require('worker_threads');
 
 const packageData = require('../package.json');
 const config = require('@zone-eu/wild-config');
@@ -24,49 +22,24 @@ const eulaText = marked.parse(
 const {
     getByteSize,
     getDuration,
-    getStats,
     flash,
     failAction,
-    verifyAccountInfo,
     isEmail,
-    getLogs,
     getWorkerCount,
     runPrechecks,
     matcher,
     readEnvValue,
-    getSignedFormData,
     threadStats,
     hasEnvValue,
     getBoolean,
     loadTlsConfig,
-    httpAgent,
-    reloadHttpProxyAgent,
+    maybeReloadHttpProxyAgent,
     resolveOAuthErrorStatus
 } = require('../lib/tools');
 const { matchIp, detectAutomatedRequest } = require('../lib/utils/network');
 
-const Bugsnag = require('@bugsnag/js');
-if (readEnvValue('BUGSNAG_API_KEY')) {
-    Bugsnag.start({
-        apiKey: readEnvValue('BUGSNAG_API_KEY'),
-        appVersion: packageData.version,
-        logger: {
-            debug(...args) {
-                logger.debug({ msg: args.shift(), worker: 'api', source: 'bugsnag', args: args.length ? args : undefined });
-            },
-            info(...args) {
-                logger.debug({ msg: args.shift(), worker: 'api', source: 'bugsnag', args: args.length ? args : undefined });
-            },
-            warn(...args) {
-                logger.warn({ msg: args.shift(), worker: 'api', source: 'bugsnag', args: args.length ? args : undefined });
-            },
-            error(...args) {
-                logger.error({ msg: args.shift(), worker: 'api', source: 'bugsnag', args: args.length ? args : undefined });
-            }
-        }
-    });
-    logger.notifyError = Bugsnag.notify.bind(Bugsnag);
-}
+const { initSentry } = require('../lib/sentry');
+initSentry('api');
 
 const Hapi = require('@hapi/hapi');
 const Boom = require('@hapi/boom');
@@ -84,20 +57,13 @@ const pathlib = require('path');
 const crypto = require('crypto');
 const { Transform, finished } = require('stream');
 const { oauth2Apps, OAUTH_PROVIDERS } = require('../lib/oauth2-apps');
-const { verifyOAuth2App } = require('../lib/oauth/verify-app');
 
 const handlebars = require('handlebars');
 const AuthBearer = require('hapi-auth-bearer-token');
 const tokens = require('../lib/tokens');
-const { autodetectImapSettings } = require('../lib/autodetect-imap-settings');
 
-const outbox = require('../lib/outbox');
-
-const { lists } = require('../lib/lists');
-
-const { redis, documentsQueue, notifyQueue, submitQueue } = require('../lib/db');
+const { redis, documentsQueue } = require('../lib/db');
 const { Account } = require('../lib/account');
-const { Gateway } = require('../lib/gateway');
 const settings = require('../lib/settings');
 
 const getSecret = require('../lib/get-secret');
@@ -114,7 +80,6 @@ const {
     TRACK_OPEN_NOTIFY,
     TRACK_CLICK_NOTIFY,
     REDIS_PREFIX,
-    MAX_DAYS_STATS,
     RENEW_TLS_AFTER,
     BLOCK_TLS_RENEW,
     TLS_RENEW_CHECK_INTERVAL,
@@ -128,45 +93,27 @@ const {
     NONCE_BYTES
 } = consts;
 
-const { fetch: fetchCmd } = require('undici');
-
 const templateRoutes = require('../lib/api-routes/template-routes');
 const chatRoutes = require('../lib/api-routes/chat-routes');
 const bullBoardRoutes = require('../lib/api-routes/bull-board-routes');
 const accountRoutes = require('../lib/api-routes/account-routes');
 const messageRoutes = require('../lib/api-routes/message-routes');
 const exportRoutes = require('../lib/api-routes/export-routes');
-
-const {
-    settingsSchema,
-    addressSchema,
-    settingsQuerySchema,
-    imapSchema,
-    smtpSchema,
-    oauth2Schema,
-    mailboxesSchema,
-    shortMailboxesSchema,
-    licenseSchema,
-    lastErrorSchema,
-    templateSchemas,
-    accountSchemas,
-    oauthCreateSchema,
-    tokenRestrictionsSchema,
-    accountIdSchema,
-    ipSchema,
-    accountPathSchema,
-    defaultAccountTypeSchema,
-    fromAddressSchema,
-    outboxEntrySchema,
-    googleProjectIdSchema,
-    googleWorkspaceAccountsSchema,
-    googleTopicNameSchema,
-    googleSubscriptionNameSchema,
-    messageReferenceSchema,
-    idempotencyKeySchema,
-    headerTimeoutSchema,
-    pubSubErrorSchema
-} = require('../lib/schemas');
+const pubsubRoutes = require('../lib/api-routes/pubsub-routes');
+const tokenRoutes = require('../lib/api-routes/token-routes');
+const mailboxRoutes = require('../lib/api-routes/mailbox-routes');
+const settingsRoutes = require('../lib/api-routes/settings-routes');
+const statsRoutes = require('../lib/api-routes/stats-routes');
+const licenseRoutes = require('../lib/api-routes/license-routes');
+const outboxRoutes = require('../lib/api-routes/outbox-routes');
+const webhookRouteRoutes = require('../lib/api-routes/webhook-route-routes');
+const oauth2AppRoutes = require('../lib/api-routes/oauth2-app-routes');
+const gatewayRoutes = require('../lib/api-routes/gateway-routes');
+const deliveryTestRoutes = require('../lib/api-routes/delivery-test-routes');
+const blocklistRoutes = require('../lib/api-routes/blocklist-routes');
+const submitRoutes = require('../lib/api-routes/submit-routes');
+
+const { imapSchema, smtpSchema, oauth2Schema, accountIdSchema, headerTimeoutSchema, errorResponses } = require('../lib/schemas');
 
 const OAuth2ProviderSchema = Joi.string()
     .valid(...Object.keys(OAUTH_PROVIDERS))
@@ -176,27 +123,14 @@ const OAuth2ProviderSchema = Joi.string()
     .label('OAuth2Provider');
 
 const AccountTypeSchema = Joi.string()
-    .valid(...['imap'].concat(Object.keys(OAUTH_PROVIDERS)).concat('oauth2'))
+    .valid(...['imap'].concat(Object.keys(OAUTH_PROVIDERS)).concat(['oauth2', 'delegated', 'sending', 'invalid']))
     .example('outlook')
-    .description('Account type')
+    .description(
+        'Account type: "imap" for IMAP accounts, an OAuth2 provider name for OAuth2 accounts, "oauth2" when the OAuth2 application is missing, "delegated" for delegated accounts, "sending" for send-only accounts, "invalid" when delegation cannot be resolved'
+    )
     .required()
     .label('AccountType');
 
-function flattenOAuthAppMeta(app) {
-    if (!app.meta) {
-        return;
-    }
-    let authFlag = app.meta.authFlag;
-    let pubSubFlag = app.meta.pubSubFlag;
-    delete app.meta;
-    if (authFlag && authFlag.message) {
-        app.lastError = { response: authFlag.message };
-    }
-    if (pubSubFlag && pubSubFlag.message) {
-        app.pubSubError = { message: pubSubFlag.message, description: pubSubFlag.description || null };
-    }
-}
-
 const SUPPORTED_LOCALES = locales.map(locale => locale.locale);
 
 const FLAG_SORT_ORDER = ['\\Inbox', '\\Flagged', '\\Sent', '\\Drafts', '\\All', '\\Archive', '\\Junk', '\\Trash'];
@@ -260,6 +194,15 @@ const API_TLS = hasEnvValue('EENGINE_API_TLS') ? getBoolean(readEnvValue('EENGIN
 // Merge TLS settings from config params and environment
 loadTlsConfig(API_TLS, 'EENGINE_API_TLS_');
 
+// Per-worker thread metadata. With multiple API workers (EENGINE_WORKERS_API > 1) the
+// main thread assigns each one an index and whether to bind with SO_REUSEPORT. Only
+// worker 0 runs singleton maintenance tasks (e.g. TLS certificate renewal).
+const WORKER_INDEX = (workerData && workerData.workerIndex) || 0;
+const USE_REUSE_PORT = !!(workerData && workerData.reusePort);
+// Worker 0 is the primary; it runs singleton maintenance tasks (e.g. TLS certificate renewal)
+// that must execute exactly once across all API workers.
+const IS_PRIMARY_API_WORKER = WORKER_INDEX === 0;
+
 const ADMIN_ACCESS_ADDRESSES = hasEnvValue('EENGINE_ADMIN_ACCESS_ADDRESSES')
     ? readEnvValue('EENGINE_ADMIN_ACCESS_ADDRESSES')
           .split(',')
@@ -542,6 +485,11 @@ parentPort.on('message', message => {
     if (message && message.cmd === 'change') {
         publishChangeEvent(message);
     }
+
+    if (message && message.cmd === 'settings') {
+        // Keep this worker's in-memory HTTP proxy agent in sync when proxy settings change
+        maybeReloadHttpProxyAgent(message.data);
+    }
 });
 
 const init = async () => {
@@ -620,11 +568,8 @@ const init = async () => {
         return formatter.format(intVal);
     });
 
-    const server = Hapi.server({
-        port: API_PORT,
-        host: API_HOST,
-        tls: API_TLS,
-
+    // Base Hapi options shared by both the default and SO_REUSEPORT binding paths
+    const serverOptions = {
         state: {
             strictHeader: false
         },
@@ -646,7 +591,27 @@ const init = async () => {
                 }).unknown()
             }
         }
-    });
+    };
+
+    // With multiple API workers we provide our own listener and bind it ourselves with
+    // SO_REUSEPORT so the kernel load-balances connections. Hapi forbids port/host when
+    // autoListen is false and needs a truthy `tls` flag to treat a provided HTTPS
+    // listener correctly. The single-worker path keeps Hapi's default binding unchanged.
+    let reusePortListener = null;
+    if (USE_REUSE_PORT) {
+        const http = require('http');
+        const https = require('https');
+        reusePortListener = API_TLS ? https.createServer(API_TLS) : http.createServer();
+        serverOptions.listener = reusePortListener;
+        serverOptions.tls = !!API_TLS;
+        serverOptions.autoListen = false;
+    } else {
+        serverOptions.port = API_PORT;
+        serverOptions.host = API_HOST;
+        serverOptions.tls = API_TLS;
+    }
+
+    const server = Hapi.server(serverOptions);
 
     let assertPreconditionResult;
     server.decorate('toolkit', 'getESClient', async (...args) => await getESClient(...args));
@@ -1132,6 +1097,12 @@ Include your token in requests using one of these methods:
                 };
             }
 
+            // Bind the token hash (id) to the request logger so it is included in the per-request
+            // log entry, allowing API requests to be correlated to the token that made them.
+            if (request.logger && typeof request.logger.setBindings === 'function') {
+                request.logger.setBindings({ tokenId: tokenData.id, tokenAccount: tokenData.account || null });
+            }
+
             if (scope && tokenData.scopes && !tokenData.scopes.includes(scope) && !tokenData.scopes.includes('*')) {
                 // failed scope validation
                 logger.error({
@@ -1620,99 +1591,6 @@ Include your token in requests using one of these methods:
         }
     });
 
-    server.route({
-        method: 'GET',
-        path: '/v1/pubsub/status',
-
-        async handler(request) {
-            try {
-                let response = await oauth2Apps.list(request.query.page, request.query.pageSize, { pubsub: true });
-
-                let apps = response.apps.map(app => {
-                    flattenOAuthAppMeta(app);
-                    return { id: app.id, name: app.name || null, lastError: app.lastError || null, pubSubError: app.pubSubError || null };
-                });
-
-                return {
-                    total: response.total,
-                    page: response.page,
-                    pages: response.pages,
-                    apps
-                };
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'List Pub/Sub status',
-            notes: 'Lists Pub/Sub enabled OAuth2 applications and their subscription status',
-            tags: ['api', 'OAuth2 Applications'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                query: Joi.object({
-                    page: Joi.number()
-                        .integer()
-                        .min(0)
-                        .max(1024 * 1024)
-                        .default(0)
-                        .example(0)
-                        .description('Page number (zero indexed, so use 0 for first page)')
-                        .label('PageNumber'),
-                    pageSize: Joi.number().integer().min(1).max(1000).default(20).example(20).description('How many entries per page').label('PageSize')
-                }).label('PubSubStatusFilter')
-            },
-
-            response: {
-                schema: Joi.object({
-                    total: Joi.number().integer().example(120).description('How many matching entries').label('TotalNumber'),
-                    page: Joi.number().integer().example(0).description('Current page (0-based index)').label('PageNumber'),
-                    pages: Joi.number().integer().example(24).description('Total page count').label('PagesNumber'),
-
-                    apps: Joi.array()
-                        .items(
-                            Joi.object({
-                                id: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID'),
-                                name: Joi.string().allow(null).max(256).example('My Gmail App').description('Display name for the app'),
-                                lastError: Joi.object({
-                                    response: Joi.string().example('Enable the Cloud Pub/Sub API').description('Setup error message')
-                                })
-                                    .allow(null)
-                                    .description('Setup error from ensurePubsub, if any')
-                                    .label('PubSubSetupError'),
-                                pubSubError: pubSubErrorSchema.allow(null)
-                            }).label('PubSubAppStatus')
-                        )
-                        .label('PubSubAppStatusList')
-                }).label('PubSubStatusResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
     server.route({
         method: 'GET',
         path: '/redirect',
@@ -2657,4282 +2535,152 @@ Include your token in requests using one of these methods:
         }
     });
 
-    server.route({
-        method: 'POST',
-        path: '/v1/token',
-
-        async handler(request) {
-            let accountObject = new Account({
-                redis,
-                account: request.payload.account,
-                call,
-                secret: await getSecret(),
-                timeout: request.headers['x-ee-timeout']
-            });
-
-            try {
-                // throws if account does not exist
-                await accountObject.loadAccountData();
-
-                let token = await tokens.provision(Object.assign({}, request.payload, { remoteAddress: request.app.ip }));
-
-                return { token };
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'Provision an access token',
-            notes: 'Provisions a new access token for an account',
-            tags: ['api', 'Access Tokens'],
+    // setup template routes
+    await templateRoutes({ server, call, CORS_CONFIG });
 
-            plugins: {},
+    // setup "chat with email" routes
+    await chatRoutes({ server, call, CORS_CONFIG });
 
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
+    // setup account CRUD routes
+    await accountRoutes({
+        server,
+        call,
+        documentsQueue,
+        oauth2Schema,
+        imapSchema,
+        smtpSchema,
+        CORS_CONFIG,
+        AccountTypeSchema,
+        OAuth2ProviderSchema,
+        metrics
+    });
 
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
+    // setup message routes
+    await messageRoutes({
+        server,
+        call,
+        CORS_CONFIG,
+        MAX_ATTACHMENT_SIZE,
+        MAX_BODY_SIZE,
+        MAX_PAYLOAD_TIMEOUT
+    });
 
-                payload: Joi.object({
-                    account: accountIdSchema.required(),
+    // setup export routes
+    await exportRoutes({
+        server,
+        CORS_CONFIG
+    });
 
-                    description: Joi.string().empty('').trim().max(1024).required().example('Token description').description('Token description'),
+    // setup Pub/Sub status route
+    await pubsubRoutes({ server, CORS_CONFIG });
 
-                    scopes: Joi.array()
-                        .items(Joi.string().valid('api', 'smtp', 'imap-proxy').label('TokenScope'))
-                        .single()
-                        .default(['api'])
-                        .required()
-                        .description(
-                            'Token permission scopes: "api" for REST API access, "smtp" for SMTP submission, "imap-proxy" for IMAP proxy authentication'
-                        )
-                        .label('Scopes'),
+    // setup access token routes
+    await tokenRoutes({ server, call, CORS_CONFIG });
 
-                    metadata: Joi.string()
-                        .empty('')
-                        .max(1024 * 1024)
-                        .custom((value, helpers) => {
-                            try {
-                                // check if parsing fails
-                                JSON.parse(value);
-                                return value;
-                            } catch (err) {
-                                return helpers.message('Metadata must be a valid JSON string');
-                            }
-                        })
-                        .example('{"example": "value"}')
-                        .description('Related metadata in JSON format')
-                        .label('JsonMetaData'),
+    // setup mailbox routes
+    await mailboxRoutes({ server, call, CORS_CONFIG, FLAG_SORT_ORDER });
 
-                    restrictions: tokenRestrictionsSchema,
+    // setup settings routes
+    await settingsRoutes({ server, notify, CORS_CONFIG });
 
-                    ip: ipSchema.description('IP address of the requester').label('TokenIP')
-                }).label('CreateToken')
-            },
+    // setup stats route
+    await statsRoutes({ server, call, CORS_CONFIG });
 
-            response: {
-                schema: Joi.object({
-                    token: Joi.string().length(64).hex().required().example('123456').description('Access token')
-                }).label('CreateTokenResponse'),
-                failAction: 'log'
-            }
-        }
-    });
+    // setup license routes
+    await licenseRoutes({ server, call, CORS_CONFIG });
 
-    server.route({
-        method: 'DELETE',
-        path: '/v1/token/{token}',
+    // setup outbox routes
+    await outboxRoutes({ server, CORS_CONFIG });
 
-        async handler(request) {
-            try {
-                return { deleted: await tokens.delete(request.params.token, { remoteAddress: request.app.ip }) };
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Remove a token',
-            notes: 'Delete an access token',
-            tags: ['api', 'Access Tokens'],
+    // setup webhook route management routes
+    await webhookRouteRoutes({ server, CORS_CONFIG });
 
-            plugins: {},
+    // setup OAuth2 application routes
+    await oauth2AppRoutes({ server, call, CORS_CONFIG, OAuth2ProviderSchema });
 
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
+    // setup SMTP gateway routes
+    await gatewayRoutes({ server, call, CORS_CONFIG });
 
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
+    // setup delivery test routes
+    await deliveryTestRoutes({ server, call, CORS_CONFIG, SMTP_TEST_HOST });
 
-                params: Joi.object({
-                    token: Joi.string().length(64).hex().required().example('123456').description('Access token')
-                }).label('DeleteTokenRequest')
-            },
+    // setup blocklist routes
+    await blocklistRoutes({ server, call, CORS_CONFIG });
 
-            response: {
-                schema: Joi.object({
-                    deleted: Joi.boolean().truthy('Y', 'true', '1').falsy('N', 'false', 0).default(true).description('Was the token deleted')
-                }).label('DeleteTokenRequestResponse'),
-                failAction: 'log'
-            }
-        }
-    });
+    // setup message submit route
+    await submitRoutes({ server, call, CORS_CONFIG, MAX_ATTACHMENT_SIZE, MAX_BODY_SIZE, MAX_PAYLOAD_TIMEOUT });
 
     server.route({
         method: 'GET',
-        path: '/v1/tokens',
+        path: '/v1/changes',
 
-        async handler(request) {
-            try {
-                // TODO: allow paging
-                return { tokens: (await tokens.list(null, 0, 1000)).tokens };
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
+        async handler(request, h) {
+            request.app.stream = new ResponseStream();
+            finished(request.app.stream, err => request.app.stream.finalize(err));
+            setImmediate(() => {
+                try {
+                    request.app.stream.write(`: EmailEngine v${packageData.version}\n\n`);
+                } catch (err) {
+                    // ignore
                 }
-                throw error;
-            }
+            });
+            return h
+                .response(request.app.stream)
+                .header('X-Accel-Buffering', 'no')
+                .header('Connection', 'keep-alive')
+                .header('Cache-Control', 'no-cache')
+                .type('text/event-stream');
         },
 
         options: {
-            description: 'List root tokens',
-            notes: 'Lists access tokens registered for root access',
-            tags: ['api', 'Access Tokens'],
+            description: 'Stream state changes',
+            notes: 'Stream account state changes as an EventSource',
+            tags: ['api', 'Account'],
 
-            plugins: {},
+            plugins: {
+                'hapi-swagger': {
+                    produces: ['text/event-stream'],
+                    responses: errorResponses(401, 403, 429, 500)
+                }
+            },
 
             auth: {
                 strategy: 'api-token',
                 mode: 'required'
             },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction
-            },
-
-            response: {
-                schema: Joi.object({
-                    tokens: Joi.array()
-                        .items(
-                            Joi.object({
-                                account: accountIdSchema.required(),
-                                description: Joi.string().empty('').trim().max(1024).required().example('Token description').description('Token description'),
-                                metadata: Joi.string()
-                                    .empty('')
-                                    .max(1024 * 1024)
-                                    .custom((value, helpers) => {
-                                        try {
-                                            // check if parsing fails
-                                            JSON.parse(value);
-                                            return value;
-                                        } catch (err) {
-                                            return helpers.message('Metadata must be a valid JSON string');
-                                        }
-                                    })
-                                    .example('{"example": "value"}')
-                                    .description('Related metadata in JSON format')
-                                    .label('JsonMetaData'),
-                                ip: ipSchema.description('IP address of the requester').label('TokenIP')
-                            }).label('RootTokensItem')
-                        )
-                        .label('RootTokensEntries')
-                }).label('RootTokensResponse'),
-                failAction: 'log'
-            }
+            cors: CORS_CONFIG
         }
     });
 
-    server.route({
-        method: 'GET',
-        path: '/v1/tokens/account/{account}',
+    // Web UI routes
 
-        async handler(request) {
-            try {
-                // TODO: allow paging
-                return { tokens: (await tokens.list(request.params.account, 0, 1000)).tokens };
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
+    await server.register({
+        plugin: Crumb,
 
         options: {
-            description: 'List account tokens',
-            notes: 'Lists access tokens registered for an account',
-            tags: ['api', 'Access Tokens'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
+            cookieOptions: {
+                isSecure: secureCookie
             },
-            cors: CORS_CONFIG,
 
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-                params: Joi.object({
-                    account: accountIdSchema.required()
-                })
-            },
+            skip: (request /*, h*/) => {
+                let tags = (request.route && request.route.settings && request.route.settings.tags) || [];
+
+                if (tags.includes('api') || tags.includes('scope:metrics') || tags.includes('static') || tags.includes('external')) {
+                    return true;
+                }
 
-            response: {
-                schema: Joi.object({
-                    tokens: Joi.array()
-                        .items(
-                            Joi.object({
-                                account: accountIdSchema.required(),
-                                description: Joi.string().empty('').trim().max(1024).required().example('Token description').description('Token description'),
-                                metadata: Joi.string()
-                                    .empty('')
-                                    .max(1024 * 1024)
-                                    .custom((value, helpers) => {
-                                        try {
-                                            // check if parsing fails
-                                            JSON.parse(value);
-                                            return value;
-                                        } catch (err) {
-                                            return helpers.message('Metadata must be a valid JSON string');
-                                        }
-                                    })
-                                    .example('{"example": "value"}')
-                                    .description('Related metadata in JSON format')
-                                    .label('JsonMetaData'),
-
-                                restrictions: tokenRestrictionsSchema,
-
-                                ip: ipSchema.description('IP address of the requester').label('TokenIP')
-                            }).label('AccountTokensItem')
-                        )
-                        .label('AccountTokensEntries')
-                }).label('AccountsTokensResponse'),
-                failAction: 'log'
+                return false;
             }
         }
     });
 
-    server.route({
-        method: 'POST',
-        path: '/v1/authentication/form',
-
-        async handler(request) {
-            try {
-                let { data, signature } = await getSignedFormData({
-                    account: request.payload.account,
-                    name: request.payload.name,
-                    email: request.payload.email,
-                    syncFrom: request.payload.syncFrom,
-                    notifyFrom: request.payload.notifyFrom,
-                    subconnections: request.payload.subconnections,
-                    redirectUrl: request.payload.redirectUrl,
-                    delegated: request.payload.delegated,
-                    path: request.payload.path && !request.payload.path.includes('*') ? request.payload.path : null,
-                    // identify request
-                    n: crypto.randomBytes(NONCE_BYTES).toString('base64url'),
-                    t: Date.now()
-                });
-
-                let serviceUrl = await settings.get('serviceUrl');
-                if (!serviceUrl) {
-                    let err = new Error('Service URL not set up');
-                    err.code = 'MissingServiceURLSetup';
-                    throw err;
-                }
-
-                let url = new URL(`accounts/new`, serviceUrl);
-
-                url.searchParams.append('data', data);
-                if (signature) {
-                    url.searchParams.append('sig', signature);
-                }
-
-                let type = request.payload.type;
-
-                if (type && type !== 'imap') {
-                    let oauth2app = await oauth2Apps.get(type);
-                    if (!oauth2app || !oauth2app.enabled) {
-                        type = false;
-                    }
-                }
-
-                if (!type) {
-                    let oauth2apps = (await oauth2Apps.list(0, 100)).apps.filter(app => app.includeInListing);
-                    if (!oauth2apps.length) {
-                        type = 'imap';
-                    }
-                }
-
-                if (type) {
-                    url.searchParams.append('type', type);
-                }
-
-                return {
-                    url: url.href
-                };
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'Generate authentication link',
-            notes: 'Generates a redirect link to the hosted authentication form',
-            tags: ['api', 'Account'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                payload: Joi.object({
-                    account: Joi.string()
-                        .empty('')
-                        .trim()
-                        .max(256)
-                        .allow(null)
-                        .example('example')
-                        .default(null)
-                        .description(
-                            'Account ID. If set to `null`, a unique ID will be generated automatically. If you provide an existing account ID, the settings for that account will be updated instead'
-                        ),
-
-                    name: Joi.string().empty('').max(256).example('My Email Account').description('Display name for the account'),
-
-                    email: Joi.string()
-                        .empty('')
-                        .email()
-                        .example('user@example.com')
-                        .description('Specifies the default email address for this account. Users can change it if needed.'),
-
-                    delegated: Joi.boolean()
-                        .empty('')
-                        .truthy('Y', 'true', '1')
-                        .falsy('N', 'false', 0)
-                        .default(false)
-                        .description('If true, configures this account as a shared mailbox. Currently supported by MS365 OAuth2 accounts'),
-
-                    syncFrom: accountSchemas.syncFrom,
-                    notifyFrom: accountSchemas.notifyFrom,
-
-                    subconnections: accountSchemas.subconnections,
-
-                    path: accountPathSchema.example(['*']).label('AccountFormPath'),
-                    redirectUrl: Joi.string()
-                        .empty('')
-                        .uri({ scheme: ['http', 'https'], allowRelative: false })
-                        .required()
-                        .example('https://myapp/account/settings.php')
-                        .description('After the authentication process is completed, the user is redirected to this URL'),
-
-                    type: defaultAccountTypeSchema
-                }).label('RequestAuthForm')
-            },
-
-            response: {
-                schema: Joi.object({
-                    url: Joi.string()
-                        .empty('')
-                        .uri({ scheme: ['http', 'https'], allowRelative: false })
-                        .required()
-                        .example('https://ee.example.com/accounts/new?data=eyJhY2NvdW50IjoiZXhh...L0W_BkFH5HW6Krwmr7c&type=imap')
-                        .description('Generated URL to the hosted authentication form')
-                }).label('RequestAuthFormResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/account/{account}/mailboxes',
-
-        async handler(request) {
-            let accountObject = new Account({
-                redis,
-                account: request.params.account,
-                call,
-                secret: await getSecret(),
-                timeout: request.headers['x-ee-timeout']
-            });
-
-            try {
-                let mailboxes = await accountObject.getMailboxListing(request.query);
-
-                if (mailboxes && Array.isArray(mailboxes)) {
-                    mailboxes = mailboxes.sort((a, b) => {
-                        if (a.specialUse && !b.specialUse) {
-                            return -1;
-                        }
-                        if (!a.specialUse && b.specialUse) {
-                            return 1;
-                        }
-                        if (a.specialUse && b.specialUse) {
-                            return FLAG_SORT_ORDER.indexOf(a.specialUse) - FLAG_SORT_ORDER.indexOf(b.specialUse);
-                        }
-
-                        return a.path.localeCompare(b.path);
-                    });
-                }
-
-                return { mailboxes };
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'List mailboxes',
-            notes: 'Lists all available mailboxes',
-            tags: ['api', 'Mailbox'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    account: accountIdSchema.required()
-                }),
-
-                query: Joi.object({
-                    counters: Joi.boolean()
-                        .truthy('Y', 'true', '1')
-                        .falsy('N', 'false', 0)
-                        .default(false)
-                        .description('If true, then includes message counters in the response')
-                        .label('MailboxCounters')
-                }).label('MailboxListQuery')
-            },
-
-            response: {
-                schema: Joi.object({
-                    mailboxes: mailboxesSchema
-                }).label('MailboxesFilterResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'POST',
-        path: '/v1/account/{account}/mailbox',
-
-        async handler(request) {
-            let accountObject = new Account({
-                redis,
-                account: request.params.account,
-                call,
-                secret: await getSecret(),
-                timeout: request.headers['x-ee-timeout']
-            });
-
-            try {
-                return await accountObject.createMailbox(request.payload.path);
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                if (err.info) {
-                    error.output.payload.details = err.info;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'Create mailbox',
-            notes: 'Create new mailbox folder',
-            tags: ['api', 'Mailbox'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    account: accountIdSchema.required()
-                }),
-
-                payload: Joi.object({
-                    path: Joi.array()
-                        .items(Joi.string().max(256))
-                        .single()
-                        .example(['Parent folder', 'Subfolder'])
-                        .description('Mailbox path as an array or a string. If account is namespaced then namespace prefix is added by default.')
-                        .label('MailboxPath')
-                }).label('CreateMailbox')
-            },
-
-            response: {
-                schema: Joi.object({
-                    path: Joi.string().required().example('Kalender/S&APw-nnip&AOQ-evad').description('Full path to mailbox').label('MailboxPath'),
-                    mailboxId: Joi.string().example('1439876283476').description('Mailbox ID (if server has support)').label('MailboxId'),
-                    created: Joi.boolean().example(true).description('Was the mailbox created')
-                }).label('CreateMailboxResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'PUT',
-        path: '/v1/account/{account}/mailbox',
-
-        async handler(request) {
-            let accountObject = new Account({
-                redis,
-                account: request.params.account,
-                call,
-                secret: await getSecret(),
-                timeout: request.headers['x-ee-timeout']
-            });
-
-            try {
-                return await accountObject.modifyMailbox(request.payload.path, request.payload.newPath, request.payload.subscribed);
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                if (err.info) {
-                    error.output.payload.details = err.info;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'Modify mailbox',
-            notes: 'Modify an existing mailbox folder (rename or change subscription status)',
-            tags: ['api', 'Mailbox'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    account: accountIdSchema.required()
-                }),
-
-                payload: Joi.object({
-                    path: Joi.string().required().example('Folder Name').description('Mailbox folder path to modify').label('ExistingMailboxPath'),
-                    newPath: Joi.array()
-                        .items(Joi.string().max(256))
-                        .single()
-                        .example(['Parent folder', 'Subfolder'])
-                        .description('New mailbox path as an array or a string. If account is namespaced then namespace prefix is added by default. Optional.')
-                        .label('TargetMailboxPath'),
-                    subscribed: Joi.boolean()
-                        .example(true)
-                        .description('Change mailbox subscription status. Only applies to IMAP accounts, ignored for Gmail and Outlook.')
-                        .label('SubscriptionStatus')
-                })
-                    .or('newPath', 'subscribed')
-                    .label('ModifyMailbox')
-            },
-
-            response: {
-                schema: Joi.object({
-                    path: Joi.string().required().example('Mail').description('Mailbox folder path').label('ExistingMailboxPath'),
-                    newPath: Joi.string().example('Kalender/S&APw-nnip&AOQ-evad').description('Full path to mailbox if renamed').label('NewMailboxPath'),
-                    renamed: Joi.boolean().example(true).description('Was the mailbox renamed'),
-                    subscribed: Joi.boolean().example(true).description('Subscription status after modification')
-                }).label('ModifyMailboxResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'DELETE',
-        path: '/v1/account/{account}/mailbox',
-
-        async handler(request) {
-            let accountObject = new Account({
-                redis,
-                account: request.params.account,
-                call,
-                secret: await getSecret(),
-                timeout: request.headers['x-ee-timeout']
-            });
-
-            try {
-                return await accountObject.deleteMailbox(request.query.path);
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'Delete mailbox',
-            notes: 'Delete existing mailbox folder',
-            tags: ['api', 'Mailbox'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    account: accountIdSchema.required()
-                }),
-
-                query: Joi.object({
-                    path: Joi.string().required().example('My Outdated Mail').description('Mailbox folder path to delete').label('MailboxPath')
-                }).label('DeleteMailbox')
-            },
-
-            response: {
-                schema: Joi.object({
-                    path: Joi.string().required().example('Kalender/S&APw-nnip&AOQ-evad').description('Full path to mailbox').label('MailboxPath'),
-                    deleted: Joi.boolean().example(true).description('Was the mailbox deleted')
-                }).label('DeleteMailboxResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'POST',
-        path: '/v1/account/{account}/submit',
-
-        async handler(request) {
-            let accountObject = new Account({
-                redis,
-                account: request.params.account,
-                call,
-                secret: await getSecret(),
-                timeout: request.headers['x-ee-timeout']
-            });
-
-            try {
-                return await accountObject.queueMessage(request.payload, {
-                    source: 'api',
-                    idempotencyKey: request.headers['idempotency-key'],
-                    useStructuredFormat: request.query.useStructuredFormat
-                });
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                if (err.info) {
-                    error.output.payload.info = err.info;
-                }
-                throw error;
-            }
-        },
-        options: {
-            payload: {
-                maxBytes: MAX_BODY_SIZE,
-                timeout: MAX_PAYLOAD_TIMEOUT
-            },
-
-            description: 'Submit message for delivery',
-            notes: 'Submit message for delivery. If reference message ID is provided then EmailEngine adds all headers and flags required for a reply/forward automatically.',
-            tags: ['api', 'Submit'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    account: accountIdSchema.required()
-                }),
-
-                query: Joi.object({
-                    documentStore: Joi.boolean()
-                        .truthy('Y', 'true', '1')
-                        .falsy('N', 'false', 0)
-                        .default(false)
-                        .description('If enabled then fetch email used as a reference template from the Document Store'),
-                    useStructuredFormat: Joi.boolean()
-                        .truthy('Y', 'true', '1')
-                        .falsy('N', 'false', 0)
-                        .default(false)
-                        .description(
-                            'For MS Graph accounts: If true, uses structured JSON format (respects from field for shared mailboxes, breaks calendar invites and special MIME types). If false, sends as raw MIME (preserves calendar invites, ignores from field). Default is false (raw MIME).'
-                        )
-                }).label('SubmitQuery'),
-
-                headers: Joi.object({
-                    'x-ee-timeout': headerTimeoutSchema,
-                    'idempotency-key': idempotencyKeySchema
-                }).unknown(),
-
-                payload: Joi.object({
-                    reference: messageReferenceSchema,
-
-                    envelope: Joi.object({
-                        from: Joi.string().email().allow('').example('sender@example.com'),
-                        to: Joi.array().items(Joi.string().email().required().example('recipient@example.com')).single().label('SmtpEnvelopeTo')
-                    })
-                        .description(
-                            "An optional object specifying the SMTP envelope used during email transmission. If not provided, the envelope is automatically derived from the email's message headers. This is useful when you need the envelope addresses to differ from those in the email headers."
-                        )
-                        .label('SMTPEnvelope')
-                        .when('mailMerge', {
-                            is: Joi.exist().not(false, null),
-                            then: Joi.forbidden('y')
-                        }),
-
-                    raw: Joi.string()
-                        .base64()
-                        .max(MAX_ATTACHMENT_SIZE)
-                        .example('TUlNRS1WZXJzaW9uOiAxLjANClN1YmplY3Q6IGhlbGxvIHdvcmxkDQoNCkhlbGxvIQ0K')
-                        .description(
-                            'A Base64-encoded email message in RFC 822 format. If you provide other fields along with raw, those fields will override the corresponding values in the raw message.'
-                        )
-                        .label('RFC822Raw')
-                        .when('mailMerge', {
-                            is: Joi.exist().not(false, null),
-                            then: Joi.forbidden('y')
-                        }),
-
-                    from: fromAddressSchema,
-
-                    replyTo: Joi.array()
-                        .items(addressSchema.label('ReplyToAddress'))
-                        .single()
-                        .example([{ name: 'From Me', address: 'sender@example.com' }])
-                        .description('List of Reply-To addresses')
-                        .label('ReplyTo'),
-
-                    to: Joi.array()
-                        .items(addressSchema.label('ToAddress'))
-                        .single()
-                        .example([{ address: 'recipient@example.com' }])
-                        .description('List of recipient addresses')
-                        .label('ToAddressList')
-                        .when('mailMerge', {
-                            is: Joi.exist().not(false, null),
-                            then: Joi.forbidden('y')
-                        }),
-
-                    cc: Joi.array()
-                        .items(addressSchema.label('CcAddress'))
-                        .single()
-                        .description('List of CC addresses')
-                        .label('CcAddressList')
-                        .when('mailMerge', {
-                            is: Joi.exist().not(false, null),
-                            then: Joi.forbidden('y')
-                        }),
-
-                    bcc: Joi.array()
-                        .items(addressSchema.label('BccAddress'))
-                        .single()
-                        .description('List of BCC addresses')
-                        .label('BccAddressList')
-                        .when('mailMerge', {
-                            is: Joi.exist().not(false, null),
-                            then: Joi.forbidden('y')
-                        }),
-
-                    subject: templateSchemas.subject,
-                    text: templateSchemas.text,
-                    html: templateSchemas.html,
-                    previewText: templateSchemas.previewText,
-
-                    template: Joi.string().max(256).example('example').description('Stored template ID to load the email content from'),
-
-                    render: Joi.object({
-                        format: Joi.string()
-                            .valid('html', 'markdown')
-                            .default('html')
-                            .description('Markup language for HTML ("html" or "markdown")')
-                            .label('RenderFormat'),
-                        params: Joi.object().label('RenderValues').description('An object of variables for the template renderer')
-                    })
-                        .allow(false)
-                        .description('Template rendering options')
-                        .when('mailMerge', {
-                            is: Joi.exist().not(false, null),
-                            then: Joi.forbidden('y')
-                        })
-                        .label('TemplateRender'),
-
-                    mailMerge: Joi.array()
-                        .items(
-                            Joi.object({
-                                to: addressSchema.label('ToAddress').required(),
-                                messageId: Joi.string().max(996).example('<test123@example.com>').description('Message ID'),
-                                params: Joi.object().label('RenderValues').description('An object of variables for the template renderer'),
-                                sendAt: Joi.date()
-                                    .iso()
-                                    .example('2021-07-08T07:06:34.336Z')
-                                    .description('Send message at specified time. Overrides message level `sendAt` value.')
-                            }).label('MailMergeListEntry')
-                        )
-                        .min(1)
-                        .description(
-                            'Mail merge options. A separate email is generated for each recipient. Using mail merge disables `messageId`, `envelope`, `to`, `cc`, `bcc`, `render` keys for the message root.'
-                        )
-                        .label('MailMergeList'),
-
-                    attachments: Joi.array()
-                        .items(
-                            Joi.object({
-                                filename: Joi.string().max(256).example('transparent.gif'),
-                                content: Joi.string()
-                                    .base64()
-                                    .max(MAX_ATTACHMENT_SIZE)
-                                    .required()
-                                    .example('R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=')
-                                    .description('Base64 formatted attachment file')
-                                    .when('reference', {
-                                        is: Joi.exist().not(false, null),
-                                        then: Joi.forbidden(),
-                                        otherwise: Joi.required()
-                                    }),
-
-                                contentType: Joi.string().lowercase().max(256).example('image/gif'),
-                                contentDisposition: Joi.string().lowercase().valid('inline', 'attachment').label('AttachmentContentDisposition'),
-                                cid: Joi.string().max(256).example('unique-image-id@localhost').description('Content-ID value for embedded images'),
-                                encoding: Joi.string().valid('base64').default('base64').label('AttachmentEncoding'),
-
-                                reference: Joi.string()
-                                    .base64({ paddingRequired: false, urlSafe: true })
-                                    .max(256)
-                                    .allow(false, null)
-                                    .example('AAAAAQAACnAcde')
-                                    .description(
-                                        'References an existing attachment by its ID instead of providing new attachment content. If this field is set, the `content` field must not be included. If not set, the `content` field is required.'
-                                    )
-                                    .label('AttachmentReference')
-                            }).label('UploadAttachment')
-                        )
-                        .description('List of attachments')
-                        .label('UploadAttachmentList'),
-
-                    messageId: Joi.string().max(996).example('<test123@example.com>').description('Message ID'),
-                    headers: Joi.object().label('CustomHeaders').description('Custom Headers').unknown().example({
-                        'X-My-Custom-Header': 'Custom header value'
-                    }),
-
-                    trackingEnabled: Joi.boolean()
-                        .example(false)
-                        .description('Should EmailEngine track clicks and opens for this message')
-                        .meta({ swaggerHidden: true }),
-
-                    trackOpens: Joi.boolean().example(false).description('Should EmailEngine track opens for this message'),
-                    trackClicks: Joi.boolean().example(false).description('Should EmailEngine track clicks for this message'),
-
-                    copy: Joi.boolean()
-                        .allow(null)
-                        .example(null)
-                        .description(
-                            "If set then either copies the message to the Sent Mail folder or not. If not set then uses the account's default setting."
-                        ),
-
-                    sentMailPath: Joi.string()
-                        .empty('')
-                        .max(1024)
-                        .example('Sent Mail')
-                        .description("Upload sent message to this folder. By default the account's Sent Mail folder is used."),
-
-                    locale: Joi.string().empty('').max(100).example('fr').description('Optional locale').label('MessageLocale'),
-                    tz: Joi.string().empty('').max(100).example('Europe/Tallinn').description('Optional timezone'),
-
-                    sendAt: Joi.date().iso().example('2021-07-08T07:06:34.336Z').description('Send message at specified time'),
-                    deliveryAttempts: Joi.number()
-                        .integer()
-                        .example(10)
-                        .description('How many delivery attempts to make until message is considered as failed'),
-                    gateway: Joi.string().max(256).example('example').description('Optional SMTP gateway ID for message routing').label('MessageGateway'),
-
-                    listId: Joi.string()
-                        .hostname()
-                        .example('test-list')
-                        .description(
-                            'List ID for Mail Merge. Must use a subdomain name format. Lists are registered ad-hoc, so a new identifier defines a new list.'
-                        )
-                        .label('ListID')
-                        .when('mailMerge', {
-                            is: Joi.exist().not(false, null),
-                            then: Joi.optional(),
-                            otherwise: Joi.forbidden()
-                        }),
-
-                    dsn: Joi.object({
-                        id: Joi.string().trim().empty('').max(256).description('The envelope identifier that would be included in the response (ENVID)'),
-                        return: Joi.string()
-                            .trim()
-                            .empty('')
-                            .valid('headers', 'full')
-                            .required()
-                            .description('Specifies if only headers or the entire body of the message should be included in the response (RET)')
-                            .label('DsnReturn'),
-                        notify: Joi.array()
-                            .single()
-                            .items(Joi.string().valid('never', 'success', 'failure', 'delay').label('NotifyEntry'))
-                            .description('Defines the conditions under which a DSN response should be sent')
-                            .label('DsnNotify'),
-                        recipient: Joi.string().trim().empty('').email().description('The email address the DSN should be sent (ORCPT)')
-                    })
-                        .description('Request DSN notifications')
-                        .label('DSN'),
-
-                    baseUrl: Joi.string()
-                        .trim()
-                        .empty('')
-                        .uri({
-                            scheme: ['http', 'https'],
-                            allowRelative: false
-                        })
-                        .example('https://customer123.myservice.com')
-                        .description('Optional base URL for trackers. This URL must point to your EmailEngine instance.'),
-
-                    proxy: settingsSchema.proxyUrl.description('Optional proxy URL to use when connecting to the SMTP server'),
-                    localAddress: ipSchema.description('Optional local IP address to bind to when connecting to the SMTP server'),
-
-                    dryRun: Joi.boolean()
-                        .truthy('Y', 'true', '1')
-                        .falsy('N', 'false', 0)
-                        .default(false)
-                        .description(
-                            'If true, then EmailEngine does not send the email and returns an RFC822 formatted email file. Tracking information is not added to the email.'
-                        )
-                        .label('Preview')
-                })
-                    .oxor('raw', 'html')
-                    .oxor('raw', 'text')
-                    .oxor('raw', 'text')
-                    .oxor('raw', 'attachments')
-                    .label('SubmitMessage')
-                    .example({
-                        to: [
-                            {
-                                name: 'Nyan Cat',
-                                address: 'nyan.cat@example.com'
-                            }
-                        ],
-                        subject: 'What a wonderful message!',
-                        text: 'Hello from myself!',
-                        html: '<p>Hello from myself!</p>',
-                        attachments: [
-                            {
-                                filename: 'transparent.gif',
-                                content: 'R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=',
-                                contentType: 'image/gif'
-                            }
-                        ]
-                    })
-            },
-
-            response: {
-                schema: Joi.object({
-                    response: Joi.string().example('Queued for delivery'),
-                    messageId: Joi.string()
-                        .example('<a2184d08-a470-fec6-a493-fa211a3756e9@example.com>')
-                        .description('Message-ID header value. Not present for bulk messages.'),
-                    queueId: Joi.string().example('d41f0423195f271f').description('Queue identifier for scheduled email. Not present for bulk messages.'),
-                    sendAt: Joi.date().example('2021-07-08T07:06:34.336Z').description('Scheduled send time'),
-
-                    reference: Joi.object({
-                        message: Joi.string()
-                            .base64({ paddingRequired: false, urlSafe: true })
-                            .max(256)
-                            .required()
-                            .example('AAAAAQAACnA')
-                            .description('Referenced message ID'),
-                        documentStore: Joi.boolean()
-                            .example(true)
-                            .description('Was the message data loaded from the Document Store')
-                            .label('ResponseDocumentStore')
-                            .meta({ swaggerHidden: true }),
-                        success: Joi.boolean().example(true).description('Was the referenced message processed successfully').label('ResponseReferenceSuccess'),
-                        error: Joi.string().example('Referenced message was not found').description('An error message if referenced message processing failed')
-                    })
-                        .description('Reference info if referencing was requested')
-                        .label('ResponseReference'),
-
-                    preview: Joi.string()
-                        .base64()
-                        .example('Q29udGVudC1UeXBlOiBtdWx0aX...')
-                        .description('Base64 encoded RFC822 email if a preview was requested')
-                        .label('ResponsePreview'),
-
-                    mailMerge: Joi.array()
-                        .items(
-                            Joi.object({
-                                success: Joi.boolean()
-                                    .example(true)
-                                    .description('Was the referenced message processed successfully')
-                                    .label('ResponseReferenceSuccess'),
-                                to: addressSchema.label('ToAddressSingle'),
-                                messageId: Joi.string().max(996).example('<test123@example.com>').description('Message ID'),
-                                queueId: Joi.string()
-                                    .example('d41f0423195f271f')
-                                    .description('Queue identifier for scheduled email. Not present for bulk messages.'),
-                                reference: Joi.object({
-                                    message: Joi.string()
-                                        .base64({ paddingRequired: false, urlSafe: true })
-                                        .max(256)
-                                        .required()
-                                        .example('AAAAAQAACnA')
-                                        .description('Referenced message ID'),
-                                    documentStore: Joi.boolean()
-                                        .example(true)
-                                        .description('Was the message data loaded from the Document Store')
-                                        .label('ResponseDocumentStore')
-                                        .meta({ swaggerHidden: true }),
-                                    success: Joi.boolean()
-                                        .example(true)
-                                        .description('Was the referenced message processed successfully')
-                                        .label('ResponseReferenceSuccess'),
-                                    error: Joi.string()
-                                        .example('Referenced message was not found')
-                                        .description('An error message if referenced message processing failed')
-                                })
-                                    .description('Reference info if referencing was requested')
-                                    .label('ResponseReference'),
-                                sendAt: Joi.date()
-                                    .iso()
-                                    .example('2021-07-08T07:06:34.336Z')
-                                    .description('Send message at specified time. Overrides message level `sendAt` value.'),
-                                skipped: Joi.object({
-                                    reason: Joi.string().example('unsubscribe').description('Why this message was skipped'),
-                                    listId: Joi.string().example('test-list')
-                                })
-                                    .description('Info about skipped message. If this value is set, then the message was not sent')
-                                    .label('SkippedMessageInfo')
-                            })
-                                .label('BulkResponseEntry')
-                                .example({
-                                    success: true,
-                                    to: {
-                                        name: 'Andris 2',
-                                        address: 'andris@ethereal.email'
-                                    },
-                                    messageId: '<19b9c433-d428-f6d8-1d00-d666ebcadfc4@ekiri.ee>',
-                                    queueId: '1812477338914c8372a',
-                                    reference: {
-                                        message: 'AAAAAQAACnA',
-                                        success: true
-                                    },
-                                    sendAt: '2021-07-08T07:06:34.336Z'
-                                })
-                                .unknown()
-                        )
-                        .label('BulkResponseList')
-                        .description('Bulk message responses')
-                }).label('SubmitMessageResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/settings',
-
-        async handler(request) {
-            let values = {};
-            for (let key of Object.keys(request.query)) {
-                if (request.query[key]) {
-                    if (key === 'eventTypes') {
-                        values[key] = Object.keys(consts)
-                            .map(key => {
-                                if (/_NOTIFY?/.test(key)) {
-                                    return consts[key];
-                                }
-                                return false;
-                            })
-                            .map(key => key);
-                        continue;
-                    }
-
-                    let value = await settings.get(key);
-
-                    if (settings.encryptedKeys.includes(key)) {
-                        // do not reveal secret values
-                        // instead show boolean value true if value is set, or false if it's not
-                        value = value ? true : false;
-                    }
-
-                    values[key] = value;
-                }
-            }
-            return values;
-        },
-        options: {
-            description: 'List specific settings',
-            notes: 'List setting values for specific keys',
-            tags: ['api', 'Settings'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                query: Joi.object(settingsQuerySchema).label('SettingsQuery')
-            },
-
-            response: {
-                schema: Joi.object(settingsSchema).label('SettingsQueryResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'POST',
-        path: '/v1/settings',
-
-        async handler(request) {
-            let updated = [];
-            for (let key of Object.keys(request.payload)) {
-                switch (key) {
-                    case 'serviceUrl': {
-                        let url = new URL(request.payload.serviceUrl);
-                        request.payload.serviceUrl = url.origin;
-                        break;
-                    }
-
-                    case 'webhooksEnabled':
-                        if (!request.payload.webhooksEnabled) {
-                            // clear error message (if exists)
-                            await settings.clear('webhookErrorFlag');
-                        }
-                        break;
-                }
-
-                await settings.set(key, request.payload[key]);
-                updated.push(key);
-            }
-
-            notify('settings', request.payload);
-            if ('httpProxyEnabled' in request.payload || 'httpProxyUrl' in request.payload) {
-                reloadHttpProxyAgent().catch(err => logger.error({ msg: 'Failed to reload HTTP proxy agent', err }));
-            }
-            return { updated };
-        },
-        options: {
-            description: 'Set setting values',
-            notes: 'Set setting values for specific keys',
-            tags: ['api', 'Settings'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                payload: Joi.object(settingsSchema).label('Settings')
-            },
-
-            response: {
-                schema: Joi.object({
-                    updated: Joi.array().items(Joi.string().example('notifyHeaders')).description('List of updated setting keys').label('UpdatedSettings')
-                }).label('SettingsUpdatedResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/settings/queue/{queue}',
-
-        async handler(request) {
-            try {
-                let queue = request.params.queue;
-                let values = {
-                    queue
-                };
-
-                const [resActive, resDelayed, resPaused, resWaiting, resMeta] = await redis
-                    .multi()
-                    .llen(`${REDIS_PREFIX}bull:${queue}:active`)
-                    .zcard(`${REDIS_PREFIX}bull:${queue}:delayed`)
-                    .llen(`${REDIS_PREFIX}bull:${queue}:paused`)
-                    .llen(`${REDIS_PREFIX}bull:${queue}:wait`)
-                    .hget(`${REDIS_PREFIX}bull:${queue}:meta`, 'paused')
-                    .exec();
-
-                if (resActive[0] || resDelayed[0] || resPaused[0] || resWaiting[0]) {
-                    // counting failed
-                    let err = new Error('Failed to count queue lengtho');
-                    err.statusCode = 500;
-                    throw err;
-                }
-
-                values.jobs = {
-                    active: Number(resActive[1]) || 0,
-                    delayed: Number(resDelayed[1]) || 0,
-                    paused: Number(resPaused[1]) || 0,
-                    waiting: Number(resWaiting[1]) || 0
-                };
-
-                values.paused = !!Number(resMeta[1]) || false;
-
-                return values;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Show queue information',
-            notes: 'Show queue status and current state',
-            tags: ['api', 'Settings'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    queue: Joi.string()
-                        .empty('')
-                        .trim()
-                        .valid('notify', 'submit', 'documents')
-                        .required()
-                        .example('notify')
-                        .description('Queue ID')
-                        .label('QueueId')
-                })
-            },
-
-            response: {
-                schema: Joi.object({
-                    queue: Joi.string()
-                        .empty('')
-                        .trim()
-                        .valid('notify', 'submit', 'documents')
-                        .required()
-                        .example('notify')
-                        .description('Queue ID')
-                        .label('QueueIdResponse'),
-                    jobs: Joi.object({
-                        active: Joi.number().integer().example(123).description('Jobs that are currently being processed'),
-                        delayed: Joi.number().integer().example(123).description('Jobs that are processed in the future'),
-                        paused: Joi.number().integer().example(123).description('Jobs that would be processed once queue processing is resumed'),
-                        waiting: Joi.number()
-                            .integer()
-                            .example(123)
-                            .description('Jobs that should be processed, but are waiting until there are any free handlers')
-                    }).label('QueueJobs'),
-                    paused: Joi.boolean().example(false).description('Is the queue paused or not')
-                }).label('SettingsQueueResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'PUT',
-        path: '/v1/settings/queue/{queue}',
-
-        async handler(request) {
-            try {
-                let queue = request.params.queue;
-
-                let queueObj = {
-                    documents: documentsQueue,
-                    notify: notifyQueue,
-                    submit: submitQueue
-                }[queue];
-
-                let values = {
-                    queue
-                };
-
-                for (let key of Object.keys(request.payload)) {
-                    switch (key) {
-                        case 'paused':
-                            if (request.payload[key]) {
-                                await queueObj.pause();
-                            } else {
-                                await queueObj.resume();
-                            }
-                            break;
-                    }
-                }
-
-                values.paused = await queueObj.isPaused();
-
-                return values;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Set queue settings',
-            notes: 'Set queue settings',
-            tags: ['api', 'Settings'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    queue: Joi.string()
-                        .empty('')
-                        .trim()
-                        .valid('notify', 'submit', 'documents')
-                        .required()
-                        .example('notify')
-                        .description('Queue ID')
-                        .label('QueueIdParam')
-                }),
-
-                payload: Joi.object({
-                    paused: Joi.boolean().empty('').example(false).description('Set queue state to paused')
-                }).label('SettingsPutQueuePayload')
-            },
-
-            response: {
-                schema: Joi.object({
-                    queue: Joi.string()
-                        .empty('')
-                        .trim()
-                        .valid('notify', 'submit', 'documents')
-                        .required()
-                        .example('notify')
-                        .description('Queue ID')
-                        .label('QueueIdPutResponse'),
-                    paused: Joi.boolean().example(false).description('Is the queue paused or not')
-                }).label('SettingsPutQueueResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/logs/{account}',
-
-        async handler(request) {
-            return getLogs(redis, request.params.account);
-        },
-        options: {
-            description: 'Return IMAP logs for an account',
-            notes: 'Output is a downloadable text file',
-            tags: ['api', 'Logs'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            plugins: {
-                'hapi-swagger': {
-                    produces: ['text/plain']
-                }
-            },
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    account: accountIdSchema.required()
-                })
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/stats',
-
-        async handler(request) {
-            return await getStats(redis, call, request.query.seconds);
-        },
-
-        options: {
-            description: 'Return server stats',
-            tags: ['api', 'Stats'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                query: Joi.object({
-                    seconds: Joi.number()
-                        .integer()
-                        .empty('')
-                        .min(0)
-                        .max(MAX_DAYS_STATS * 24 * 3600)
-                        .default(3600)
-                        .example(3600)
-                        .description('Duration for counters')
-                        .label('CounterSeconds')
-                }).label('ServerStats')
-            },
-
-            response: {
-                schema: Joi.object({
-                    version: Joi.string().example(packageData.version).description('EmailEngine version number'),
-                    license: Joi.string().example(packageData.license).description('EmailEngine license'),
-                    accounts: Joi.number().integer().example(26).description('Number of registered accounts'),
-                    node: Joi.string().example('16.10.0').description('Node.js Version'),
-                    redis: Joi.string().example('6.2.4').description('Redis Version'),
-                    connections: Joi.object({
-                        init: Joi.number().integer().example(2).description('Accounts not yet initialized'),
-                        connected: Joi.number().integer().example(8).description('Successfully connected accounts'),
-                        connecting: Joi.number().integer().example(7).description('Connection is being established'),
-                        authenticationError: Joi.number().integer().example(3).description('Authentication failed'),
-                        connectError: Joi.number().integer().example(5).description('Connection failed due to technical error'),
-                        unset: Joi.number().integer().example(0).description('Accounts without valid IMAP settings'),
-                        disconnected: Joi.number().integer().example(1).description('IMAP connection was closed')
-                    })
-                        .description('Counts of accounts in different connection states')
-                        .label('ConnectionsStats'),
-                    counters: Joi.object().label('CounterStats').unknown()
-                }).label('SettingsResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'POST',
-        path: '/v1/verifyAccount',
-
-        async handler(request) {
-            try {
-                return await verifyAccountInfo(redis, request.payload, request.logger.child({ action: 'verify-account' }));
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Verify IMAP and SMTP settings',
-            notes: 'Checks if can connect and authenticate using provided account info',
-            tags: ['api', 'Account'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                payload: Joi.object({
-                    mailboxes: Joi.boolean().example(false).description('Include mailbox listing in response').default(false).label('IncludeMailboxes'),
-                    imap: Joi.object(imapSchema).allow(false).description('IMAP configuration').label('ImapConfiguration'),
-                    smtp: Joi.object(smtpSchema).allow(false).description('SMTP configuration').label('SmtpConfiguration'),
-                    proxy: settingsSchema.proxyUrl,
-                    smtpEhloName: settingsSchema.smtpEhloName
-                }).label('VerifyAccount')
-            },
-            response: {
-                schema: Joi.object({
-                    imap: Joi.object({
-                        success: Joi.boolean().example(true).description('Was IMAP account verified').label('VerifyImapSuccess'),
-                        error: Joi.string()
-                            .example('Something went wrong')
-                            .description('Error messages for IMAP verification. Only present if success=false')
-                            .label('VerifyImapError'),
-                        code: Joi.string()
-                            .example('ERR_SSL_WRONG_VERSION_NUMBER')
-                            .description('Error code. Only present if success=false')
-                            .label('VerifyImapCode')
-                    }).label('VerifyImapResult'),
-                    smtp: Joi.object({
-                        success: Joi.boolean().example(true).description('Was SMTP account verified').label('VerifySmtpSuccess'),
-                        error: Joi.string()
-                            .example('Something went wrong')
-                            .description('Error messages for SMTP verification. Only present if success=false')
-                            .label('VerifySmtpError'),
-                        code: Joi.string()
-                            .example('ERR_SSL_WRONG_VERSION_NUMBER')
-                            .description('Error code. Only present if success=false')
-                            .label('VerifySmtpCode')
-                    }).label('VerifySmtpResult'),
-                    mailboxes: shortMailboxesSchema
-                }).label('VerifyAccountResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/license',
-
-        async handler(request) {
-            try {
-                const licenseInfo = await call({ cmd: 'license', timeout: request.headers['x-ee-timeout'] });
-                if (!licenseInfo) {
-                    let err = new Error('Failed to load license info');
-                    err.statusCode = 403;
-                    throw err;
-                }
-                return licenseInfo;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Request license info',
-            notes: 'Get active license information',
-            tags: ['api', 'License'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            response: {
-                schema: licenseSchema.label('LicenseResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'DELETE',
-        path: '/v1/license',
-
-        async handler(request) {
-            try {
-                const licenseInfo = await call({ cmd: 'removeLicense', timeout: request.headers['x-ee-timeout'] });
-                if (!licenseInfo) {
-                    let err = new Error('Failed to clear license info');
-                    err.statusCode = 403;
-                    throw err;
-                }
-                return licenseInfo;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Remove license',
-            notes: 'Remove registered active license',
-            tags: ['api', 'License'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            response: {
-                schema: Joi.object({
-                    active: Joi.boolean().example(false),
-                    details: Joi.boolean().example(false),
-                    type: Joi.string().example('SSPL-1.0-or-later')
-                }).label('EmptyLicenseResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'POST',
-        path: '/v1/license',
-
-        async handler(request) {
-            try {
-                const licenseInfo = await call({ cmd: 'updateLicense', license: request.payload.license, timeout: request.headers['x-ee-timeout'] });
-                if (!licenseInfo) {
-                    let err = new Error('Failed to update license. Check license file contents.');
-                    err.statusCode = 403;
-                    throw err;
-                }
-                return licenseInfo;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Register a license',
-            notes: 'Set up a license for EmailEngine to unlock all features',
-            tags: ['api', 'License'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                payload: Joi.object({
-                    license: Joi.string()
-                        .max(10 * 1024)
-                        .required()
-                        .example('-----BEGIN LICENSE-----\r\n...')
-                        .description('License file')
-                }).label('RegisterLicense')
-            },
-
-            response: {
-                schema: licenseSchema.label('LicenseResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/autoconfig',
-
-        async handler(request) {
-            try {
-                let serverSettings = await autodetectImapSettings(request.query.email, request.app.gt);
-                return serverSettings;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                return { imap: false, smtp: false, _source: 'unknown' };
-            }
-        },
-
-        options: {
-            description: 'Discover Email settings',
-            notes: 'Try to discover IMAP and SMTP settings for an email account',
-            tags: ['api', 'Settings'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                query: Joi.object({
-                    email: Joi.string()
-                        .email()
-                        .required()
-                        .example('sender@example.com')
-                        .description('Email address to discover email settings for')
-                        .label('EmailAddress')
-                }).label('AutodiscoverQuery')
-            },
-
-            response: {
-                schema: Joi.object({
-                    imap: Joi.object({
-                        auth: Joi.object({
-                            user: Joi.string().max(256).example('myuser@gmail.com').description('Account username')
-                        }).label('DetectedAuthenticationInfo'),
-
-                        host: Joi.string().hostname().required().example('imap.gmail.com').description('Hostname to connect to'),
-                        port: Joi.number()
-                            .integer()
-                            .min(1)
-                            .max(64 * 1024)
-                            .required()
-                            .example(993)
-                            .description('Service port number'),
-                        secure: Joi.boolean().default(false).example(true).description('Should connection use TLS. Usually true for port 993')
-                    }).label('ResolvedServerSettings'),
-                    smtp: Joi.object({
-                        auth: Joi.object({
-                            user: Joi.string().max(256).example('myuser@gmail.com').description('Account username')
-                        }).label('DetectedAuthenticationInfo'),
-
-                        host: Joi.string().hostname().required().example('imap.gmail.com').description('Hostname to connect to'),
-                        port: Joi.number()
-                            .integer()
-                            .min(1)
-                            .max(64 * 1024)
-                            .required()
-                            .example(993)
-                            .description('Service port number'),
-                        secure: Joi.boolean().default(false).example(true).description('Should connection use TLS. Usually true for port 993')
-                    }).label('DiscoveredServerSettings'),
-                    _source: Joi.string().example('srv').description('Source for the detected info')
-                }).label('DiscoveredEmailSettings'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/outbox',
-
-        async handler(request) {
-            try {
-                return await outbox.list(Object.assign({ logger }, request.query));
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'List queued messages',
-            notes: 'Lists messages in the Outbox',
-            tags: ['api', 'Outbox'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                query: Joi.object({
-                    page: Joi.number()
-                        .integer()
-                        .min(0)
-                        .max(1024 * 1024)
-                        .default(0)
-                        .example(0)
-                        .description('Page number (zero indexed, so use 0 for first page)')
-                        .label('PageNumber'),
-                    pageSize: Joi.number().integer().min(1).max(1000).default(20).example(20).description('How many entries per page').label('PageSize')
-                }).label('OutbixListFilter')
-            },
-
-            response: {
-                schema: Joi.object({
-                    total: Joi.number().integer().example(120).description('How many matching entries').label('TotalNumber'),
-                    page: Joi.number().integer().example(0).description('Current page (0-based index)').label('PageNumber'),
-                    pages: Joi.number().integer().example(24).description('Total page count').label('PagesNumber'),
-
-                    messages: Joi.array().items(outboxEntrySchema).label('OutboxListEntries')
-                }).label('OutboxListResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/outbox/{queueId}',
-
-        async handler(request) {
-            try {
-                let outboxEntry = await outbox.get({ queueId: request.params.queueId, logger });
-                if (!outboxEntry) {
-                    let message = 'Requested queue entry was not found';
-                    let error = Boom.boomify(new Error(message), { statusCode: 404 });
-                    throw error;
-                }
-                return outboxEntry;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'Get queued message',
-            notes: 'Gets a queued message in the Outbox',
-            tags: ['api', 'Outbox'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    queueId: Joi.string().max(100).example('d41f0423195f271f').description('Queue identifier for scheduled email').required()
-                }).label('OutboxEntryParams')
-            },
-
-            response: {
-                schema: outboxEntrySchema,
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'DELETE',
-        path: '/v1/outbox/{queueId}',
-
-        async handler(request) {
-            try {
-                return {
-                    deleted: await outbox.del({ queueId: request.params.queueId, logger })
-                };
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Remove a message',
-            notes: 'Remove a message from the outbox',
-            tags: ['api', 'Outbox'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    queueId: Joi.string().max(100).example('d41f0423195f271f').description('Queue identifier for scheduled email').required()
-                }).label('OutboxEntryParams')
-            },
-
-            response: {
-                schema: Joi.object({
-                    deleted: Joi.boolean().truthy('Y', 'true', '1').falsy('N', 'false', 0).default(true).description('Was the message deleted')
-                }).label('DeleteOutboxEntryResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    // setup template routes
-    await templateRoutes({ server, call, CORS_CONFIG });
-
-    // setup "chat with email" routes
-    await chatRoutes({ server, call, CORS_CONFIG });
-
-    // setup account CRUD routes
-    await accountRoutes({
-        server,
-        call,
-        documentsQueue,
-        oauth2Schema,
-        imapSchema,
-        smtpSchema,
-        CORS_CONFIG,
-        AccountTypeSchema
-    });
-
-    // setup message routes
-    await messageRoutes({
-        server,
-        call,
-        CORS_CONFIG,
-        MAX_ATTACHMENT_SIZE,
-        MAX_BODY_SIZE,
-        MAX_PAYLOAD_TIMEOUT
-    });
-
-    // setup export routes
-    await exportRoutes({
-        server,
-        CORS_CONFIG
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/webhookRoutes',
-
-        async handler(request) {
-            try {
-                return await Webhooks.list(request.query.page, request.query.pageSize);
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'List webhook routes',
-            notes: 'List custom webhook routes',
-            tags: ['api', 'Webhooks'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                query: Joi.object({
-                    page: Joi.number()
-                        .integer()
-                        .min(0)
-                        .max(1024 * 1024)
-                        .default(0)
-                        .example(0)
-                        .description('Page number (zero indexed, so use 0 for first page)')
-                        .label('PageNumber'),
-                    pageSize: Joi.number().integer().min(1).max(1000).default(20).example(20).description('How many entries per page').label('PageSize')
-                }).label('WebhookRoutesListRequest')
-            },
-
-            response: {
-                schema: Joi.object({
-                    total: Joi.number().integer().example(120).description('How many matching entries').label('TotalNumber'),
-                    page: Joi.number().integer().example(0).description('Current page (0-based index)').label('PageNumber'),
-                    pages: Joi.number().integer().example(24).description('Total page count').label('PagesNumber'),
-
-                    webhooks: Joi.array()
-                        .items(
-                            Joi.object({
-                                id: Joi.string().max(256).required().example('AAABgS-UcAYAAAABAA').description('Webhook ID'),
-                                name: Joi.string().max(256).example('Send to Slack').description('Name of the route').label('WebhookRouteName').required(),
-                                description: Joi.string()
-                                    .allow('')
-                                    .max(1024)
-                                    .example('Something about the route')
-                                    .description('Optional description of the webhook route')
-                                    .label('WebhookRouteDescription'),
-                                created: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('The time this route was created'),
-                                updated: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('The time this route was last updated'),
-                                enabled: Joi.boolean().example(true).description('Is the route enabled').label('WebhookRouteEnabled'),
-                                targetUrl: settingsSchema.webhooks,
-                                tcount: Joi.number().integer().example(123).description('How many times this route has been applied')
-                            }).label('WebhookRoutesListEntry')
-                        )
-                        .label('WebhookRoutesList')
-                }).label('WebhookRoutesListResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/webhookRoutes/webhookRoute/{webhookRoute}',
-
-        async handler(request) {
-            try {
-                return await Webhooks.get(request.params.webhookRoute);
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'Get webhook route information',
-            notes: 'Retrieve webhook route content and information',
-            tags: ['api', 'Webhooks'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-                params: Joi.object({
-                    webhookRoute: Joi.string().max(256).required().example('example').description('Webhook ID')
-                }).label('GetWebhookRouteRequest')
-            },
-
-            response: {
-                schema: Joi.object({
-                    id: Joi.string().max(256).required().example('AAABgS-UcAYAAAABAA').description('Webhook ID'),
-                    name: Joi.string().max(256).example('Send to Slack').description('Name of the route').label('WebhookRouteName').required(),
-                    description: Joi.string()
-                        .allow('')
-                        .max(1024)
-                        .example('Something about the route')
-                        .description('Optional description of the webhook route')
-                        .label('WebhookRouteDescription'),
-                    created: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('The time this route was created'),
-                    updated: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('The time this route was last updated'),
-                    enabled: Joi.boolean().example(true).description('Is the route enabled').label('WebhookRouteEnabled'),
-                    targetUrl: settingsSchema.webhooks,
-                    tcount: Joi.number().integer().example(123).description('How many times this route has been applied'),
-                    content: Joi.object({
-                        fn: Joi.string().example('return true;').description('Filter function'),
-                        map: Joi.string().example('payload.ts = Date.now(); return payload;').description('Mapping function')
-                    }).label('WebhookRouteContent')
-                }).label('WebhookRouteResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/oauth2',
-
-        async handler(request) {
-            try {
-                let response = await oauth2Apps.list(request.query.page, request.query.pageSize);
-
-                for (let app of response.apps) {
-                    for (let secretKey of ['clientSecret', 'serviceKey', 'accessToken', 'externalAccount']) {
-                        if (app[secretKey]) {
-                            app[secretKey] = '******';
-                        }
-                    }
-
-                    if (app.extraScopes && !app.extraScopes.length) {
-                        delete app.extraScopes;
-                    }
-
-                    if (app.app) {
-                        delete app.app;
-                    }
-
-                    flattenOAuthAppMeta(app);
-                }
-
-                return response;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'List OAuth2 applications',
-            notes: 'Lists registered OAuth2 applications',
-            tags: ['api', 'OAuth2 Applications'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                query: Joi.object({
-                    page: Joi.number()
-                        .integer()
-                        .min(0)
-                        .max(1024 * 1024)
-                        .default(0)
-                        .example(0)
-                        .description('Page number (zero indexed, so use 0 for first page)')
-                        .label('PageNumber'),
-                    pageSize: Joi.number().integer().min(1).max(1000).default(20).example(20).description('How many entries per page').label('PageSize')
-                }).label('GatewaysFilter')
-            },
-
-            response: {
-                schema: Joi.object({
-                    total: Joi.number().integer().example(120).description('How many matching entries').label('TotalNumber'),
-                    page: Joi.number().integer().example(0).description('Current page (0-based index)').label('PageNumber'),
-                    pages: Joi.number().integer().example(24).description('Total page count').label('PagesNumber'),
-
-                    apps: Joi.array()
-                        .items(
-                            Joi.object({
-                                id: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID'),
-                                name: Joi.string().max(256).example('My OAuth2 App').description('Display name for the app'),
-                                description: Joi.string().empty('').trim().max(1024).example('App description').description('OAuth2 application description'),
-                                title: Joi.string().empty('').trim().max(256).example('App title').description('Title for the application button'),
-                                provider: OAuth2ProviderSchema,
-                                enabled: Joi.boolean()
-                                    .truthy('Y', 'true', '1', 'on')
-                                    .falsy('N', 'false', 0, '')
-                                    .example(true)
-                                    .description('Is the application enabled')
-                                    .label('AppEnabled'),
-                                legacy: Joi.boolean()
-                                    .truthy('Y', 'true', '1', 'on')
-                                    .falsy('N', 'false', 0, '')
-                                    .example(true)
-                                    .description('`true` for older OAuth2 apps set via the settings endpoint'),
-                                created: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('The time this entry was added').required(),
-                                updated: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('The time this entry was updated'),
-                                includeInListing: Joi.boolean()
-                                    .truthy('Y', 'true', '1', 'on')
-                                    .falsy('N', 'false', 0, '')
-                                    .example(true)
-                                    .description('Is the application listed in the hosted authentication form'),
-
-                                clientId: Joi.string()
-                                    .example('4f05f488-d858-4f2c-bd12-1039062612fe')
-                                    .description('Client or Application ID for 3-legged OAuth2 applications')
-                                    .label('OAuth2AppListClientId'),
-                                clientSecret: Joi.string()
-                                    .example('******')
-                                    .description('Client secret for 3-legged OAuth2 applications. Actual value is not revealed.'),
-                                authority: Joi.string().example('common').description('Authorization tenant value for Outlook OAuth2 applications'),
-                                redirectUrl: Joi.string()
-                                    .uri({
-                                        scheme: ['http', 'https'],
-                                        allowRelative: false
-                                    })
-                                    .example('https://myservice.com/oauth')
-                                    .description('Redirect URL for 3-legged OAuth2 applications')
-                                    .label('OAuth2AppListRedirectUrl'),
-
-                                serviceClient: Joi.string()
-                                    .example('9103965568215821627203')
-                                    .description('Service client ID for 2-legged OAuth2 applications')
-                                    .label('OAuth2AppListServiceClient'),
-
-                                googleProjectId: googleProjectIdSchema,
-                                googleWorkspaceAccounts: googleWorkspaceAccountsSchema,
-                                googleTopicName: googleTopicNameSchema,
-                                googleSubscriptionName: googleSubscriptionNameSchema,
-
-                                serviceClientEmail: Joi.string()
-                                    .email()
-                                    .example('name@project-123.iam.gserviceaccount.com')
-                                    .description('Service Client Email for 2-legged OAuth2 applications'),
-
-                                serviceKey: Joi.string()
-                                    .example('******')
-                                    .description('PEM formatted service secret for 2-legged OAuth2 applications. Actual value is not revealed.'),
-
-                                lastError: lastErrorSchema.allow(null),
-                                pubSubError: pubSubErrorSchema.allow(null)
-                            }).label('OAuth2ResponseItem')
-                        )
-                        .label('OAuth2Entries')
-                }).label('OAuth2FilterResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/oauth2/{app}',
-
-        async handler(request) {
-            try {
-                let app = await oauth2Apps.get(request.params.app);
-
-                // remove secrets
-                for (let secretKey of ['clientSecret', 'serviceKey', 'accessToken', 'externalAccount']) {
-                    if (app[secretKey]) {
-                        app[secretKey] = '******';
-                    }
-                }
-
-                if (app.extraScopes && !app.extraScopes.length) {
-                    delete app.extraScopes;
-                }
-
-                if (app.app) {
-                    delete app.app;
-                }
-
-                flattenOAuthAppMeta(app);
-
-                return app;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Get application info',
-            notes: 'Returns stored information about an OAuth2 application. Secrets are not included.',
-            tags: ['api', 'OAuth2 Applications'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    app: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID')
-                })
-            },
-
-            response: {
-                schema: Joi.object({
-                    id: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID'),
-                    name: Joi.string().max(256).example('My OAuth2 App').description('Display name for the app'),
-                    description: Joi.string().empty('').trim().max(1024).example('App description').description('OAuth2 application description'),
-                    title: Joi.string().empty('').trim().max(256).example('App title').description('Title for the application button'),
-                    provider: OAuth2ProviderSchema,
-                    enabled: Joi.boolean()
-                        .truthy('Y', 'true', '1', 'on')
-                        .falsy('N', 'false', 0, '')
-                        .example(true)
-                        .description('Is the application enabled')
-                        .label('AppEnabled'),
-                    legacy: Joi.boolean()
-                        .truthy('Y', 'true', '1', 'on')
-                        .falsy('N', 'false', 0, '')
-                        .example(true)
-                        .description('`true` for older OAuth2 apps set via the settings endpoint'),
-                    created: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('The time this entry was added').required(),
-                    updated: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('The time this entry was updated'),
-                    includeInListing: Joi.boolean()
-                        .truthy('Y', 'true', '1', 'on')
-                        .falsy('N', 'false', 0, '')
-                        .example(true)
-                        .description('Is the application listed in the hosted authentication form'),
-
-                    clientId: Joi.string()
-                        .example('4f05f488-d858-4f2c-bd12-1039062612fe')
-                        .description('Client or Application ID for 3-legged OAuth2 applications')
-                        .label('OAuth2AppGetClientId'),
-                    clientSecret: Joi.string().example('******').description('Client secret for 3-legged OAuth2 applications. Actual value is not revealed.'),
-                    authority: Joi.string().example('common').description('Authorization tenant value for Outlook OAuth2 applications'),
-                    redirectUrl: Joi.string()
-                        .uri({
-                            scheme: ['http', 'https'],
-                            allowRelative: false
-                        })
-                        .example('https://myservice.com/oauth')
-                        .description('Redirect URL for 3-legged OAuth2 applications')
-                        .label('OAuth2AppGetRedirectUrl'),
-
-                    googleProjectId: googleProjectIdSchema,
-                    googleWorkspaceAccounts: googleWorkspaceAccountsSchema,
-                    googleTopicName: googleTopicNameSchema,
-                    googleSubscriptionName: googleSubscriptionNameSchema,
-
-                    serviceClientEmail: Joi.string()
-                        .email()
-                        .example('name@project-123.iam.gserviceaccount.com')
-                        .description('Service Client Email for 2-legged OAuth2 applications'),
-
-                    serviceClient: Joi.string()
-                        .example('9103965568215821627203')
-                        .description('Service client ID for 2-legged OAuth2 applications')
-                        .label('OAuth2AppGetServiceClient'),
-
-                    serviceKey: Joi.string()
-                        .example('******')
-                        .description('PEM formatted service secret for 2-legged OAuth2 applications. Actual value is not revealed.'),
-
-                    accounts: Joi.number()
-                        .integer()
-                        .example(12)
-                        .description('The number of accounts registered with this application. Not available for legacy apps.'),
-
-                    lastError: lastErrorSchema.allow(null),
-                    pubSubError: pubSubErrorSchema.allow(null)
-                }).label('ApplicationResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'POST',
-        path: '/v1/oauth2',
-
-        async handler(request) {
-            try {
-                let result = await oauth2Apps.create(request.payload);
-
-                if (result && result.pubsubUpdates && Object.keys(result.pubsubUpdates).length > 0) {
-                    await call({ cmd: 'googlePubSub', app: result.id });
-                    delete result.pubsubUpdates;
-                }
-
-                return result;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'Register OAuth2 application',
-            notes: 'Registers a new OAuth2 application for a specific provider',
-            tags: ['api', 'OAuth2 Applications'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                payload: Joi.object(oauthCreateSchema).tailor('api').label('CreateOAuth2App')
-            },
-
-            response: {
-                schema: Joi.object({
-                    id: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID'),
-                    created: Joi.boolean().truthy('Y', 'true', '1').falsy('N', 'false', 0).default(true).description('Was the app created')
-                }).label('CreateAppResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'PUT',
-        path: '/v1/oauth2/{app}',
-
-        async handler(request) {
-            try {
-                let result = await oauth2Apps.update(request.params.app, request.payload);
-
-                if (result && result.pubsubUpdates && Object.keys(result.pubsubUpdates).length > 0) {
-                    await call({ cmd: 'googlePubSub', app: result.id });
-                    delete result.pubsubUpdates;
-                }
-
-                return result;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Update OAuth2 application',
-            notes: 'Updates OAuth2 application information',
-            tags: ['api', 'OAuth2 Applications'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    app: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID')
-                }),
-
-                payload: Joi.object({
-                    name: Joi.string().trim().empty('').max(256).example('My Gmail App').description('Application name'),
-                    description: Joi.string().trim().allow('').max(1024).example('My cool app').description('Application description'),
-                    title: Joi.string().allow('').trim().max(256).example('App title').description('Title for the application button'),
-
-                    enabled: Joi.boolean().truthy('Y', 'true', '1', 'on').falsy('N', 'false', 0, '').example(true).description('Enable this app'),
-
-                    clientId: Joi.string()
-                        .trim()
-                        .allow('', null, false)
-                        .max(256)
-                        .example('52422112755-3uov8bjwlrullq122rdm6l8ui25ho7qf.apps.googleusercontent.com')
-                        .description('Client or Application ID for 3-legged OAuth2 applications')
-                        .label('UpdateOAuth2ClientId'),
-
-                    clientSecret: Joi.string()
-                        .trim()
-                        .empty('')
-                        .max(256)
-                        .example('boT7Q~dUljnfFdVuqpC11g8nGMjO8kpRAv-ZB')
-                        .description('Client secret for 3-legged OAuth2 applications'),
-
-                    pubSubApp: Joi.string()
-                        .empty('')
-                        .base64({ paddingRequired: false, urlSafe: true })
-                        .max(512)
-                        .example('AAAAAQAACnA')
-                        .description('Cloud Pub/Sub app for Gmail API webhooks')
-                        .label('UpdatePubSubAppId'),
-
-                    extraScopes: Joi.array()
-                        .items(Joi.string().trim().max(255).example('User.Read').label('UpdateExtraScopeEntry'))
-                        .description('OAuth2 Extra Scopes')
-                        .label('UpdateOAuth2ExtraScopes'),
-
-                    skipScopes: Joi.array()
-                        .items(Joi.string().trim().max(255).example('SMTP.Send').label('UpdateSkipScopeEntry'))
-                        .description('OAuth2 scopes to skip from the base set')
-                        .label('UpdateOAuth2SkipScopes'),
-
-                    serviceClient: Joi.string()
-                        .trim()
-                        .allow('', null, false)
-                        .max(256)
-                        .example('7103296518315821565203')
-                        .description('Service client ID for 2-legged OAuth2 applications')
-                        .label('UpdateServiceClient'),
-
-                    googleProjectId: googleProjectIdSchema,
-                    googleWorkspaceAccounts: googleWorkspaceAccountsSchema,
-                    googleTopicName: googleTopicNameSchema,
-                    googleSubscriptionName: googleSubscriptionNameSchema,
-
-                    serviceClientEmail: Joi.string()
-                        .email()
-                        .example('name@project-123.iam.gserviceaccount.com')
-                        .description('Service Client Email for 2-legged OAuth2 applications'),
-
-                    serviceKey: Joi.string()
-                        .trim()
-                        .empty('')
-                        .max(100 * 1024)
-                        .example('-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgk...')
-                        .description('PEM formatted service secret for 2-legged OAuth2 applications'),
-
-                    authority: Joi.string()
-                        .trim()
-                        .empty('')
-                        .max(1024)
-                        .example('common')
-                        .description('Authorization tenant value for Outlook OAuth2 applications')
-                        .label('SupportedAccountTypes'),
-
-                    cloud: Joi.string()
-                        .trim()
-                        .empty('')
-                        .valid('global', 'gcc-high', 'dod', 'china')
-                        .example('global')
-                        .description('Azure cloud type for Outlook OAuth2 applications')
-                        .label('AzureCloud'),
-
-                    tenant: Joi.string().trim().empty('').max(1024).example('f8cdef31-a31e-4b4a-93e4-5f571e91255a').label('Directorytenant'),
-
-                    redirectUrl: Joi.string()
-                        .allow('', null, false)
-                        .uri({ scheme: ['http', 'https'], allowRelative: false })
-                        .example('https://myservice.com/oauth')
-                        .description('Redirect URL for 3-legged OAuth2 applications')
-                        .label('UpdateOAuth2RedirectUrl')
-                }).label('UpdateOAuthApp')
-            },
-
-            response: {
-                schema: Joi.object({
-                    id: Joi.string().max(256).required().example('example').description('OAuth2 app ID')
-                }).label('UpdateOAuthAppResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'DELETE',
-        path: '/v1/oauth2/{app}',
-
-        async handler(request) {
-            try {
-                let result = await oauth2Apps.del(request.params.app);
-
-                try {
-                    await call({ cmd: 'googlePubSubRemove', app: request.params.app });
-                } catch (err) {
-                    request.logger.error({ msg: 'Failed to notify workers about OAuth2 app deletion', err, app: request.params.app });
-                }
-
-                return result;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Remove OAuth2 application',
-            notes: 'Delete OAuth2 application data',
-            tags: ['api', 'OAuth2 Applications'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    app: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID')
-                }).label('DeleteAppRequest')
-            },
-
-            response: {
-                schema: Joi.object({
-                    id: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID'),
-                    deleted: Joi.boolean().truthy('Y', 'true', '1').falsy('N', 'false', 0).default(true).description('Was the OAuth2 application deleted'),
-                    accounts: Joi.number()
-                        .integer()
-                        .example(12)
-                        .description('The number of accounts registered with this application. Not available for legacy apps.')
-                }).label('DeleteAppRequestResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'POST',
-        path: '/v1/oauth2/{app}/verify',
-
-        async handler(request) {
-            try {
-                return await verifyOAuth2App(request.params.app, {
-                    account: request.payload.account,
-                    testConnection: request.payload.testConnection
-                });
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Verify OAuth2 application setup',
-            notes: 'Runs the provider authentication chain step by step and reports which steps pass or fail, with hints for fixing failures. For service-account apps an optional mailbox address enables the delegation and live mailbox checks.',
-            tags: ['api', 'OAuth2 Applications'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    app: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID')
-                }),
-
-                payload: Joi.object({
-                    account: Joi.string()
-                        .trim()
-                        .empty('')
-                        .max(256)
-                        .example('user@example.com')
-                        .description('Mailbox address used to verify domain-wide delegation and live mailbox access'),
-                    testConnection: Joi.boolean()
-                        .truthy('Y', 'true', '1', 'on')
-                        .falsy('N', 'false', 0, '')
-                        .default(true)
-                        .description('Perform the live IMAP/API connection step when an access token is obtained')
-                }).label('VerifyOAuth2AppRequest')
-            },
-
-            response: {
-                schema: Joi.object({
-                    app: Joi.string().max(256).required().example('AAABhaBPHscAAAAH').description('OAuth2 application ID'),
-                    provider: Joi.string().example('gmailService').description('Provider type'),
-                    authMethod: Joi.string().allow(null).example('externalAccount').description('Authentication method for service-account apps'),
-                    account: Joi.string().allow(null).example('user@example.com').description('Mailbox used for the delegation/mailbox checks'),
-                    ok: Joi.boolean().example(true).description('True when no verification step failed'),
-                    steps: Joi.array()
-                        .items(
-                            Joi.object({
-                                id: Joi.string().example('signJwt').description('Step identifier'),
-                                label: Joi.string().example('Sign assertion (signJwt)').description('Human readable step name'),
-                                status: Joi.string().valid('ok', 'fail', 'skip').example('ok').description('Step outcome'),
-                                message: Joi.string().allow(null).example('Assertion signed via IAM signJwt').description('Outcome detail'),
-                                hint: Joi.string()
-                                    .example('Grant roles/iam.serviceAccountTokenCreator to the workload principal')
-                                    .description('How to fix a failed step')
-                            }).label('OAuth2VerifyStep')
-                        )
-                        .label('OAuth2VerifySteps')
-                }).label('VerifyOAuth2AppResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/gateways',
-
-        async handler(request) {
-            try {
-                let gatewayObject = new Gateway({ redis, gateway: request.params.gateway, call, secret: await getSecret() });
-
-                return await gatewayObject.listGateways(request.query.page, request.query.pageSize);
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'List gateways',
-            notes: 'Lists registered gateways',
-            tags: ['api', 'SMTP Gateway'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                query: Joi.object({
-                    page: Joi.number()
-                        .integer()
-                        .min(0)
-                        .max(1024 * 1024)
-                        .default(0)
-                        .example(0)
-                        .description('Page number (zero indexed, so use 0 for first page)')
-                        .label('PageNumber'),
-                    pageSize: Joi.number().integer().min(1).max(1000).default(20).example(20).description('How many entries per page').label('PageSize')
-                }).label('GatewaysFilter')
-            },
-
-            response: {
-                schema: Joi.object({
-                    total: Joi.number().integer().example(120).description('How many matching entries').label('TotalNumber'),
-                    page: Joi.number().integer().example(0).description('Current page (0-based index)').label('PageNumber'),
-                    pages: Joi.number().integer().example(24).description('Total page count').label('PagesNumber'),
-
-                    gateways: Joi.array()
-                        .items(
-                            Joi.object({
-                                gateway: Joi.string().max(256).required().example('example').description('Gateway ID'),
-                                name: Joi.string().max(256).example('My Email Gateway').description('Display name for the gateway'),
-                                deliveries: Joi.number().integer().empty('').example(100).description('Count of email deliveries using this gateway'),
-                                lastUse: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('Last delivery time'),
-                                lastError: lastErrorSchema.allow(null)
-                            }).label('GatewayResponseItem')
-                        )
-                        .label('GatewayEntries')
-                }).label('GatewaysFilterResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/gateway/{gateway}',
-
-        async handler(request) {
-            let gatewayObject = new Gateway({ redis, gateway: request.params.gateway, call, secret: await getSecret() });
-            try {
-                let gatewayData = await gatewayObject.loadGatewayData();
-
-                // remove secrets
-                if (gatewayData.pass) {
-                    gatewayData.pass = '******';
-                }
-
-                let result = {};
-
-                for (let key of ['gateway', 'name', 'host', 'port', 'user', 'pass', 'secure', 'deliveries', 'lastUse', 'lastError']) {
-                    if (key in gatewayData) {
-                        result[key] = gatewayData[key];
-                    }
-                }
-
-                return result;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Get gateway info',
-            notes: 'Returns stored information about the gateway. Passwords are not included.',
-            tags: ['api', 'SMTP Gateway'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    gateway: Joi.string().max(256).required().example('example').description('Gateway ID')
-                })
-            },
-
-            response: {
-                schema: Joi.object({
-                    gateway: Joi.string().max(256).required().example('example').description('Gateway ID'),
-
-                    name: Joi.string().max(256).required().example('My Email Gateway').description('Display name for the gateway'),
-                    deliveries: Joi.number().integer().empty('').example(100).description('Count of email deliveries using this gateway'),
-                    lastUse: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('Last delivery time'),
-
-                    user: Joi.string().empty('').trim().max(1024).description('SMTP authentication username').label('UserName'),
-                    pass: Joi.string().empty('').max(1024).description('SMTP authentication password').label('Password'),
-
-                    host: Joi.string().hostname().example('smtp.gmail.com').description('Hostname to connect to').label('Hostname'),
-                    port: Joi.number()
-                        .integer()
-                        .min(1)
-                        .max(64 * 1024)
-                        .example(465)
-                        .description('Service port number')
-                        .label('Port'),
-
-                    secure: Joi.boolean()
-                        .truthy('Y', 'true', '1', 'on')
-                        .falsy('N', 'false', 0, '')
-                        .default(false)
-                        .example(true)
-                        .description('Should connection use TLS. Usually true for port 465')
-                        .label('GatewayTlsOptions'),
-
-                    lastError: lastErrorSchema.allow(null)
-                }).label('GatewayResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'POST',
-        path: '/v1/gateway',
-
-        async handler(request) {
-            let gatewayObject = new Gateway({ redis, call, secret: await getSecret() });
-
-            try {
-                let result = await gatewayObject.create(request.payload);
-                return result;
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'Register new gateway',
-            notes: 'Registers a new SMP gateway',
-            tags: ['api', 'SMTP Gateway'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                payload: Joi.object({
-                    gateway: Joi.string().empty('').trim().max(256).default(null).example('sendgun').description('Gateway ID').label('Gateway ID').required(),
-
-                    name: Joi.string().empty('').max(256).example('John Smith').description('Account Name').label('Gateway Name').required(),
-
-                    user: Joi.string().empty('').trim().default(null).max(1024).description('SMTP authentication username').label('UserName'),
-                    pass: Joi.string().empty('').max(1024).default(null).description('SMTP authentication password').label('Password'),
-
-                    host: Joi.string().hostname().example('smtp.gmail.com').description('Hostname to connect to').label('Hostname').required(),
-                    port: Joi.number()
-                        .integer()
-                        .min(1)
-                        .max(64 * 1024)
-                        .example(465)
-                        .description('Service port number')
-                        .label('Port')
-                        .required(),
-
-                    secure: Joi.boolean()
-                        .truthy('Y', 'true', '1', 'on')
-                        .falsy('N', 'false', 0, '')
-                        .default(false)
-                        .example(true)
-                        .description('Should connection use TLS. Usually true for port 465')
-                        .label('GatewayCreateTlsOptions')
-                }).label('CreateGateway')
-            },
-
-            response: {
-                schema: Joi.object({
-                    gateway: Joi.string().max(256).required().example('example').description('Gateway ID'),
-                    state: Joi.string()
-                        .required()
-                        .valid('existing', 'new')
-                        .example('new')
-                        .description('Is the gateway new or updated existing')
-                        .label('CreateGatewayState')
-                }).label('CreateGatewayResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'PUT',
-        path: '/v1/gateway/edit/{gateway}',
-
-        async handler(request) {
-            let gatewayObject = new Gateway({ redis, gateway: request.params.gateway, call, secret: await getSecret() });
-
-            try {
-                return await gatewayObject.update(request.payload);
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Update gateway info',
-            notes: 'Updates gateway information',
-            tags: ['api', 'SMTP Gateway'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    gateway: Joi.string().max(256).required().example('example').description('Gateway ID')
-                }),
-
-                payload: Joi.object({
-                    name: Joi.string().empty('').max(256).example('John Smith').description('Account Name').label('Gateway Name'),
-
-                    user: Joi.string().empty('').trim().max(1024).allow(null).description('SMTP authentication username').label('UserName'),
-                    pass: Joi.string().empty('').max(1024).allow(null).description('SMTP authentication password').label('Password'),
-
-                    host: Joi.string().hostname().empty('').example('smtp.gmail.com').description('Hostname to connect to').label('Hostname'),
-                    port: Joi.number()
-                        .integer()
-                        .min(1)
-                        .empty('')
-                        .max(64 * 1024)
-                        .example(465)
-                        .description('Service port number')
-                        .label('Port'),
-
-                    secure: Joi.boolean()
-                        .truthy('Y', 'true', '1', 'on')
-                        .falsy('N', 'false', 0, '')
-                        .example(true)
-                        .description('Should connection use TLS. Usually true for port 465')
-                        .label('GatewayUpdateTlsOptions')
-                }).label('UpdateGateway')
-            },
-
-            response: {
-                schema: Joi.object({
-                    gateway: Joi.string().max(256).required().example('example').description('Gateway ID')
-                }).label('UpdateGatewayResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'DELETE',
-        path: '/v1/gateway/{gateway}',
-
-        async handler(request) {
-            let gatewayObject = new Gateway({
-                redis,
-                gateway: request.params.gateway,
-                secret: await getSecret()
-            });
-
-            try {
-                return await gatewayObject.delete();
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Remove SMTP gateway',
-            notes: 'Delete SMTP gateway data',
-            tags: ['api', 'SMTP Gateway'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    gateway: Joi.string().max(256).required().example('example').description('Gateway ID')
-                }).label('DeleteRequest')
-            },
-
-            response: {
-                schema: Joi.object({
-                    gateway: Joi.string().max(256).required().example('example').description('Gateway ID'),
-                    deleted: Joi.boolean().truthy('Y', 'true', '1').falsy('N', 'false', 0).default(true).description('Was the gateway deleted')
-                }).label('DeleteGatewayResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/account/{account}/oauth-token',
-
-        async handler(request) {
-            let enableOAuthTokensApi = await settings.get('enableOAuthTokensApi');
-            if (!enableOAuthTokensApi) {
-                let error = Boom.boomify(new Error('Disabled API endpoint'), { statusCode: 403 });
-                error.output.payload.code = 'ApiEndpointDisabled';
-                throw error;
-            }
-
-            let accountObject = new Account({
-                redis,
-                account: request.params.account,
-                call,
-                secret: await getSecret(),
-                timeout: request.headers['x-ee-timeout']
-            });
-
-            try {
-                const tokenData = await accountObject.getActiveAccessTokenData();
-
-                // Record metric if token was actually refreshed (not cached)
-                if (!tokenData.cached) {
-                    const provider = tokenData.provider || 'unknown';
-                    metrics(request.logger, 'oauth2TokenRefresh', 'inc', { status: 'success', provider, statusCode: '200' });
-                }
-
-                return tokenData;
-            } catch (err) {
-                // Record failed token refresh
-                const statusCode = String(err.statusCode || 0);
-                metrics(request.logger, 'oauth2TokenRefresh', 'inc', { status: 'failure', provider: 'unknown', statusCode });
-
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'Get OAuth2 access token',
-            notes: 'Get the active OAuth2 access token for an account. NB! This endpoint is disabled by default and needs activation on the Service configuration page.',
-            tags: ['api', 'Account'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-                params: Joi.object({
-                    account: accountIdSchema.required()
-                })
-            },
-
-            response: {
-                schema: Joi.object({
-                    account: accountIdSchema.required(),
-                    user: Joi.string().max(256).required().example('user@example.com').description('Username'),
-                    accessToken: Joi.string().max(256).required().example('aGVsbG8gd29ybGQ=').description('Access Token').label('OAuthAccessToken'),
-                    provider: OAuth2ProviderSchema
-                }).label('AccountTokenResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/account/{account}/server-signatures',
-
-        async handler(request) {
-            let accountObject = new Account({
-                redis,
-                account: request.params.account,
-                call,
-                secret: await getSecret(),
-                timeout: request.headers['x-ee-timeout']
-            });
-            try {
-                return await accountObject.listSignatures(request.query);
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'List Account Signatures',
-            notes: 'Returns signatures associated with the account. Currently only Gmail is supported, and only "new message" signatures from the "sendAs" list are returned.',
-            tags: ['api', 'Account'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-                params: Joi.object({
-                    account: accountIdSchema.required()
-                })
-            },
-
-            response: {
-                schema: Joi.object({
-                    signatures: Joi.array()
-                        .items(
-                            Joi.object({
-                                address: Joi.string().email().example('user@example.com').description('Email address associated with the signature').required(),
-                                signature: Joi.string().example('<div>Best regards,</div>').description('Signature HTML code').required()
-                            }).label('SignatureResponseItem')
-                        )
-                        .label('SignatureEntries')
-                }).label('AccountSignaturesResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'POST',
-        path: '/v1/delivery-test/account/{account}',
-        async handler(request) {
-            let accountObject = new Account({
-                redis,
-                account: request.params.account,
-                call,
-                secret: await getSecret(),
-                timeout: request.headers['x-ee-timeout']
-            });
-
-            try {
-                // throws if account does not exist
-                let accountData = await accountObject.loadAccountData();
-
-                request.logger.info({ msg: 'Requested SMTP delivery test', account: request.params.account });
-
-                let headers = {
-                    'Content-Type': 'application/json',
-                    'User-Agent': `${packageData.name}/${packageData.version} (+${packageData.homepage})`
-                };
-
-                let res = await fetchCmd(`${SMTP_TEST_HOST}/test-address`, {
-                    method: 'post',
-                    body: JSON.stringify({
-                        version: packageData.version,
-                        requestor: '@postalsys/emailengine-app'
-                    }),
-                    headers,
-                    dispatcher: httpAgent.retry
-                });
-
-                if (!res.ok) {
-                    let err = new Error(`Invalid response: ${res.status} ${res.statusText}`);
-                    err.statusCode = res.status;
-
-                    try {
-                        err.details = await res.json();
-                    } catch (err) {
-                        // ignore
-                    }
-
-                    throw err;
-                }
-
-                let testAccount = await res.json();
-                if (!testAccount || !testAccount.user) {
-                    let err = new Error(`Invalid test account`);
-                    err.statusCode = 500;
-
-                    try {
-                        err.details = testAccount;
-                    } catch (err) {
-                        // ignore
-                    }
-
-                    throw err;
-                }
-
-                if (request.payload.gateway) {
-                    // try to load the gateway, throws if not set
-                    let gatewayObject = new Gateway({ redis, gateway: request.payload.gateway, call, secret: await getSecret() });
-                    await gatewayObject.loadGatewayData();
-                }
-
-                try {
-                    let now = new Date().toISOString();
-                    let queueResponse = await accountObject.queueMessage(
-                        {
-                            account: accountData.account,
-                            subject: `Delivery test ${now}`,
-                            text: `Hello
-
-This is an automated email to test deliverability settings. If you see this email, you can safely delete it.
-
-${now}`,
-                            html: `<p>Hello</p>
-<p>This is an automated email to test deliverability settings. If you see this email, you can safely delete it.</p>
-<p>${now}</p>`,
-                            from: {
-                                name: accountData.name,
-                                address: accountData.email
-                            },
-                            to: [{ name: 'Delivery Test Server', address: testAccount.address }],
-                            copy: false,
-                            gateway: request.payload.gateway,
-                            feedbackKey: `${REDIS_PREFIX}test-send:${testAccount.user}`,
-                            deliveryAttempts: 1
-                        },
-                        { source: 'test' }
-                    );
-
-                    return {
-                        success: !!queueResponse.queueId,
-                        deliveryTest: testAccount.user
-                    };
-                } catch (err) {
-                    return {
-                        error: err.message
-                    };
-                }
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                if (err.details) {
-                    error.output.payload.details = err.details;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Create delivery test',
-            notes: 'Initiate a delivery test',
-            tags: ['api', 'Delivery Test'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    account: accountIdSchema.required()
-                }),
-
-                payload: Joi.object({
-                    gateway: Joi.string().allow(false, null).empty('').max(256).example(false).description('Optional gateway ID').label('DeliveryTestGateway')
-                }).label('DeliveryStartRequest')
-            },
-
-            response: {
-                schema: Joi.object({
-                    success: Joi.boolean().example(true).description('Was the test started').label('ResponseDeliveryStartSuccess'),
-                    deliveryTest: Joi.string()
-                        .guid({
-                            version: ['uuidv4', 'uuidv5']
-                        })
-                        .example('6420a6ad-7f82-4e4f-8112-82a9dad1f34d')
-                        .description('Test ID')
-                }).label('DeliveryStartResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/delivery-test/check/{deliveryTest}',
-        async handler(request) {
-            try {
-                request.logger.info({ msg: 'Requested SMTP delivery test check', deliveryTest: request.params.deliveryTest });
-
-                let deliveryStatus = (await redis.hgetall(`${REDIS_PREFIX}test-send:${request.params.deliveryTest}`)) || {};
-                if (deliveryStatus.success === 'false') {
-                    let err = new Error(`Failed to deliver email`);
-                    err.statusCode = 500;
-                    err.details = deliveryStatus;
-                    throw err;
-                }
-
-                let headers = {
-                    'Content-Type': 'application/json',
-                    'User-Agent': `${packageData.name}/${packageData.version} (+${packageData.homepage})`
-                };
-
-                let res = await fetchCmd(`${SMTP_TEST_HOST}/test-address/${request.params.deliveryTest}`, {
-                    method: 'get',
-                    headers,
-                    dispatcher: httpAgent.retry
-                });
-
-                if (!res.ok) {
-                    let err = new Error(`Invalid response: ${res.status} ${res.statusText}`);
-                    err.statusCode = res.status;
-
-                    try {
-                        err.details = await res.json();
-                    } catch (err) {
-                        // ignore
-                    }
-
-                    throw err;
-                }
-
-                let testResponse = await res.json();
-
-                let success = testResponse && testResponse.status === 'success'; //Default
-
-                if (testResponse && success) {
-                    let mainSig =
-                        testResponse.dkim &&
-                        testResponse.dkim.results &&
-                        testResponse.dkim.results.find(entry => entry && entry.status && entry.status.result === 'pass' && entry.status.aligned);
-
-                    if (!mainSig) {
-                        mainSig =
-                            testResponse.dkim &&
-                            testResponse.dkim.results &&
-                            testResponse.dkim.results.find(entry => entry && entry.status && entry.status.result === 'pass');
-                    }
-
-                    if (!mainSig) {
-                        mainSig = testResponse.dkim && testResponse.dkim.results && testResponse.dkim.results[0];
-                    }
-
-                    testResponse.mainSig = mainSig || {
-                        status: {
-                            result: 'none'
-                        }
-                    };
-
-                    if (testResponse.spf && testResponse.spf.status && testResponse.spf.status.comment) {
-                        testResponse.spf.status.comment = testResponse.spf.status.comment.replace(/^[^:\s]+:s*/, '');
-                    }
-                }
-
-                if (testResponse) {
-                    if (testResponse.status === 'success') {
-                        delete testResponse.status;
-                    }
-                    delete testResponse.user;
-                }
-
-                return Object.assign({ success }, testResponse || {});
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                if (err.details) {
-                    error.output.payload.details = err.details;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Check test status',
-            notes: 'Check delivery test status',
-            tags: ['api', 'Delivery Test'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    deliveryTest: Joi.string()
-                        .guid({
-                            version: ['uuidv4', 'uuidv5']
-                        })
-                        .example('6420a6ad-7f82-4e4f-8112-82a9dad1f34d')
-                        .required()
-                        .description('Test ID')
-                }).label('DeliveryCheckParams')
-            },
-
-            response: {
-                schema: Joi.object({
-                    success: Joi.boolean().example(true).description('Was the test completed').label('ResponseDeliveryCheckSuccess'),
-                    dkim: Joi.object().unknown().description('DKIM results').label('DkimResults'),
-                    spf: Joi.object().unknown().description('SPF results').label('SpfResults'),
-                    dmarc: Joi.object().unknown().description('DMARC results').label('DmarcResults'),
-                    bimi: Joi.object().unknown().description('BIMI results').label('BimiResults'),
-                    arc: Joi.object().unknown().description('ARC results').label('ArcResults'),
-                    mainSig: Joi.object()
-                        .unknown()
-                        .description('Primary DKIM signature. `status.aligned` should be set, otherwise DKIM check should not be considered as passed.')
-                        .label('MainSignature')
-                }).label('DeliveryCheckResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/blocklists',
-
-        async handler(request) {
-            try {
-                return await lists.list(request.query.page, request.query.pageSize);
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'List blocklists',
-            notes: 'List blocklists with blocked addresses',
-            tags: ['api', 'Blocklists'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                query: Joi.object({
-                    page: Joi.number()
-                        .integer()
-                        .min(0)
-                        .max(1024 * 1024)
-                        .default(0)
-                        .example(0)
-                        .description('Page number (zero indexed, so use 0 for first page)')
-                        .label('PageNumber'),
-                    pageSize: Joi.number().integer().min(1).max(1000).default(20).example(20).description('How many entries per page').label('PageSize')
-                }).label('PageListsRequest')
-            },
-
-            response: {
-                schema: Joi.object({
-                    total: Joi.number().integer().example(120).description('How many matching entries').label('TotalNumber'),
-                    page: Joi.number().integer().example(0).description('Current page (0-based index)').label('PageNumber'),
-                    pages: Joi.number().integer().example(24).description('Total page count').label('PagesNumber'),
-
-                    blocklists: Joi.array()
-                        .items(
-                            Joi.object({
-                                listId: Joi.string().max(256).required().example('example').description('List ID'),
-                                count: Joi.number().integer().example(12).description('Count of blocked addresses in this list')
-                            }).label('BlocklistsResponseItem')
-                        )
-                        .label('BlocklistsEntries')
-                }).label('BlocklistsResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/blocklist/{listId}',
-
-        async handler(request) {
-            try {
-                return await lists.listContent(request.params.listId, request.query.page, request.query.pageSize);
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-
-        options: {
-            description: 'List blocklist entries',
-            notes: 'List blocked addresses for a list',
-            tags: ['api', 'Blocklists'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    listId: Joi.string()
-                        .hostname()
-                        .example('test-list')
-                        .description('List ID. Must use a subdomain name format. Lists are registered ad-hoc, so a new identifier defines a new list.')
-                        .label('ListID')
-                        .required()
-                }).label('BlocklistListRequest'),
-
-                query: Joi.object({
-                    page: Joi.number()
-                        .integer()
-                        .min(0)
-                        .max(1024 * 1024)
-                        .default(0)
-                        .example(0)
-                        .description('Page number (zero indexed, so use 0 for first page)')
-                        .label('PageNumber'),
-                    pageSize: Joi.number().integer().min(1).max(1000).default(20).example(20).description('How many entries per page').label('PageSize')
-                }).label('PageListsRequest')
-            },
-
-            response: {
-                schema: Joi.object({
-                    listId: Joi.string().max(256).required().example('example').description('List ID'),
-                    total: Joi.number().integer().example(120).description('How many matching entries').label('TotalNumber'),
-                    page: Joi.number().integer().example(0).description('Current page (0-based index)').label('PageNumber'),
-                    pages: Joi.number().integer().example(24).description('Total page count').label('PagesNumber'),
-                    addresses: Joi.array()
-                        .items(
-                            Joi.object({
-                                recipient: Joi.string().email().example('user@example.com').description('Listed email address').required(),
-                                account: accountIdSchema.required().required(),
-                                messageId: Joi.string().example('<test123@example.com>').description('Message ID'),
-                                source: Joi.string().example('api').description('Which mechanism was used to add the entry'),
-                                reason: Joi.string().example('api').description('Why this entry was added'),
-                                remoteAddress: Joi.string()
-                                    .ip({
-                                        version: ['ipv4', 'ipv6'],
-                                        cidr: 'optional'
-                                    })
-                                    .description('Which IP address triggered the entry'),
-                                userAgent: Joi.string().example('Mozilla/5.0 (Macintosh)').description('Which user agent triggered the entry'),
-                                created: Joi.date().iso().example('2021-02-17T13:43:18.860Z').description('The time this entry was added or updated').required()
-                            }).label('BlocklistListResponseItem')
-                        )
-                        .label('BlocklistListEntries')
-                }).label('BlocklistListResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'POST',
-        path: '/v1/blocklist/{listId}',
-        async handler(request) {
-            let accountObject = new Account({
-                redis,
-                account: request.payload.account,
-                call,
-                secret: await getSecret(),
-                timeout: request.headers['x-ee-timeout']
-            });
-
-            try {
-                // throws if account does not exist
-                await accountObject.loadAccountData();
-
-                let added = await redis.eeListAdd(
-                    `${REDIS_PREFIX}lists:unsub:lists`,
-                    `${REDIS_PREFIX}lists:unsub:entries:${request.params.listId}`,
-                    request.params.listId,
-                    request.payload.recipient.toLowerCase().trim(),
-                    JSON.stringify({
-                        recipient: request.payload.recipient,
-                        account: request.payload.account,
-                        source: 'api',
-                        reason: request.payload.reason,
-                        remoteAddress: request.app.ip,
-                        userAgent: request.headers['user-agent'],
-                        created: new Date().toISOString()
-                    })
-                );
-
-                return {
-                    success: true,
-                    added: !!added
-                };
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                if (err.details) {
-                    error.output.payload.details = err.details;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Add to blocklist',
-            notes: 'Add an email address to a blocklist',
-            tags: ['api', 'Blocklists'],
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    listId: Joi.string()
-                        .hostname()
-                        .example('test-list')
-                        .description('List ID. Must use a subdomain name format. Lists are registered ad-hoc, so a new identifier defines a new list.')
-                        .label('ListID')
-                        .required()
-                }).label('BlocklistListRequest'),
-
-                payload: Joi.object({
-                    account: accountIdSchema.required(),
-                    recipient: Joi.string().empty('').email().example('user@example.com').description('Email address to add to the list').required(),
-                    reason: Joi.string().empty('').default('block').description('Identifier for the blocking reason')
-                }).label('BlocklistListAddPayload')
-            },
-
-            response: {
-                schema: Joi.object({
-                    success: Joi.boolean().example(true).description('Was the request successful').label('BlocklistListAddSuccess'),
-                    added: Joi.boolean().example(true).description('Was the address added to the list')
-                }).label('BlocklistListAddResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'DELETE',
-        path: '/v1/blocklist/{listId}',
-
-        async handler(request) {
-            try {
-                let exists = await redis.hexists(`${REDIS_PREFIX}lists:unsub:lists`, request.params.listId);
-                if (!exists) {
-                    let message = 'Requested blocklist was not found';
-                    let error = Boom.boomify(new Error(message), { statusCode: 404 });
-                    throw error;
-                }
-
-                let deleted = await redis.eeListRemove(
-                    `${REDIS_PREFIX}lists:unsub:lists`,
-                    `${REDIS_PREFIX}lists:unsub:entries:${request.params.listId}`,
-                    request.params.listId,
-                    request.query.recipient.toLowerCase().trim()
-                );
-
-                return {
-                    deleted: !!deleted
-                };
-            } catch (err) {
-                request.logger.error({ msg: 'API request failed', err });
-                if (Boom.isBoom(err)) {
-                    throw err;
-                }
-                let error = Boom.boomify(err, { statusCode: err.statusCode || 500 });
-                if (err.code) {
-                    error.output.payload.code = err.code;
-                }
-                throw error;
-            }
-        },
-        options: {
-            description: 'Remove from blocklist',
-            notes: 'Delete a blocked email address from a list',
-            tags: ['api', 'Blocklists'],
-
-            plugins: {},
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG,
-
-            validate: {
-                options: {
-                    stripUnknown: false,
-                    abortEarly: false,
-                    convert: true
-                },
-                failAction,
-
-                params: Joi.object({
-                    listId: Joi.string()
-                        .hostname()
-                        .example('test-list')
-                        .description('List ID. Must use a subdomain name format. Lists are registered ad-hoc, so a new identifier defines a new list.')
-                        .label('ListID')
-                        .required()
-                }).label('BlocklistListRequest'),
-
-                query: Joi.object({
-                    recipient: Joi.string().empty('').email().example('user@example.com').description('Email address to remove from the list').required()
-                }).label('RecipientQuery')
-            },
-
-            response: {
-                schema: Joi.object({
-                    deleted: Joi.boolean().truthy('Y', 'true', '1').falsy('N', 'false', 0).default(true).description('Was the address removed from the list')
-                }).label('DeleteBlocklistResponse'),
-                failAction: 'log'
-            }
-        }
-    });
-
-    server.route({
-        method: 'GET',
-        path: '/v1/changes',
-
-        async handler(request, h) {
-            request.app.stream = new ResponseStream();
-            finished(request.app.stream, err => request.app.stream.finalize(err));
-            setImmediate(() => {
-                try {
-                    request.app.stream.write(`: EmailEngine v${packageData.version}\n\n`);
-                } catch (err) {
-                    // ignore
-                }
-            });
-            return h
-                .response(request.app.stream)
-                .header('X-Accel-Buffering', 'no')
-                .header('Connection', 'keep-alive')
-                .header('Cache-Control', 'no-cache')
-                .type('text/event-stream');
-        },
-
-        options: {
-            description: 'Stream state changes',
-            notes: 'Stream account state changes as an EventSource',
-            tags: ['api', 'Account'],
-
-            plugins: {
-                'hapi-swagger': {
-                    produces: ['text/event-stream']
-                }
-            },
-
-            auth: {
-                strategy: 'api-token',
-                mode: 'required'
-            },
-            cors: CORS_CONFIG
-        }
-    });
-
-    // Web UI routes
-
-    await server.register({
-        plugin: Crumb,
-
-        options: {
-            cookieOptions: {
-                isSecure: secureCookie
-            },
-
-            skip: (request /*, h*/) => {
-                let tags = (request.route && request.route.settings && request.route.settings.tags) || [];
-
-                if (tags.includes('api') || tags.includes('metrics') || tags.includes('external')) {
-                    return true;
-                }
-
-                return false;
-            }
-        }
-    });
-
-    server.views({
-        engines: {
-            hbs: handlebars
-        },
-        compileOptions: {
-            preventIndent: true
-        },
+    server.views({
+        engines: {
+            hbs: handlebars
+        },
+        compileOptions: {
+            preventIndent: true
+        },
 
         relativeTo: pathlib.join(__dirname, '..'),
         path: './views',
@@ -7288,9 +3036,7 @@ ${now}`,
 
         async handler(request, h) {
             const renderedMetrics = await call({ cmd: 'metrics', timeout: request.headers['x-ee-timeout'] });
-            const response = h.response('success');
-            response.type('text/plain');
-            return renderedMetrics;
+            return h.response(renderedMetrics).type('text/plain');
         },
         options: {
             tags: ['scope:metrics'],
@@ -7311,6 +3057,35 @@ ${now}`,
 
     await server.start();
 
+    if (USE_REUSE_PORT) {
+        // Hapi (autoListen:false) wired its request dispatcher to our listener but did not
+        // bind it. Bind now with SO_REUSEPORT so the kernel distributes connections across
+        // all API workers. listen() can throw synchronously (bad args) or emit 'error'
+        // asynchronously (EADDRINUSE/EACCES/ENOTSUP); handle both, mirroring probeReusePort().
+        await new Promise((resolve, reject) => {
+            const onError = err => {
+                let wrapped = new Error(
+                    `Failed to bind API worker ${WORKER_INDEX} to ${API_HOST}:${API_PORT} with SO_REUSEPORT` + (err && err.code ? ` (${err.code})` : '')
+                );
+                wrapped.code = err && err.code;
+                wrapped.workerIndex = WORKER_INDEX;
+                wrapped.host = API_HOST;
+                wrapped.port = API_PORT;
+                reject(wrapped);
+            };
+            reusePortListener.once('error', onError);
+            try {
+                reusePortListener.listen({ port: API_PORT, host: API_HOST, reusePort: true }, () => {
+                    reusePortListener.removeListener('error', onError);
+                    resolve();
+                });
+            } catch (err) {
+                reusePortListener.removeListener('error', onError);
+                onError(err);
+            }
+        });
+    }
+
     // trigger a request to cache swagger.json
     setImmediate(() => {
         server
@@ -7340,6 +3115,7 @@ ${now}`,
             }
 
             if (
+                IS_PRIMARY_API_WORKER &&
                 currentCert &&
                 currentCert.validTo < new Date(Date.now() - RENEW_TLS_AFTER) &&
                 (!currentCert.lastCheck || currentCert.lastCheck < new Date(Date.now() - BLOCK_TLS_RENEW))