> ## Documentation Index > Fetch the complete documentation index at: https://jobo.world/docs/llms.txt > Use this file to discover all available pages before exploring further. # Connect a mailbox > Auto Apply is an invite-only beta. Accounts without access receive 403 with problem code auto_apply_not_enabled. Connects an inbox this account may read verification codes from. Mailboxes are account-level resources: connect once, then reference the mailbox id from any application's verification retrieval call. Optional. Connecting a mailbox is a convenience, not a requirement: email verification steps behave identically without one, and an integration that already reads the inbox itself can keep doing so and submit the code through the normal answers call. Use these endpoints only if you would rather not build and operate inbox access. Provider imap (Gmail app passwords, custom domains, most providers) verifies the credentials synchronously — success returns status connected, a rejected login is 422 mailbox_verification_failed and nothing is stored. Provider outlook returns status pending plus an authorization_url; open it (or send it to the mailbox owner) to grant consent via Microsoft, after which the mailbox flips to connected. Outlook/Microsoft 365 requires this OAuth flow — Microsoft disabled basic-auth IMAP in April 2026 — and is read over Microsoft Graph, so the imap_* fields are neither required nor returned for it. Credentials are encrypted at rest and never returned by any endpoint. ## OpenAPI ````yaml /openapi.yaml post /api/auto-apply/mailboxes openapi: 3.0.3 info: title: Jobo Enterprise API description: > The Jobo Enterprise API provides programmatic access to job listings, intelligent search, real-time feeds, geocoding services, and callback-driven job applications. Auto Apply is an invite-only beta; accounts without access receive 403 auto_apply_not_enabled from create. version: '2026-08-12' contact: name: Jobo Support url: https://jobo.world email: support@jobo.world license: name: Proprietary — see terms of service url: https://jobo.world/terms termsOfService: https://jobo.world/terms servers: - url: https://connect.jobo.world description: Production security: - ApiKeyAuth: [] tags: - name: Jobs description: Search and retrieve job listings - name: Feed description: Bulk job feeds and expiration tracking - name: Companies description: Company profiles and company-scoped job listings - name: Auto Apply description: >- Coming soon: profileless applications answered through signed, typed HTTPS callbacks - name: Locations description: Geocoding and location services paths: /api/auto-apply/mailboxes: post: tags: - Auto Apply summary: Connect a mailbox description: | Auto Apply is an invite-only beta. Accounts without access receive 403 with problem code auto_apply_not_enabled. Connects an inbox this account may read verification codes from. Mailboxes are account-level resources: connect once, then reference the mailbox id from any application's verification retrieval call. Optional. Connecting a mailbox is a convenience, not a requirement: email verification steps behave identically without one, and an integration that already reads the inbox itself can keep doing so and submit the code through the normal answers call. Use these endpoints only if you would rather not build and operate inbox access. Provider imap (Gmail app passwords, custom domains, most providers) verifies the credentials synchronously — success returns status connected, a rejected login is 422 mailbox_verification_failed and nothing is stored. Provider outlook returns status pending plus an authorization_url; open it (or send it to the mailbox owner) to grant consent via Microsoft, after which the mailbox flips to connected. Outlook/Microsoft 365 requires this OAuth flow — Microsoft disabled basic-auth IMAP in April 2026 — and is read over Microsoft Graph, so the imap_* fields are neither required nor returned for it. Credentials are encrypted at rest and never returned by any endpoint. operationId: createAutoApplyMailbox requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateMailboxRequest' examples: imap: summary: Gmail with an app password value: provider: imap address: candidate@gmail.com imap_host: imap.gmail.com password: abcd efgh ijkl mnop outlook: summary: Outlook / Microsoft 365 via hosted OAuth value: provider: outlook address: candidate@outlook.com responses: '200': description: >- The mailbox. Status connected for a verified imap mailbox; status pending with authorization_url for an outlook mailbox awaiting consent. content: application/json: schema: $ref: '#/components/schemas/Mailbox' '401': $ref: '#/components/responses/Unauthorized' '403': description: The account has not been granted Auto Apply. content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '409': description: A mailbox with this address already exists (mailbox_already_exists). content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '422': description: >- Validation failed, the IMAP host/port is not allowed (unsafe_imap_host), the credentials were rejected (mailbox_verification_failed), or the account mailbox limit is reached (mailbox_limit_reached). content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' '429': $ref: '#/components/responses/TooManyRequests' '503': description: >- Outlook connections are not configured on this deployment (mailbox_oauth_unavailable). content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' x-codeSamples: - lang: cURL source: | curl -X POST "https://connect.jobo.world/api/auto-apply/mailboxes" \ -H "X-Api-Key: $JOBO_API_KEY" \ -H "Content-Type: application/json" \ -d '{"provider": "imap", "address": "candidate@example.com", "imap_host": "imap.gmail.com", "password": "app-password"}' components: schemas: CreateMailboxRequest: type: object required: - provider - address properties: provider: type: string enum: - imap - outlook description: >- imap connects with host + credentials; outlook starts the hosted Microsoft OAuth consent flow. address: type: string format: email description: The mailbox address. Unique per account; lowercased. imap_host: type: string nullable: true description: Required for provider imap. Ports 993 and 143 only. imap_port: type: integer nullable: true default: 993 imap_security: type: string enum: - ssl - starttls nullable: true default: ssl username: type: string nullable: true description: Defaults to address. password: type: string nullable: true description: >- Required for provider imap (use an app password where the provider offers them). Encrypted at rest, never returned. Mailbox: type: object required: - api_version - id - provider - address - status - created_at - updated_at properties: api_version: $ref: '#/components/schemas/AutoApplyApiVersion' id: type: string format: uuid provider: type: string enum: - imap - outlook address: type: string format: email status: type: string enum: - pending - connected - error - disabled description: >- pending = outlook mailbox awaiting consent; error = the last connectivity check failed (see last_error). imap_host: type: string nullable: true imap_port: type: integer nullable: true imap_security: type: string nullable: true username: type: string nullable: true authorization_url: type: string format: uri nullable: true description: >- Only on a pending outlook mailbox: open this URL (or send it to the mailbox owner) to grant consent via Microsoft. last_error: type: string nullable: true connected_at: type: string format: date-time nullable: true last_checked_at: type: string format: date-time nullable: true created_at: type: string format: date-time updated_at: type: string format: date-time ProblemDetails: type: object description: Problem Details object returned for error responses. properties: type: type: string nullable: true title: type: string nullable: true status: type: integer nullable: true detail: type: string nullable: true instance: type: string nullable: true code: type: string nullable: true description: Stable machine-readable code for Auto Apply domain errors. api_version: $ref: '#/components/schemas/AutoApplyApiVersion' AutoApplyApiVersion: type: string description: Version of the profileless Auto Apply API contract. enum: - '2026-08-12' example: '2026-08-12' ApiRateLimitError: type: object description: API-key request-window rejection returned by rate-limit middleware. required: - error - detail - group - retry_after_seconds properties: error: type: string example: Rate limit exceeded detail: type: string group: type: string example: AutoApply retry_after_seconds: type: integer minimum: 0 nullable: true responses: Unauthorized: description: Missing or invalid API key content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' TooManyRequests: description: Rate limit exceeded. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' application/json: schema: $ref: '#/components/schemas/ApiRateLimitError' securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-Api-Key description: API key provided by Jobo ````