Sandbox Recipients

Sandbox tenants can only send to recipients who have explicitly consented. This is the anti-abuse cornerstone — new accounts cannot blast arbitrary mailboxes.

POST /v1/sandbox-recipients

Invite a recipient. Finn emails them a confirmation link; once they click it, you can send to them.

{"email": "[email protected]"}

Response — 201 Created

{
  "email": "[email protected]",
  "status": "pending",
  "consent_email_sent": true
}

If they click "Allow", status becomes "confirmed" and you can send. If they click "Decline", the recipient moves to "rejected" — you cannot re-invite.

Errors

• sandbox_recipient_rejected (409) — previously declined; re-invite is blocked

Already confirmed

If the recipient is already confirmed, the response is 200 OK with status: "confirmed".

GET /v1/sandbox-recipients

List all sandbox recipients for the tenant.

{
  "recipients": [
    {"email": "[email protected]", "status": "confirmed"},
    {"email": "[email protected]", "status": "pending"}
  ]
}

Graduation

Once you verify a sending domain (POST /v1/domains/{id}/verify → verified), the tenant is promoted to verified trust tier — the sandbox-recipient gate is lifted.