API documentation — Fastmail for Business

Cited by

Facts read from this source

• Mail protocols Report an error

  “Mail — you can access mail via JMAP, IMAP, or POP and send via JMAP or SMTP.”

• Calendars protocols Report an error

  “Calendars — you can access via CalDAV. We will be opening up JMAP access as well, as soon as the specification is finalized.”

• Files protocols Report an error

  “Files — you can access via WebDAV.”

• Oauth supported Report an error

  “You can use OAuth with all of our supported protocols”

• API tokens Report an error

  “you can generate an API token (for JMAP access) in Settings → Privacy & Security → Manage API tokens, or an app password (for everything else) in Settings → Privacy & Security → Manage app passwords and access.”

• Jmap session URL Report an error

  “The JMAP session resource can be found at https://api.fastmail.com/jmap/session.”

• Cors enabled Report an error

  “Our JMAP APIs are CORS enabled so you can create integrations directly from a web app, as well as from a server or native code.”

• Masked email jmap extension Report an error

  “We support a JMAP extension to allow apps to manage a user’s Masked Email addresses.”

• Masked email states Report an error

  “pending: the initial state. Once set to anything else, it cannot be set back to pending.”

• Masked email pending deletion Report an error

  “Pending email addresses are automatically deleted 24h after creation and are not shown in the Fastmail UI.”

• Masked email disabled behavior Report an error

  “disabled: the address is active, but mail is sent straight to trash.”

• Masked email deleted behavior Report an error

  “deleted: the address is inactive; any mail sent to the address is bounced.”

• Masked email prefix constraint Report an error

  “The string MUST be <= 64 characters in length and MUST only contain characters a-z, 0-9 and _ (underscore).”

• Masked email methods Report an error

  “MaskedEmail/get This is a standard “/get” method as described in RFC8620, Section 5.1.”

• Masked email rate limits Report an error

  “To prevent abuse, there are rate limits in place. A standard JMAP rateLimit SetError will be returned on create if these are exceeded.”

• Oauth grant flow Report an error

  “Fastmail can authorize third-party clients to access a user’s data using OAuth 2.0, in conformance with the Authorization Code grant flow of the OAuth 2.0 Authorization Framework, as defined in RFC 6749.”

• Oauth public clients Report an error

  “For native clients (which can use a localhost or private-use scheme for their redirect URI), there is no need to register manually with us. We support the OAuth Profile for Open Public Clients.”

• Oauth authorize URL Report an error

  “Clients initiate authorization by opening the user’s web browser at the Fastmail OAuth Authorization URL: https://api.fastmail.com/oauth/authorize”

• Oauth token URL Report an error

  “the client will obtain initial refresh tokens and access tokens by making a POST request to the Fastmail token endpoint: https://api.fastmail.com/oauth/refresh”

• Oauth code expiry Report an error

  “code: The authorization code. This may be exchanged for the refresh token. It expires 10 minutes after authorization.”

• Oauth pkce required Report an error

  “code_challenge: A PKCE code challenge as per RFC 7636, using SHA-256.”

• Oauth scopes Report an error

  “urn:ietf:params:jmap:core This grants access to use the JMAP protocol and fetch the user’s session object.”

• Oauth refresh token rotation Report an error

  “a new refresh token will be returned in the response and the client MUST replace their previous refresh token with this.”

• Oauth device isolation Report an error

  “If the user has multiple devices, each client MUST obtain separate authorization. You cannot share a refresh token between devices.”

• Oauth revocation endpoint Report an error

  “it can revoke it as per RFC7009 using the token revocation endpoint URL https://api.fastmail.com/oauth/revoke.”

• Company Report an error

  “© 2026 Fastmail Pty Ltd. All rights reserved.”

• Open source samples Report an error

  “We’ve written a short JMAP crash course, and published open source sample code to our GitHub account to help you get started.”

Scores citing this record

• The Data Protection Officer Mail, domains & deliverability
• The Data Protection Officer Calendar, contacts & office apps
• The Data Protection Officer Administration, identity & partner management
• The Data Protection Officer Migration, open standards & exit
• The IT Administrator Mail, domains & deliverability
• The IT Administrator Calendar, contacts & office apps
• The IT Administrator Migration, open standards & exit
• The IT Service Provider Mail, domains & deliverability
• The IT Service Provider Calendar, contacts & office apps
• The IT Service Provider Administration, identity & partner management
• The IT Service Provider Migration, open standards & exit
• The Public Sector IT Lead Mail, domains & deliverability
• The Public Sector IT Lead Calendar, contacts & office apps
• The Public Sector IT Lead Migration, open standards & exit
• The Skeptic Mail, domains & deliverability
• The Skeptic Calendar, contacts & office apps
• The Skeptic Administration, identity & partner management
• The Skeptic Migration, open standards & exit
• The Small Firm Owner Mail, domains & deliverability
• The Small Firm Owner Calendar, contacts & office apps
• The Small Firm Owner Administration, identity & partner management
• The Small Firm Owner Migration, open standards & exit