Connect IMAP/SMTP mailbox

Outcome

Connect an IMAP/SMTP mailbox (for example Migadu) to a seat through Nexus (app_topolo_nexus.email.mailboxes.connect_imap) as the signed-in person, so the mailbox belongs to them (allowed_app_ids [app_topolo_engage] lets Engage send from it in the background), and bind it. The password is passed straight to Nexus and is never stored, logged or returned by Engage. 401 user_credential_required, 424 mailbox_directory_not_configured, 422 mailbox_connect_refused when Nexus rejects the credentials, 502 mailbox_directory_unavailable. Verify with seats.get; undo by binding another mailbox.

Before you start

• Verify the intended environment, signed-in credential, authorized organization and the action permission workspace:write.
• Discover and select an authorized canonical Engage workspace. Pass resourceType=workspace and resourceId separately from action input.
• Review the exact effects and obtain approval before CLI --confirm or MCP confirm:true. A local capture does not authorize a live mutation.

Discover the target

topolo whoami --json
topolo actions get app_topolo_engage.seats.connect_mailbox_imap --json
topolo workspaces list topolo-engage --json

Set ENGAGE_WORKSPACE_ID to the identifier of the selected authorized workspace.

Input contract

Validate, plan and execute

Build payload.json from the current schema and discovered identifiers. The action description above defines its behavior, limits, side effects and declared errors.

: "${ENGAGE_WORKSPACE_ID:?Set ENGAGE_WORKSPACE_ID to your selected workspace identifier}"
topolo actions validate app_topolo_engage.seats.connect_mailbox_imap --data @payload.json --json
topolo actions plan app_topolo_engage.seats.connect_mailbox_imap --resource-type workspace --resource-id "$ENGAGE_WORKSPACE_ID" --data @payload.json --confirm --json

Review the plan and approve its exact effects before executing the unchanged request.

: "${ENGAGE_WORKSPACE_ID:?Set ENGAGE_WORKSPACE_ID to your selected workspace identifier}"
topolo actions call app_topolo_engage.seats.connect_mailbox_imap --resource-type workspace --resource-id "$ENGAGE_WORKSPACE_ID" --data @payload.json --confirm --json

For MCP, use topolo_get_action, topolo_validate_action, topolo_plan_action and topolo_call_action. Pass resource context separately where required; confirm:true is required for mutations.

Captured successful requests and responses

Captured HTTP 200 · seat mailbox actions > connects an IMAP mailbox: the password reaches Nexus only and is never stored, logged or returned

Action input

{
  "id": "eng_seat_1",
  "emailAddress": "ash@migadu.test",
  "imapHost": "imap.migadu.com",
  "imapPort": 993,
  "smtpHost": "smtp.migadu.com",
  "smtpPort": 465,
  "password": "Migadu-Pa55word-never-stored"
}

Actual local response

{
  "seat": {
    "id": "eng_seat_1",
    "nexusMailboxId": "mbsender_imap",
    "mailboxStatus": "active",
    "mailboxCheckedAt": "2026-10-06T08:30:00.000Z",
    "whatsappConnectionId": null,
    "displayName": "Ash",
    "fromAddress": "ash@example.com",
    "status": "active",
    "pauseReason": null,
    "timezone": "Europe/London",
    "warmup": {
      "startDate": "2026-10-01",
      "startLimit": 10,
      "dailyIncrease": 3,
      "maxLimit": 50
    },
    "createdAt": "2026-10-06T08:30:00.000Z",
    "updatedAt": "2026-10-06T08:30:00.000Z",
    "health": {
      "windowDays": 14,
      "sent": 0,
      "bounced": 0,
      "optedOut": 0,
      "bounceRate": 0,
      "optOutRate": 0,
      "healthy": true,
      "sentToday": 0,
      "warmupCap": 25
    }
  }
}

Source test: seat mailbox actions > connects an IMAP mailbox: the password reaches Nexus only and is never stored, logged or returned. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Effects and response meaning

• Connect an IMAP/SMTP mailbox (for example Migadu) to a seat through Nexus (app_topolo_nexus.email.mailboxes.connect_imap) as the signed-in person, so the mailbox belongs to them (allowed_app_ids [app_topolo_engage] lets Engage send from it in the background), and bind it. The password is passed straight to Nexus and is never stored, logged or returned by Engage. 401 user_credential_required, 424 mailbox_directory_not_configured, 422 mailbox_connect_refused when Nexus rejects the credentials, 502 mailbox_directory_unavailable. Verify with seats.get; undo by binding another mailbox.

Verify the outcome

• Check the response against the declared output schema and the requested operation. For mutations, use the action-specific read described in the action description before any dependent operation.

Recover

For an uncertain result, inspect current retained state with a read action before retrying. Do not replay a mutation unless its contract explicitly guarantees idempotency.

Refused requests

Captured HTTP 401 · seat mailbox actions > connects and reads mailboxes only as the signed-in person: without their token it refuses before calling Nexus

Action input

{
  "id": "eng_seat_1",
  "emailAddress": "ash@migadu.test",
  "imapHost": "imap.migadu.com",
  "imapPort": 993,
  "smtpHost": "smtp.migadu.com",
  "smtpPort": 465,
  "password": "Migadu-Pa55word-never-stored"
}

Actual local response

{
  "error": {
    "code": "user_credential_required",
    "message": "Connect a mailbox while signed in as the person it belongs to."
  }
}

Source test: seat mailbox actions > connects and reads mailboxes only as the signed-in person: without their token it refuses before calling Nexus. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 422 · seat mailbox actions > connects an IMAP mailbox: the password reaches Nexus only and is never stored, logged or returned

Action input

{
  "id": "eng_seat_1",
  "emailAddress": "ash@migadu.test",
  "imapHost": "imap.migadu.com",
  "imapPort": 993,
  "smtpHost": "smtp.migadu.com",
  "smtpPort": 465,
  "password": "Migadu-Pa55word-never-stored"
}

Actual local response

{
  "error": {
    "code": "mailbox_connect_refused",
    "message": "Nexus refused the mailbox request.",
    "details": {
      "nexusCode": "imap_auth_failed"
    }
  }
}

Source test: seat mailbox actions > connects an IMAP mailbox: the password reaches Nexus only and is never stored, logged or returned. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 502 · seat mailbox actions > connects an IMAP mailbox: the password reaches Nexus only and is never stored, logged or returned

Action input

{
  "id": "eng_seat_1",
  "emailAddress": "ash@migadu.test",
  "imapHost": "imap.migadu.com",
  "imapPort": 993,
  "smtpHost": "smtp.migadu.com",
  "smtpPort": 465,
  "password": "Migadu-Pa55word-never-stored"
}

Actual local response

{
  "error": {
    "code": "mailbox_directory_unavailable",
    "message": "Nexus could not be reached. Try again."
  }
}

Source test: seat mailbox actions > connects an IMAP mailbox: the password reaches Nexus only and is never stored, logged or returned. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Captured HTTP 422 · seat mailbox actions > connects an IMAP mailbox: the password reaches Nexus only and is never stored, logged or returned

Refused input; do not execute

{
  "emailAddress": "ash@migadu.test",
  "imapHost": "imap.migadu.com",
  "imapPort": "x",
  "smtpHost": "smtp.migadu.com",
  "smtpPort": 465,
  "password": "Migadu-Pa55word-never-stored",
  "id": "eng_seat_1"
}

Actual local response

{
  "error": {
    "code": "invalid_action_input",
    "message": "Input for seats.connect_mailbox_imap is invalid.",
    "details": [
      {
        "expected": "number",
        "code": "invalid_type",
        "path": [
          "imapPort"
        ],
        "message": "Invalid input: expected number, received string"
      }
    ]
  }
}

Source test: seat mailbox actions > connects an IMAP mailbox: the password reaches Nexus only and is never stored, logged or returned. Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

Error recovery

• HTTP 401 user_credential_required: Read the refusal details and current action contract, correct the stated cause, then validate and plan again. Do not retry unchanged or infer success.
• HTTP 422 mailbox_connect_refused: Read the refusal details and current action contract, correct the stated cause, then validate and plan again. Do not retry unchanged or infer success.
• HTTP 502 mailbox_directory_unavailable: Preserve the request and inspect the declared dependency state. Retry only after the transient or configuration cause is resolved; do not infer that the operation completed.
• HTTP 422 invalid_action_input: Correct the request against the current action input schema, then validate it again before planning.

Related actions

• List sending seats
• Create sending seat
• Get sending seat
• Update sending seat
• Pause sending seat
• Resume sending seat
• Start mailbox connection (Google or Microsoft)
• Bind mailbox to seat
• Check seat mailbox
• Set seat WhatsApp number
• List seat health
• Get seat health

Evidence and limits

• /api/seats/{id}/mailbox/connect-imap

• Actual route handlers with SQLite repositories; synthetic identity/workspace grants and provider ports.

• Widget/bootstrap use actual app handler but mocked worker runtime and app identity.

• No gateway execution, live permissions, external delivery or deployed proof.

These are local route captures with synthetic identity and simulated dependencies. They do not prove live authorization, gateway execution, production state, or external delivery.