Step 4: RESTful APIs

Two kinds of client talk to this service. Other mail servers and desktop mail apps use the standard protocols, SMTP and IMAP, whose commands are fixed by internet standards. The web and mobile apps use an HTTP API that we design ourselves, and that API is the subject of this step.

The API is stateless: each request carries everything the server needs, including an Authorization header with an OAuth2 bearer token that identifies the user. No server keeps session data between calls, so any server can answer any request. Requests and responses use JSON, and times are Unix epoch milliseconds