# Create mail address for a web hosting package

> A new mail address for one web hosting package - a mailbox, a forward, a catch-all, or one that refuses or deletes mail.

- Effect: Write - Changes the account. Agents ask first.
- Idempotent: no
- Stability: beta
- MCP tool: `manitu_webhosting_mail_address_create` on https://mcp.manitu.de/mcp
- REST: `POST https://api.manitu.de/v1/webhosting/mail/address/create`
- Needs: `service_webhosting`
- Page: /reference/webhosting/mail/address/create/

**Changes the account. Agents say what will happen and wait for an explicit yes before calling it.**

## MCP tool

`manitu_webhosting_mail_address_create`

### Description for the model

Creates a mail address for a web hosting package of the manitu customer account this connection works in, by its site_id from manitu_webhosting_list, at one of the package's domains. type says what it does: mailbox (mail is kept; needs mailbox.password_hash - bcrypt, "$2b$"/"$2y$" - NEVER ask for or pass a plaintext password: mailbox.password is refused over this connection, a password in a chat is no longer secret; without a hash, the customer creates the mailbox in the customer panel), forward (target_list required), catchall (every address of a domain not set up otherwise - written @example.de; target_list required), reject (mail refused, the sender gets an error) or delete (mail accepted and deleted unread - e.g. for an address that only gets spam). Check first with manitu_webhosting_mail_address_list (text_contains) that the address is free. Refused with a conflict when the package allows no more mailboxes (limit_reached), its mail disk space is almost full (quota_almost_exceeded) or it cannot be changed now (not_configurable). Usable a few minutes later; for a mailbox the answer says how to set up a mail program. Tell the customer what will happen - for a forward or catch-all every target, as mail to an outside address leaves the account - and ask for an explicit yes first.

### Arguments

- `site_id` (integer | string, required) - The site_id from manitu_webhosting_list - never guess one. (pattern `"^[1-9][0-9]*$"`; minimum `1`)
- `mail_address` (string, required) - The mail address from manitu_webhosting_mail_address_list, e.g. info@example.de - a catch-all is written "@" and its domain, e.g. @example.de. Never guess one. (minLength `2`; maxLength `254`)
- `type` (string, required) - What the address does - it cannot be changed later. (one of `"mailbox"`, `"forward"`, `"catchall"`, `"reject"`, `"delete"`)
- `description` (string | null) - The customer's description, for his own overview. Left out: unchanged (set) or none (create); null or empty: none. (maxLength `1024`)
- `target_list` (array of string) - Where mail goes on to - the whole list, it replaces the one there. Forward and catch-all: required, at least one; mailbox: copies besides the mailbox (may be empty); reject and delete: not taken. A catch-all may have one entry "@" and a domain of the package - the same name at that domain. Mail to an address outside manitu leaves the account: name the targets to the customer. (maxItems `25`)
- `alias_list` (array of string) - Other addresses whose mail ends up here - the whole list, it replaces the one there. Mailbox and forward only. (maxItems `25`)
- `greylisting` (boolean) - Greylisting against spam: mail from an unknown sender is accepted only on its second try, minutes later. Mailbox and forward only. Default when created: true.
- `mailbox` (object) - The mailbox - type mailbox only.
  - `mailbox.password` (string, write-only) - The password a mail program logs in with - customer panel and REST only, refused over MCP: never ask for a password in a chat. Kept as a hash only, never shown again. Only one of password, password_hash. 12 to 72 printable ASCII characters, no space at the start or the end, not listed as leaked (pwnedpasswords.com). (minLength `12`; maxLength `72`; pattern `"^[\\x20-\\x7E]+$"`)
  - `mailbox.password_hash` (string, write-only) - The password as a hash made by the customer - instead of password. A hash can be attacked offline: only for a strong password. Taken: bcrypt ("$2b$" or "$2y$", cost 10 or more). (maxLength `128`; pattern `"^\\$"`)
  - `mailbox.quota_mb` (integer | null) - Disk space in MB its mail may take, at most the package's; null or 0: no limit of its own. Default when created: the package's. (minimum `0`)
  - `mailbox.suspended` (boolean) - true switches it off without deleting it: no login, mail to it is refused.
  - `mailbox.alias_login_allowed` (boolean) - Whether a mail program may log in with an alias as well. Default when created: false.

### Example

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "manitu_webhosting_mail_address_create",
    "arguments": {
      "site_id": 12345,
      "mail_address": "info@example.com",
      "type": "mailbox"
    }
  }
}
```

## REST

`POST https://api.manitu.de/v1/webhosting/mail/address/create`

### Authentication

One of `X-API-Key`, `Authorization: Bearer …` - never more than one in a request.

### Request body

JSON; unknown fields are refused.

- `site_id` (integer | string, required) - The site_id from manitu_webhosting_list - never guess one. (pattern `"^[1-9][0-9]*$"`; minimum `1`)
- `mail_address` (string, required) - The mail address from manitu_webhosting_mail_address_list, e.g. info@example.de - a catch-all is written "@" and its domain, e.g. @example.de. Never guess one. (minLength `2`; maxLength `254`)
- `type` (string, required) - What the address does - it cannot be changed later. (one of `"mailbox"`, `"forward"`, `"catchall"`, `"reject"`, `"delete"`)
- `description` (string | null) - The customer's description, for his own overview. Left out: unchanged (set) or none (create); null or empty: none. (maxLength `1024`)
- `target_list` (array of string) - Where mail goes on to - the whole list, it replaces the one there. Forward and catch-all: required, at least one; mailbox: copies besides the mailbox (may be empty); reject and delete: not taken. A catch-all may have one entry "@" and a domain of the package - the same name at that domain. Mail to an address outside manitu leaves the account: name the targets to the customer. (maxItems `25`)
- `alias_list` (array of string) - Other addresses whose mail ends up here - the whole list, it replaces the one there. Mailbox and forward only. (maxItems `25`)
- `greylisting` (boolean) - Greylisting against spam: mail from an unknown sender is accepted only on its second try, minutes later. Mailbox and forward only. Default when created: true.
- `mailbox` (object) - The mailbox - type mailbox only.
  - `mailbox.password` (string, write-only) - The password a mail program logs in with - customer panel and REST only, refused over MCP: never ask for a password in a chat. Kept as a hash only, never shown again. Only one of password, password_hash. 12 to 72 printable ASCII characters, no space at the start or the end, not listed as leaked (pwnedpasswords.com). (minLength `12`; maxLength `72`; pattern `"^[\\x20-\\x7E]+$"`)
  - `mailbox.password_hash` (string, write-only) - The password as a hash made by the customer - instead of password. A hash can be attacked offline: only for a strong password. Taken: bcrypt ("$2b$" or "$2y$", cost 10 or more). (maxLength `128`; pattern `"^\\$"`)
  - `mailbox.quota_mb` (integer | null) - Disk space in MB its mail may take, at most the package's; null or 0: no limit of its own. Default when created: the package's. (minimum `0`)
  - `mailbox.suspended` (boolean) - true switches it off without deleting it: no login, mail to it is refused.
  - `mailbox.alias_login_allowed` (boolean) - Whether a mail program may log in with an alias as well. Default when created: false.

### Response

In `data`; the rest of the body as on every call.

- `mail_address` (string, required) - The address - what the other mail address tools take. A catch-all is "@" and its domain, e.g. @example.de. Internationalized domains in Unicode.
- `mail_address_ascii` (string, required) - The same address as the mail servers have it (internationalized domains in ASCII, xn--).
- `type` (string | null, required) - What happens to its mail: mailbox - kept, to read with a mail program or webmail; forward - sent on to target_list, nothing kept; catchall - every address of its domain not set up otherwise, sent on to target_list; reject - refused, the sender gets an error; delete - accepted and deleted unread, the sender learns nothing. null: a kind no longer used. (one of `"mailbox"`, `"forward"`, `"catchall"`, `"reject"`, `"delete"`, `null`)
- `description` (string | null, required) - What the customer wrote about it (his description), null if nothing - not its name or user name.
- `target_list` (array of string | null, required) - Where its mail goes on to - for a forward and a catch-all where it goes, for a mailbox copies besides the mailbox. An entry "@other.example" (catch-all only) sends to the same name at that domain. null for reject and delete.
- `alias_list` (array of string | null, required) - Other addresses whose mail ends up here (mailbox and forward only, else null) - they are not addresses of their own.
- `greylisting` (boolean | null, required) - Greylisting against spam: mail from an unknown sender is accepted only on its second try, minutes later. Mailbox and forward only, else null.
- `created_at` (string | null, required) - When it was created. (format `date-time`)
- `mailbox` (object | null, required) - The mailbox - type mailbox only, else null.
  - `mailbox.quota_mb` (integer | null, required) - Disk space in MB its mail may take; null: no limit of its own (the package's applies).
  - `mailbox.suspended` (boolean, required) - Switched off by the customer: no login, mail to it is refused - kept for later.
  - `mailbox.alias_login_allowed` (boolean, required) - A mail program may log in with an alias as well, not only with mail_address.
  - `mailbox.panel_access` (boolean, required) - With its address and password one may log in to the customer panel - for this mailbox only (password, autoreply, filters). Changed in the customer panel only.
  - `mailbox.autoreply_active` (boolean, required) - An automatic reply (e.g. out of office) is switched on - manitu_webhosting_mail_address_autoreply_get shows it.
  - `mailbox.password_change_recommended` (boolean, required) - The password is kept in an outdated form - the customer should set a new one.
  - `mailbox.last_login_at` (string | null, required) - Its last login (mail program or webmail), null if never. (format `date-time`)
  - `mailbox.connection` (object, required)
    - `mailbox.connection.host` (string, required) - The server a mail program connects to - for receiving (IMAP, POP3) and sending (SMTP) alike. NOT the MX server of the package.
    - `mailbox.connection.username` (string, required) - The user name to log in with - the full mail address; the password is the mailbox's.
    - `mailbox.connection.method_list` (array of object, required) - The ways to connect, per protocol the one to prefer first - encrypted only, there is no unencrypted way. Receiving: IMAP (mail stays on the server, several devices) or POP3 (mail is fetched); sending: SMTP with login (the same user name and password) - port 587 with STARTTLS where 465 is blocked.
      - `mailbox.connection.method_list[].protocol` (string, required) - (one of `"imap"`, `"pop3"`, `"smtp"`)
      - `mailbox.connection.method_list[].port` (integer, required)
      - `mailbox.connection.method_list[].security` (string, required) - ssl_tls: encrypted from the start (often "SSL/TLS"); starttls: switched to encryption after connecting ("STARTTLS"). (one of `"ssl_tls"`, `"starttls"`)
      - `mailbox.connection.method_list[].is_recommended` (boolean, required)

### Statuses

- `200` Success.
- `400` The request does not match the declared input schema.
- `401` No credential was presented, or it was not recognised.
- `403` The credential is not permitted to use this operation.
- `500` The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.
- `503` The channel this operation forwards through is unavailable.

### Example

```sh
curl -X POST 'https://api.manitu.de/v1/webhosting/mail/address/create' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"site_id":12345,"mail_address":"info@example.com","type":"mailbox"}'
```

## Example result

```json
{
  "mail_address": "info@example.com",
  "mail_address_ascii": "string",
  "type": "mailbox",
  "description": "Example",
  "target_list": [
    "string"
  ],
  "alias_list": [
    "string"
  ],
  "greylisting": true,
  "created_at": "2026-10-23T12:00:00+02:00",
  "mailbox": {
    "quota_mb": 1,
    "suspended": true,
    "alias_login_allowed": true,
    "panel_access": true,
    "autoreply_active": true,
    "password_change_recommended": true,
    "last_login_at": "2026-10-23T12:00:00+02:00",
    "connection": {
      "host": "string",
      "username": "string",
      "method_list": [
        {
          "protocol": "imap",
          "port": 1,
          "security": "ssl_tls",
          "is_recommended": true
        }
      ]
    }
  }
}
```