Provision mailboxes

Internal testing — not generally available

The Provisioning API is still in internal testing. Endpoints and payloads may change without notice, and access is granted case by case. Treat this guide and the reference as a preview rather than a contract, and talk to us before building against it.

The Provisioning API lets integration partners white-label mailbox provisioning for their own end customers. You create senders and connect domains; the platform handles Microsoft 365 tenant setup, DNS configuration and mailbox creation.

Provisioning APIv1Internal testing

Base URL

https://live-api.customers.ac/v1

Key

sac_live_… / sac_test_…Scoped per operation. Sandbox provisions nothing.

The object model

Object	What it is
User	an end customer on your platform
Sender	a logical grouping of domains and mailboxes belonging to a user
Domain	a domain connected to the platform
Mailbox	an individual email account with IMAP/SMTP credentials
Operation	every write returns an operation_id you can poll or receive by webhook

Everything is asynchronous

A POST that triggers infrastructure changes returns immediately with status: "pending" and an operation_id. It has not happened yet. Poll GET /operations/{id} to track progress, or take the webhook.

This is the part most integrations get wrong: treating the 201 as completion. The mailbox does not exist until the operation says so.

The path through

1. Create a user — POST /users — one per end customer on your platform.
2. Create a sender — POST /senders — the grouping that domains and mailboxes hang off.
3. Connect a domain. The platform assigns nameservers in response.
4. Update the registrar with those nameservers, then wait for propagation — up to 48 hours. Nothing you can do shortens this.
5. M365 is provisioned automatically once propagation completes. You do not call anything to trigger it.
6. Read the mailboxes — GET /senders/{id}/mailboxes — and their credentials when you need IMAP/SMTP details.

Step 4 is the long pole and it is outside the API. Design your onboarding so a customer can leave and come back rather than watching a spinner.

Pagination

List endpoints are cursor-based. Pass page[size] (max 100, default 25) and page[after], an opaque cursor taken from a previous response.

Tearing down

Deprovisioning is explicit and separate per level:

• DELETE /senders/{id}
• DELETE /domains/{id}

Both are writes, so both return an operation_id and complete asynchronously like everything else.

Sandbox

Sandbox keys (sac_test_…) run against https://sandbox-api.customers.ac/v1, where no real infrastructure is provisioned and operations complete instantly. That makes it the right place to exercise the async polling flow without waiting on DNS propagation or M365.

Webhooks

Not documented yet

The spec says an operation result can be “received via webhook”, but does not describe how a subscription is registered or what the payload looks like. Rather than guess, this guide leaves it out. Poll GET /operations/{id} and talk to us if you need push delivery.