{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "zoho-mail", "name": "Zoho Mail API", "vendor": "Zoho", "vendorUrl": "https://www.zoho.com/mail/", "kind": "http-api", "category": "mailbox-access", "summary": "Zoho Mail is Zoho's hosted business email service. Its REST API lets an application read, search, send and organise mail in a Zoho Mail account and administer an organisation's users, domains, groups and policies, with OAuth 2.0 access.", "url": "https://www.anchorterminal.com/tools/zoho-mail", "markdownUrl": "https://www.anchorterminal.com/tools/zoho-mail.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/zoho-mail.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/zoho-mail.json", "license": "Proprietary service under the Zoho Terms of Service and the Zoho Mail usage policy. No source repository was found", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 only. A person registers a client in the Zoho API console (server-based, client-based, mobile, non-browser with device authorisation, or a self client for one's own account) and approves scopes of the form `ZohoMail.\u003cresource\u003e.\u003coperation\u003e`. Registration is self-serve, with no app review or sales approval found. The access token lasts one hour and goes in `Authorization: Zoho-oauthtoken \u003ctoken\u003e`. The refresh token lasts until revoked. Organisation calls need an administrator's account. Each data centre has its own accounts host and API host.", "pricing": "freemium", "pricingNotes": "API access comes with a mailbox plan and has no per-call charge. Mail Free covers up to five users on one domain with no card and is available in some regions only. Paid plans cost $1 to $6 a user a month billed yearly, with a 15-day trial of the highest edition and no card. The API guide says plan and mail policy decide which APIs an account can call (https://www.zoho.com/mail/zohomail-pricing.html, checked 2026-10-09).", "priceSummary": "$1 / seat-mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API guide, the OAuth guide or the pricing page (checked 2026-10-09).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://www.zoho.com/mail/help/api/", "llmsTxt": "https://www.zoho.com/mail/help/llms.txt", "capabilities": [ "mailbox.read", "mailbox.search", "mailbox.send", "mailbox.drafts", "mailbox.sync" ], "tags": [ "hosted", "closed-source", "oauth", "mcp", "webhooks", "free-tier", "no-card", "llms-txt", "email", "status-page", "bug-bounty", "soc2", "eu-data-residency" ], "graded": true, "anchor": { "graded": true, "score": 53.8, "grade": "D", "agentReady": false, "rank": 626, "ranked": true, "rankOf": 842, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 56, "maintenance": 33, "payments": 30, "reliability": 63, "schema": 45, "security": 67, "transparency": 73 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 63, "points": 12.6, "reason": "Graded on the REST API, read with the hosted lines. status.zoho.com redirects to us.zohostatus.com, which has components for Zoho Mail, mail listing, IMAP, POP, SMTP and the MX host, with incident history (20). In the 90 days to 9 October 2026 the history has seven notices naming a mail component (IMAP, the MX host and one mail listing), each under 12 minutes, the longest the MX host for 11 minutes 40 seconds on 3 October. Two notices covering several products, on 12 July and 10 August, lasted under 10 minutes, and the status feed shows mail components changing state when they ended. We read that as minor incidents only (20 of 30). Only the US page was read. The getting started guide says each API has its own rate limit and gives no numbers. Sending limits are published, 50 to 500 external emails an hour and 1,000 internal (7 of 15). The response code list has no 429, and no Retry-After, backoff guidance or idempotency key was found. The guide says only that the response will say when a limit is exceeded (2 of 15). The pricing page lists a 99.9% uptime guarantee for paid plans, with no SLA document, measurement or credit terms found (4 of 10). The API carries no beta or preview label (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 45, "points": 7.31, "reason": "Graded on the REST API. No OpenAPI or similar file was found in the docs or under the zoho organisation on GitHub. The MCP tool definitions sit in a signed-in console and were not read (0 of 25). `https://www.zoho.com/mail/help/llms.txt` indexes a Markdown twin of every reference page (10). Each page states the purpose and names the call that supplies each ID, with little on when not to use a call (13 of 20). Parameters are listed with a type, a mandatory mark, allowed values and defaults, in prose only. Many PUT calls share one URL and differ by a `mode` field, and sample responses carry numbers and booleans as strings (9 of 15). Every page has a curl sample and a sample response. Errors are one shared list of seven status codes, with nothing per endpoint (9 of 15). The path has no version. What's New is a product changelog dated by month, and no API changelog was found (4 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 56, "points": 9.1, "reason": "Graded on the REST API. List and search return a summary per message and the body is a separate call, with `limit` from 1 to 200 and a default of 10. There is no field selection. In MCP the owner chooses which tools a server carries, and the tool count is not published (17 of 25). `start` and `limit`, filters for folder, read status, flag, label, thread and attachments, three sort keys and a search syntax (18 of 20). Errors carry a status code, a description and a `moreInfo` message. Seven codes are documented, with no list of messages or recovery steps (10 of 20). No idempotency key or conditional write was found, so a retried send can go out twice. Delete moves to Trash unless `expunge=true`. MCP annotations were not read (5 of 20). Send needs only `fromAddress` and `toAddress`, and defaults are stated. No REST SDK in any language, tokens last an hour, hosts differ by data centre, and reading a body needs an account ID, a folder ID and a message ID (6 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 67, "points": 11.73, "reason": "OAuth 2.0 with scopes down to one resource and one operation, one-hour access tokens, revocable refresh tokens, PKCE for mobile and browser clients and a device flow (30). Less 10 because the documented token, refresh and revoke calls carry the client secret and refresh token in the URL query string (20 of 30). READ, CREATE, UPDATE and DELETE are separate scopes per resource, delete goes to Trash by default, and an MCP server holds only the tools its owner adds. Nothing confirms a send, and the MCP URL holds an API key that the FAQ says works like a password (14 of 20). Mail is untrusted content. No prompt-injection guidance was found in the API guide or the MCP pages read (2 of 15). The Logs API returns login history, admin audit records and SMTP logs, and the admin console has audit logs with SIEM export. No per-call API log was found (11 of 15). security.txt valid to 30 June 2028, a bug bounty, and ISO/IEC 27001 and SOC 2 Type II per the Zoho Mail compliance page (20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "No x402, MPP or L402 (0 of 40). Plan prices are public without a login, $1 to $6 a user a month billed yearly, with API access included and no per-call price (10 of 20). Mail Free covers five users with no card, in some regions only, and the highest paid edition has a 15-day trial with no card (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0 of 20)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 33, "points": 2.89, "reason": "Zoho keeps no API changelog, so recency rests on what could be dated. Zoho Mail MCP is listed under May 2026 in What's New, between 131 and 161 days before this check. Product changes are listed for August 2026, none of them to the API (10 of 30, where a reading on product changes would give 20). What's New has more than three entries in the last 90 days, dated by month and none about the API or MCP, so half credit (10 of 20). The pricing page states support by email, chat and phone around the clock, and the changelog is public. We did not test the community forum for replies (9 of 15 for a closed service). No REST SDK. A Java command line tool and the MCP server are official. The MCP registry was not checked (4 of 15). No public repository, package or CI was found (0 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 73, "points": 6.39, "note": "editorial 51, provenance 95", "reason": "The editorial half. A closed service under the Zoho Terms of Service, last updated 2 March 2022, and a Zoho Mail usage policy updated 2 September 2026. No source repository (15 of 30). The privacy policy of 22 December 2025 says Zoho does not sell personal information, and that account data leaves the active database at a clean-up run every six months after termination and backups three months later. It also says anonymised crops of service data are used to improve algorithms and that staff may manually verify emails reported as spam, while the Zoho Mail privacy page says Zoho will never read a customer's emails. The DPA is sent on request by email (21 of 30). No API deprecation policy or dated notices were found (0 of 20). A sub-processor page exists, but its list loads by script and was not read. The data centre page names 20 sites and the certifications of each (15 of 20). The provenance half is computed from the provenance block." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded on the REST API. List and search return a summary per message and the body is a separate call, with `limit` from 1 to 200 and a default of 10. There is no field selection. In MCP the owner chooses which tools a server carries, and the tool count is not published (17 of 25). `start` and `limit`, filters for folder, read status, flag, label, thread and attachments, three sort keys and a search syntax (18 of 20). Errors carry a status code, a description and a `moreInfo` message. Seven codes are documented, with no list of messages or recovery steps (10 of 20). No idempotency key or conditional write was found, so a retried send can go out twice. Delete moves to Trash unless `expunge=true`. MCP annotations were not read (5 of 20). Send needs only `fromAddress` and `toAddress`, and defaults are stated. No REST SDK in any language, tokens last an hour, hosts differ by data centre, and reading a body needs an account ID, a folder ID and a message ID (6 of 15).", "maintenance": "Zoho keeps no API changelog, so recency rests on what could be dated. Zoho Mail MCP is listed under May 2026 in What's New, between 131 and 161 days before this check. Product changes are listed for August 2026, none of them to the API (10 of 30, where a reading on product changes would give 20). What's New has more than three entries in the last 90 days, dated by month and none about the API or MCP, so half credit (10 of 20). The pricing page states support by email, chat and phone around the clock, and the changelog is public. We did not test the community forum for replies (9 of 15 for a closed service). No REST SDK. A Java command line tool and the MCP server are official. The MCP registry was not checked (4 of 15). No public repository, package or CI was found (0 of 10).", "payments": "No x402, MPP or L402 (0 of 40). Plan prices are public without a login, $1 to $6 a user a month billed yearly, with API access included and no per-call price (10 of 20). Mail Free covers five users with no card, in some regions only, and the highest paid edition has a 15-day trial with no card (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0 of 20).", "reliability": "Graded on the REST API, read with the hosted lines. status.zoho.com redirects to us.zohostatus.com, which has components for Zoho Mail, mail listing, IMAP, POP, SMTP and the MX host, with incident history (20). In the 90 days to 9 October 2026 the history has seven notices naming a mail component (IMAP, the MX host and one mail listing), each under 12 minutes, the longest the MX host for 11 minutes 40 seconds on 3 October. Two notices covering several products, on 12 July and 10 August, lasted under 10 minutes, and the status feed shows mail components changing state when they ended. We read that as minor incidents only (20 of 30). Only the US page was read. The getting started guide says each API has its own rate limit and gives no numbers. Sending limits are published, 50 to 500 external emails an hour and 1,000 internal (7 of 15). The response code list has no 429, and no Retry-After, backoff guidance or idempotency key was found. The guide says only that the response will say when a limit is exceeded (2 of 15). The pricing page lists a 99.9% uptime guarantee for paid plans, with no SLA document, measurement or credit terms found (4 of 10). The API carries no beta or preview label (10).", "schema": "Graded on the REST API. No OpenAPI or similar file was found in the docs or under the zoho organisation on GitHub. The MCP tool definitions sit in a signed-in console and were not read (0 of 25). `https://www.zoho.com/mail/help/llms.txt` indexes a Markdown twin of every reference page (10). Each page states the purpose and names the call that supplies each ID, with little on when not to use a call (13 of 20). Parameters are listed with a type, a mandatory mark, allowed values and defaults, in prose only. Many PUT calls share one URL and differ by a `mode` field, and sample responses carry numbers and booleans as strings (9 of 15). Every page has a curl sample and a sample response. Errors are one shared list of seven status codes, with nothing per endpoint (9 of 15). The path has no version. What's New is a product changelog dated by month, and no API changelog was found (4 of 15).", "security": "OAuth 2.0 with scopes down to one resource and one operation, one-hour access tokens, revocable refresh tokens, PKCE for mobile and browser clients and a device flow (30). Less 10 because the documented token, refresh and revoke calls carry the client secret and refresh token in the URL query string (20 of 30). READ, CREATE, UPDATE and DELETE are separate scopes per resource, delete goes to Trash by default, and an MCP server holds only the tools its owner adds. Nothing confirms a send, and the MCP URL holds an API key that the FAQ says works like a password (14 of 20). Mail is untrusted content. No prompt-injection guidance was found in the API guide or the MCP pages read (2 of 15). The Logs API returns login history, admin audit records and SMTP logs, and the admin console has audit logs with SIEM export. No per-call API log was found (11 of 15). security.txt valid to 30 June 2028, a bug bounty, and ISO/IEC 27001 and SOC 2 Type II per the Zoho Mail compliance page (20).", "transparency": "The editorial half. A closed service under the Zoho Terms of Service, last updated 2 March 2022, and a Zoho Mail usage policy updated 2 September 2026. No source repository (15 of 30). The privacy policy of 22 December 2025 says Zoho does not sell personal information, and that account data leaves the active database at a clean-up run every six months after termination and backups three months later. It also says anonymised crops of service data are used to improve algorithms and that staff may manually verify emails reported as spam, while the Zoho Mail privacy page says Zoho will never read a customer's emails. The DPA is sent on request by email (21 of 30). No API deprecation policy or dated notices were found (0 of 20). A sub-processor page exists, but its list loads by script and was not read. The data centre page names 20 sites and the certifications of each (15 of 20). The provenance half is computed from the provenance block." }, "sources": [ { "what": "API index", "url": "https://www.zoho.com/mail/help/api/", "seen": "2026-10-09" }, { "what": "API overview", "url": "https://www.zoho.com/mail/help/api/overview.html", "seen": "2026-10-09" }, { "what": "getting started, data centres, errors and rate limiting", "url": "https://www.zoho.com/mail/help/api/getting-started-with-api.html", "seen": "2026-10-09" }, { "what": "OAuth 2.0 guide", "url": "https://www.zoho.com/mail/help/api/using-oauth-2.html", "seen": "2026-10-09" }, { "what": "response codes", "url": "https://www.zoho.com/mail/help/api/response-codes.html", "seen": "2026-10-09" }, { "what": "send an email", "url": "https://www.zoho.com/mail/help/api/post-send-an-email.html", "seen": "2026-10-09" }, { "what": "list emails", "url": "https://www.zoho.com/mail/help/api/get-emails-list.html", "seen": "2026-10-09" }, { "what": "search emails", "url": "https://www.zoho.com/mail/help/api/get-search-emails.html", "seen": "2026-10-09" }, { "what": "get email content", "url": "https://www.zoho.com/mail/help/api/get-email-content.html", "seen": "2026-10-09" }, { "what": "delete an email", "url": "https://www.zoho.com/mail/help/api/delete-email.html", "seen": "2026-10-09" }, { "what": "Logs API", "url": "https://www.zoho.com/mail/help/api/logs-api.html", "seen": "2026-10-09" }, { "what": "help centre llms.txt", "url": "https://www.zoho.com/mail/help/llms.txt", "seen": "2026-10-09" }, { "what": "product llms.txt", "url": "https://www.zoho.com/mail/llms.txt", "seen": "2026-10-09" }, { "what": "Zoho Mail MCP", "url": "https://www.zoho.com/mail/help/mcp/getting-started.html", "seen": "2026-10-09" }, { "what": "MCP server configuration", "url": "https://www.zoho.com/mail/help/mcp/mcp-server-configuration.html", "seen": "2026-10-09" }, { "what": "MCP client configuration", "url": "https://www.zoho.com/mail/help/mcp/configure-mcp.html", "seen": "2026-10-09" }, { "what": "Zoho MCP product page", "url": "https://www.zoho.com/mcp/", "seen": "2026-10-09" }, { "what": "webhooks", "url": "https://www.zoho.com/mail/help/dev-platform/webhook.html", "seen": "2026-10-09" }, { "what": "command line tool", "url": "https://www.zoho.com/mail/help/cli/getting-started-with-cli.html", "seen": "2026-10-09" }, { "what": "rates, limits and policies", "url": "https://www.zoho.com/mail/help/adminconsole/rates-and-limits.html", "seen": "2026-10-09" }, { "what": "usage policy", "url": "https://www.zoho.com/mail/help/usage-policy.html", "seen": "2026-10-09" }, { "what": "What's New", "url": "https://www.zoho.com/mail/whats-new.html", "seen": "2026-10-09" }, { "what": "pricing", "url": "https://www.zoho.com/mail/zohomail-pricing.html", "seen": "2026-10-09" }, { "what": "status page", "url": "https://us.zohostatus.com/", "seen": "2026-10-09" }, { "what": "status incident history", "url": "https://us.zohostatus.com/incident_history", "seen": "2026-10-09" }, { "what": "status RSS", "url": "https://us.zohostatus.com/rss", "seen": "2026-10-09" }, { "what": "terms of service", "url": "https://www.zoho.com/terms.html", "seen": "2026-10-09" }, { "what": "contracting entities", "url": "https://www.zoho.com/legal/zoho-contracting-entities.html", "seen": "2026-10-09" }, { "what": "privacy policy", "url": "https://www.zoho.com/privacy.html", "seen": "2026-10-09" }, { "what": "Zoho Mail data privacy page", "url": "https://www.zoho.com/mail/data-privacy.html", "seen": "2026-10-09" }, { "what": "Zoho Mail certificates and compliance", "url": "https://www.zoho.com/mail/security/certificates-and-compliance.html", "seen": "2026-10-09" }, { "what": "sub-processors", "url": "https://www.zoho.com/privacy/sub-processors.html", "seen": "2026-10-09" }, { "what": "GDPR and DPA", "url": "https://www.zoho.com/gdpr.html", "seen": "2026-10-09" }, { "what": "data centres", "url": "https://www.zoho.com/know-your-datacenter.html", "seen": "2026-10-09" }, { "what": "security.txt", "url": "https://www.zoho.com/.well-known/security.txt", "seen": "2026-10-09" }, { "what": "robots.txt", "url": "https://www.zoho.com/robots.txt", "seen": "2026-10-09" }, { "what": "GitHub search of the zoho organisation for mail repositories", "url": "https://api.github.com/search/repositories?q=org:zoho+mail", "seen": "2026-10-09" }, { "what": "RDAP for zoho.com", "url": "https://rdap.verisign.com/com/v1/domain/zoho.com", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: the number and definitions of Zoho Mail MCP tools, which sit in the signed-in Zoho MCP console", "unchecked: the sub-processor list at zoho.com/privacy/sub-processors.html, which loads by script", "unchecked: status pages for data centres other than the US", "unchecked: the official MCP registry for a Zoho entry", "unchecked: whether the token endpoint accepts parameters in the request body, which the OAuth guide does not show", "No request rate limit numbers, 429 documentation, SLA document, API changelog, API deprecation policy, OpenAPI file or REST SDK was found", "The day Zoho Mail MCP launched is not stated. What's New lists it under May 2026, and a Zoho blog post on an email MCP server is dated 25 March 2026", "Which REST calls the Mail Free plan allows is not stated. The overview says plan and mail policy decide API availability", "The usage policy bars automated emails without saying whether a message an agent sends for its owner through the API counts", "The lead was right on the vendor, URL, docs link and interface. It did not mention Zoho Mail MCP, the command line tool or the usage policy's bar on automated email" ] }, "negative": 0, "verdict": "A REST API over a Zoho Mail mailbox with OAuth scopes that narrow to one resource and one operation, plus an MCP server launched in 2026. Zoho publishes no OpenAPI file, SDK, request rate limit or API changelog, and its usage policy bars automated email.", "bestFor": "An agent working inside its owner's Zoho Mail mailbox or administering a Zoho Mail organisation, where narrow scopes and the MCP server keep access small.", "strengths": [ "OAuth scopes name one resource and one operation, such as `ZohoMail.messages.READ`, so an agent can hold read access without send or delete.", "Every reference page has a Markdown twin, indexed in `https://www.zoho.com/mail/help/llms.txt`, with a curl sample and a sample response.", "Zoho Mail MCP exposes the API methods as tools on a remote server, and the owner picks which tools a server carries.", "The Mail Free plan covers five users on one domain with no card, and the MCP FAQ says free and paid plans both work.", "Delete moves a message to Trash unless `expunge=true` is sent, and audit records, login history and SMTP logs are readable through the Logs API." ], "weaknesses": [ "The Zoho Mail usage policy, updated 2 September 2026, lists automated, bulk and transactional emails among uses that are not allowed.", "No OpenAPI file, official REST SDK or dated API changelog was found. The path carries no version.", "The getting started guide says each API has its own rate limit and gives no numbers. The response code list has no 429.", "External sending is capped at 50 to 500 emails an hour by sender reputation, with a block of up to one hour once the cap is reached.", "The OAuth guide's token, refresh and revoke examples carry the client secret and refresh token in the URL query string." ], "agentNotes": [ "Send `Authorization: Zoho-oauthtoken \u003ctoken\u003e`, not `Bearer`. The token response says `Bearer`, but the OAuth guide says the Mail API requires the Zoho prefix.", "Use the host for the account's data centre, such as `mail.zoho.eu` or `mail.zoho.in`. Call `GET /api/accounts` first for the `accountId` every mailbox call needs.", "Reading a message body needs both `folderId` and `messageId`. List and search calls return a summary only, 10 messages by default and 200 at most.", "Request `ZohoMail.messages.READ` alone for a reading agent. Add `CREATE` only when it must send, and leave `DELETE` out unless required.", "Refresh the access token every hour, and post OAuth parameters in the request body where the server accepts it, to keep secrets out of URLs." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 53.8 } ], "editorialScores": { "ergonomics": 56, "maintenance": 33, "payments": 30, "reliability": 63, "schema": 45, "security": 67, "transparency": 51 }, "provenanceScore": 95 }, "connect": { "http": "curl \"https://mail.zoho.com/api/accounts\" \\\n -X GET \\\n -H \"Accept: application/json\" \\\n -H \"Authorization: Zoho-oauthtoken $ZOHO_ACCESS_TOKEN\"" }, "letme": { "capability": "https://letme.dev/mailbox.read", "tool": "https://letme.dev/zoho-mail" }, "sameCompany": [ "zoho-books", "zoho-zeptomail", "zoho-crm", "zoho-desk", "zoho-recruit", "zoho-people" ], "notable": [ "The API index lists 16 groups, from Organisation, Domain, Groups, Users and Mail Policy to Accounts, Folders, Labels, Email Messages, Signatures, Threads, Tasks, Bookmarks, Notes, Logs and Anti-spam (https://www.zoho.com/mail/help/api/)", "The Zoho Mail usage policy, last updated 2 September 2026, says Zoho Mail cannot be used for promotional, bulk, marketing, newsletter, automated or transactional emails, and points to ZeptoMail for transactional mail (https://www.zoho.com/mail/help/usage-policy.html)", "Zoho Mail MCP is listed under May 2026 in the product's What's New page. Tools are added to a server in the Zoho MCP console, which issues a server URL holding an API key (https://www.zoho.com/mail/help/mcp/getting-started.html)", "The MCP FAQ says the MCP URL must be treated like a password because anyone holding it can reach the mailbox, and that data sent to AI agents is not encrypted by the MCP layer (https://www.zoho.com/mail/help/mcp/getting-started.html)", "The getting started guide says each API has its own rate limit and that the response says when it is exceeded. It gives no numbers (https://www.zoho.com/mail/help/api/getting-started-with-api.html)", "External sending is limited to 50 to 500 emails an hour depending on sender reputation, internal sending to 1,000 an hour, and a message to 150 external recipients on paid accounts (https://www.zoho.com/mail/help/adminconsole/rates-and-limits.html)", "The privacy policy, last updated 22 December 2025, says Zoho uses anonymised crops of service data to improve its algorithms and that staff may manually verify emails reported as spam (https://www.zoho.com/privacy.html)", "A ZMail command line tool is distributed as a Java JAR that needs Java 17 or later (https://www.zoho.com/mail/help/cli/getting-started-with-cli.html)", "Zoho's API overview points developers building their own email application to Mail360, a separate Zoho product (https://www.zoho.com/mail/help/api/overview.html)" ], "area": "communication", "details": [ { "label": "Surface graded", "value": "The REST API at `https://mail.zoho.com/api` (US). Zoho Mail MCP is described and counted where a checklist line covers it. IMAP, POP and SMTP also exist on paid plans" }, { "label": "Mailbox calls", "value": "Send, send with attachment, upload attachment, save draft or template, reply, list a folder, search, read headers, content, original message, metadata and attachments, mark read or unread, move, flag, label, archive, mark spam and delete. Thread calls flag, move, label and mark a whole conversation" }, { "label": "Administration calls", "value": "Organisation, domains (MX, SPF and DKIM checks, aliases, catch-all), groups and moderation, users, mail policies, storage, allowed IP ranges, anti-spam lists and logs. These need an administrator's token" }, { "label": "Credentials", "value": "OAuth 2.0. Authorisation code for server apps, authorisation code with PKCE for mobile apps, implicit or PKCE for browser apps, device authorisation for tools without a browser, and a self client for one's own account. Access tokens last one hour (https://www.zoho.com/mail/help/api/using-oauth-2.html)" }, { "label": "Auth scopes", "value": "`ZohoMail.\u003cresource\u003e.\u003coperation\u003e` with operations ALL, READ, CREATE, UPDATE and DELETE. Resources include `accounts`, `folders`, `tags`, `messages`, `tasks`, and `organization.accounts`, `organization.domains`, `organization.groups`, `organization.policy`, `organization.audit` and `partner.organization`" }, { "label": "Rate limits", "value": "No request rate published. Sending is 50 to 500 external emails an hour by reputation, 1,000 internal, 150 recipients a message on paid accounts and 100 on free. Incoming mail is capped at 100 messages a minute. Folder creation is limited to 40 an hour" }, { "label": "Pagination", "value": "`start` and `limit` on list and search, with `limit` from 1 to 200 and a default of 10. List filters by folder, read status, flag, label, thread and attachment, and sorts by date, message ID or size" }, { "label": "Search", "value": "`GET /api/accounts/{accountId}/messages/search` with a `searchKey` written in Zoho Mail's search syntax and an optional `receivedTime` cut-off. By default it returns mail received more than two minutes ago" }, { "label": "Errors", "value": "A `status` object with a code and description and a `data.moreInfo` message. The reference lists 200, 201, 400, 401, 403, 404 and 500" }, { "label": "Events", "value": "Outgoing webhooks post incoming emails, tasks or Streams posts that match a filter to a URL. They are set up in Settings, Integrations, Developer Space, not through the API (https://www.zoho.com/mail/help/dev-platform/webhook.html)" }, { "label": "MCP server", "value": "Zoho Mail tools are added to a server in the Zoho MCP console, by hand or from a pre-configured template. Authorisation is OAuth 2.1 per user, or one shared connection approved by the Super Admin. Works with ChatGPT, Gemini, Claude, Cursor, Windsurf, VS Code and Cline per the docs. Tool count not published" }, { "label": "Data centres", "value": "US, Europe, India, Australia, Japan, Canada, China, UAE and Saudi Arabia, each with its own API host such as `mail.zoho.eu`, `mail.zoho.in` and `mail.zohocloud.ca`" }, { "label": "SDKs", "value": "No REST SDK found. A Java command line tool (ZMail CLI) and a widget SDK for extensions inside the Zoho Mail web client exist" }, { "label": "Free tier", "value": "Mail Free, up to five users, one domain, 5 GB a user, no card, no IMAP, POP or ActiveSync, in some regions only. 15-day trial of the highest paid edition with no card" }, { "label": "Audit", "value": "Logs API for login history, admin audit records and SMTP logs. Admin console audit logs can be sent to a SIEM tool" }, { "label": "Certifications", "value": "ISO/IEC 27001, SOC 2 Type II, ISO 22301 and ISO 9001 per the Zoho Mail compliance page. Bug bounty at bugbounty.zohocorp.com" }, { "label": "Status", "value": "status.zoho.com redirects to us.zohostatus.com, with components for Zoho Mail, mail listing, IMAP, POP, SMTP, the MX host and Zoho MCP" } ], "unitPrices": [ { "item": "Mail Lite, 5 GB", "unit": "seat-month", "usd": 1, "note": "billed yearly, no monthly plan. $1.25 for 10 GB" }, { "item": "Workplace Standard", "unit": "seat-month", "usd": 3, "note": "billed yearly. $4 billed monthly. 30 GB mailbox plus the office suite" }, { "item": "Mail Premium", "unit": "seat-month", "usd": 4, "note": "billed yearly, no monthly plan. 50 GB mailbox with retention and eDiscovery" }, { "item": "Workplace Professional", "unit": "seat-month", "usd": 6, "note": "billed yearly. 100 GB mailbox" } ], "provenance": { "legalEntity": "Zoho Corporation Private Limited", "domain": "zoho.com", "domainRegistered": "2004-01-16", "endpointOnVendorDomain": true, "terms": "https://www.zoho.com/terms.html", "privacy": "https://www.zoho.com/privacy.html", "statusPage": "https://status.zoho.com", "changelog": "https://www.zoho.com/mail/whats-new.html", "securityTxt": "valid", "checked": "2026-10-09", "notes": [ "The Terms of Service (last updated 2 March 2022) are the service agreement for Zoho's online services. The contracting entity depends on the customer's region, Zoho Corporation Private Limited for India and Zoho Corporation for the United States (https://www.zoho.com/legal/zoho-contracting-entities.html).", "The Zoho Mail usage policy at https://www.zoho.com/mail/help/usage-policy.html, last updated 2 September 2026, adds rules for the mail service and bars automated and bulk email.", "The privacy policy was last updated on 22 December 2025. Part II covers data Zoho processes on a customer's behalf.", "security.txt at www.zoho.com gives a bug bounty contact, security@zohocorp.com, a policy link and an expiry of 30 June 2028.", "What's New is a product changelog dated by month, with the latest entries under August 2026. No API changelog was found.", "The US API answers on mail.zoho.com. Other data centres use mail.zoho.eu, mail.zoho.in, mail.zoho.com.au, mail.zoho.jp, mail.zohocloud.ca, mail.zoho.com.cn, mail.zoho.ae and mail.zoho.sa. OAuth runs on accounts.zoho.com.", "RDAP for zoho.com gives a registration date of 2004-01-16 and expiry on 2031-01-16." ], "score": 95, "checks": [ { "check": "Legal entity named", "value": "Zoho Corporation Private Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "zoho.com, registered 2004-01-16 (22 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "zoho.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 1 clause that costs points", "points": 7.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.zoho.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.zoho.com/terms.html", "state": "read", "readAt": "2026-10-08", "statedDate": "2022-03-02", "words": 4052, "points": 7.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated on: 2nd March 2022.", "says": "Last updated 2022-03-02" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "Accordingly, each party agrees to the governing law (without regard to choice or conflicts of law rules) and to the exclusive jurisdiction of the courts mentioned herein in case of any dispute or lawsuit arising out of or in connection with this Agreement ." }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "IN NO EVENT SHALL ZOHO’S ENTIRE LIABILITY TO YOU IN RESPECT OF ANY SERVICE, WHETHER DIRECT OR INDIRECT, EXCEED ONE THOUSAND DOLLARS ($1000) OR THE FEES PAID BY YOU DURING THE TWELVE (12) MONTHS PRIOR TO THE FIRST EVENT GIVING RISE TO SUCH LIABILITY, WHICHEVER IS HIGHER.", "says": "Capped at the fees paid in the 12 months before the claim or $1000" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If you provide any information that is untrue, inaccurate, outdated, or incomplete, or if Zoho has reasonable grounds to suspect that such information is untrue, inaccurate, outdated, or incomplete, Zoho may terminate your user account and refuse current or future use of any or all of the Services." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "If we make significant changes to the Agreement that affect your rights, you will be provided with at least 30 days advance notice of the changes by email to your primary email address.", "says": "Gives 30 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "In addition to all other terms and conditions of this Agreement, you shall not: (i) transfer the Services or otherwise make it available to any third party;" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "use the Services for any form of competitive or benchmarking purposes", "costsPoints": true }, { "key": "old", "label": "Has not been updated for three years or more", "found": true, "quote": "Last updated on: 2nd March 2022." } ], "notes": [ { "date": "2026-10-08", "text": "Subscriptions renew automatically and the customer must give at least seven days' notice before the renewal date to stop renewal.", "quote": "If you do not wish to renew the subscription, you must inform us at least seven days prior to the renewal date." }, { "date": "2026-10-08", "text": "Unpaid accounts inactive for 120 continuous days may be terminated and their data deleted, with prior notice, and activity in one service does not keep another active.", "quote": "We reserve the right to terminate unpaid user accounts that are inactive for a continuous period of 120 days." }, { "date": "2026-10-08", "text": "If the customer does not answer a forwarded complaint within 10 days, Zoho may give the customer's name and contact information to the complainant.", "quote": "If you do not respond to the complainant within 10 days from the date of our email to you, we may disclose your name and contact information to the complainant for enabling the complainant to take legal action against you." } ] }, { "kind": "privacy", "url": "https://www.zoho.com/privacy.html", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-12-22", "words": 6377, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated on: 22nd Dec 2025.", "says": "Last updated 2025-12-22" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This policy tells you what information we collect from you, what we do with it, who can access it, and what you can do about it." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "After you terminate your account, your data will be automatically deleted from our active database within 6 months and from our backups within 3 months after that.", "says": "Names a period of 6 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "If you ask about our products through one of our referral programs or reselling partners, or sign in to one of our products through an authentication service provider like LinkedIn or Google, they'll pass on your contact information to us." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We share your information only in the ways that are described in this Privacy Policy, and only with parties who adopt appropriate confidentiality and security measures." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "The European Economic Area (EEA) provides certain rights to data subjects (including access, rectification, erasure, restriction of processing, data portability, and the right to object and to complain)." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you wish to update or delete your testimonial, you can contact us at privacy@zohocorp.com", "says": "privacy@zohocorp.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…or otherwise providing personal information or service data to us, you understand that the processing, transfer, and storage of your personal information or Service Data within the United States of America, the European Economic Area (EEA) and other countries where Zoho operates.", "says": "Data goes to the United States" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "In keeping with Zoho's promise not to exploit your data in a way that is not respectful of your privacy and confidentiality expectations, we make only the following limited use of service data for these technologies: (i) using anonymized crops of service data to improve accuracy of the algorithms;", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "Zoho employees and contractors may open service data to resolve errors and to check by hand emails reported as spam and scanned images.", "quote": "so that they can (i) identify, analyze and resolve errors, (ii) manually verify emails reported as spam to improve spam detection, or (iii) manually verify scanned images that you submit to us to verify the accuracy of optical character recognition." }, { "date": "2026-10-08", "text": "Zoho says it uses an organisation's data to develop models specific to that organisation.", "quote": "(ii) using your organization's data for developing models specific for your organization." }, { "date": "2026-10-08", "text": "After an account is terminated, data leaves the active database at a clean-up run once every six months and leaves backups three months later.", "quote": "Once you terminate your Zoho user account, your data will eventually get deleted from active database during the next clean-up that occurs once in 6 months." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/zoho-mail.json" } }