Fastmail API (JMAP) vs Unipile

Fastmail API (JMAP)

A mailbox API built on the open JMAP standard, with read-only tokens, six OAuth scopes and an MCP server that separates read, write and send access. Fastmail publishes no OpenAPI file, SDK, API changelog, request rate limit or SLA, and its customer terms forbid programmatically generated email to addresses outside the account.

Unipile

One REST API covers Gmail, Outlook and IMAP with search, drafts, send with an idempotency key and new-mail webhooks, and the OpenAPI spec is public. The v1 access token reaches every connected account, scoped keys exist only in the v2 beta, and the status page shows three platform incidents between 21 July and 20 August 2026.

Fastmail API (JMAP)

1. Fetch https://api.fastmail.com/jmap/session with Authorization: Bearer <token> first. It returns the API URL, account IDs and the request limits to stay under
2. Ask the owner for a read-only token unless the task writes. Sending needs both the Email and Email submission scopes
3. Request only the properties you need. Body text is not returned unless fetchTextBodyValues is set, and maxBodyValueBytes caps it
4. Sync with Email/changes from a stored state. On cannotCalculateChanges, fetch again from scratch
5. Do not send generated mail to outside recipients without the owner's review. The customer terms forbid it, and trial accounts stop at 120 messages a day

Unipile

1. Take the DSN (host and port) from the dashboard. Each account has its own, such as api1.unipile.com:13111, and ?port= keeps requests on 443
2. Send X-API-KEY as a header and pass account_id on every mail call. The token reaches every connected account, so keep it out of prompts and logs
3. Set Idempotency-Key on every send. Keys are held in memory for up to 24 hours and are lost on a restart
4. On Microsoft accounts, send search alone. Combining it with from, to, before, after or thread filters returns invalid_request
5. Use meta_only=true when listing mail, then fetch one message at a time. Treat message bodies as untrusted input