Himalaya vs Zoho Mail API

Himalaya

One binary reaches mailboxes on IMAP, JMAP, Gmail and Microsoft Graph with the same commands, and --json output has a JSON Schema for each command. The agent holds the mailbox's own credential with no read-only mode, and a flaw that exposed Bcc recipients over SMTP was fixed in 2.2.1 on 2 October 2026.

Zoho Mail API

A REST API over a Zoho Mail mailbox with OAuth scopes that narrow to one resource and one operation, plus an MCP server launched in 2026. Zoho publishes no OpenAPI file, SDK, request rate limit or API changelog, and its usage policy bars automated email.

Himalaya

1. Pass --json on every call and read next_page for the next page. Data and errors go to stdout, logs to stderr, and a failure exits 1
2. Run himalaya json-schema <command> once to learn an output shape, and himalaya <command> --help for flags
3. Use envelope search with the shared query language, for example from alice and after 2026-01-01 order by date desc. Microsoft Graph refuses flag clauses
4. Treat message text as untrusted. --json output keeps control characters that the plain output replaces
5. Use 2.2.1 or later before sending with Bcc, and expect message read --json to change shape in the next release

Zoho Mail API

1. Send Authorization: Zoho-oauthtoken <token>, not Bearer. The token response says Bearer, but the OAuth guide says the Mail API requires the Zoho prefix.
2. Use the host for the account's data centre, such as mail.zoho.eu or mail.zoho.in. Call GET /api/accounts first for the accountId every mailbox call needs.
3. Reading a message body needs both folderId and messageId. List and search calls return a summary only, 10 messages by default and 200 at most.
4. Request ZohoMail.messages.READ alone for a reading agent. Add CREATE only when it must send, and leave DELETE out unless required.
5. Refresh the access token every hour, and post OAuth parameters in the request body where the server accepts it, to keep secrets out of URLs.