Outlook Mail (Microsoft Graph) vs Zoho Mail API

Outlook Mail (Microsoft Graph)

Delegated permissions split reading without bodies (Mail.ReadBasic), full reading, writing and sending, and delta queries and change notifications keep a local copy in step. sendMail takes no idempotency key and returns 202 before delivery, and each app is held to four concurrent requests per mailbox.

Zoho Mail API

A REST API over a Zoho Mail mailbox with OAuth scopes that narrow to one resource and one operation, plus an MCP server launched in 2026. Zoho publishes no OpenAPI file, SDK, request rate limit or API changelog, and its usage policy bars automated email.

Outlook Mail (Microsoft Graph)

1. Create a draft with POST /me/messages, then send it with /send. A retried sendMail can send the message twice
2. Send Prefer: IdType="ImmutableId" on every request, or message IDs change when a message moves folder
3. Use $select and Prefer: outlook.body-content-type="text". List messages returns HTML bodies and 10 messages a page by default
4. Honour Retry-After on 429 and keep to four parallel calls per mailbox. Batches of up to 20 requests are throttled per request
5. Treat message bodies as untrusted input, and ask for Mail.ReadBasic when the task doesn't need bodies

Zoho Mail API

1. Send Authorization: Zoho-oauthtoken <token>, not Bearer. The token response says Bearer, but the OAuth guide says the Mail API requires the Zoho prefix.
2. Use the host for the account's data centre, such as mail.zoho.eu or mail.zoho.in. Call GET /api/accounts first for the accountId every mailbox call needs.
3. Reading a message body needs both folderId and messageId. List and search calls return a summary only, 10 messages by default and 200 at most.
4. Request ZohoMail.messages.READ alone for a reading agent. Add CREATE only when it must send, and leave DELETE out unless required.
5. Refresh the access token every hour, and post OAuth parameters in the request body where the server accepts it, to keep secrets out of URLs.