# Zoho Mail API > Zoho Mail is Zoho's hosted business email service. Its REST API lets an application read, search, send and organise mail in a Zoho Mail account and administer an organisation's users, domains, groups and policies, with OAuth 2.0 access. - Canonical: https://www.anchorterminal.com/tools/zoho-mail - Markdown: https://www.anchorterminal.com/tools/zoho-mail.md (~8,750 tokens) - Slim: https://www.anchorterminal.com/tools/zoho-mail.min.md (~2,130 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/zoho-mail.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-09 ## Overview **Grade D · 53.8/100 · rank #626 of 842 · #7 in Mailbox access · not agent-ready · confidence medium** More from Zoho, listed separately because each is its own product: [Zoho Books](https://www.anchorterminal.com/tools/zoho-books.md) (Accounting & invoicing), [Zoho CPaaS (formerly ZeptoMail)](https://www.anchorterminal.com/tools/zoho-zeptomail.md) (Email delivery APIs), [Zoho CRM](https://www.anchorterminal.com/tools/zoho-crm.md) (CRM & customer platforms), [Zoho Desk](https://www.anchorterminal.com/tools/zoho-desk.md) (Customer support & helpdesk), [Zoho Recruit](https://www.anchorterminal.com/tools/zoho-recruit.md) (Recruiting & applicant tracking), [Zoho People](https://www.anchorterminal.com/tools/zoho-people.md) (HR & employee operations). ## Assessment A REST API over a Zoho Mail mailbox with OAuth scopes that narrow to one resource and one operation, plus an MCP server launched in 2026. Zoho publishes no OpenAPI file, SDK, request rate limit or API changelog, and its usage policy bars automated email. ## Facts | Field | Value | | --- | --- | | Vendor | Zoho (https://www.zoho.com/mail/) | | Kind | HTTP API | | Category | Mailbox access (https://www.anchorterminal.com/categories/mailbox-access) | | Transport | HTTP | | Auth | OAuth · OAuth 2.0 only. A person registers a client in the Zoho API console (server-based, client-based, mobile, non-browser with device authorisation, or a self client for one's own account) and approves scopes of the form `ZohoMail..`. Registration is self-serve, with no app review or sales approval found. The access token lasts one hour and goes in `Authorization: Zoho-oauthtoken `. The refresh token lasts until revoked. Organisation calls need an administrator's account. Each data centre has its own accounts host and API host. | | Pricing | Freemium ($1 / seat-mo) · API access comes with a mailbox plan and has no per-call charge. Mail Free covers up to five users on one domain with no card and is available in some regions only. Paid plans cost $1 to $6 a user a month billed yearly, with a 15-day trial of the highest edition and no card. The API guide says plan and mail policy decide which APIs an account can call (https://www.zoho.com/mail/zohomail-pricing.html, checked 2026-10-09). | | x402 | No · No x402, MPP or L402 in the API guide, the OAuth guide or the pricing page (checked 2026-10-09). | | Licence | Proprietary service under the Zoho Terms of Service and the Zoho Mail usage policy. No source repository was found | | Docs | https://www.zoho.com/mail/help/api/ | | llms.txt | https://www.zoho.com/mail/help/llms.txt | | Surface graded | The REST API at `https://mail.zoho.com/api` (US). Zoho Mail MCP is described and counted where a checklist line covers it. IMAP, POP and SMTP also exist on paid plans | | Mailbox calls | Send, send with attachment, upload attachment, save draft or template, reply, list a folder, search, read headers, content, original message, metadata and attachments, mark read or unread, move, flag, label, archive, mark spam and delete. Thread calls flag, move, label and mark a whole conversation | | Administration calls | Organisation, domains (MX, SPF and DKIM checks, aliases, catch-all), groups and moderation, users, mail policies, storage, allowed IP ranges, anti-spam lists and logs. These need an administrator's token | | Credentials | OAuth 2.0. Authorisation code for server apps, authorisation code with PKCE for mobile apps, implicit or PKCE for browser apps, device authorisation for tools without a browser, and a self client for one's own account. Access tokens last one hour (https://www.zoho.com/mail/help/api/using-oauth-2.html) | | Auth scopes | `ZohoMail..` with operations ALL, READ, CREATE, UPDATE and DELETE. Resources include `accounts`, `folders`, `tags`, `messages`, `tasks`, and `organization.accounts`, `organization.domains`, `organization.groups`, `organization.policy`, `organization.audit` and `partner.organization` | | Rate limits | No request rate published. Sending is 50 to 500 external emails an hour by reputation, 1,000 internal, 150 recipients a message on paid accounts and 100 on free. Incoming mail is capped at 100 messages a minute. Folder creation is limited to 40 an hour | | Pagination | `start` and `limit` on list and search, with `limit` from 1 to 200 and a default of 10. List filters by folder, read status, flag, label, thread and attachment, and sorts by date, message ID or size | | Search | `GET /api/accounts/{accountId}/messages/search` with a `searchKey` written in Zoho Mail's search syntax and an optional `receivedTime` cut-off. By default it returns mail received more than two minutes ago | | Errors | A `status` object with a code and description and a `data.moreInfo` message. The reference lists 200, 201, 400, 401, 403, 404 and 500 | | Events | Outgoing webhooks post incoming emails, tasks or Streams posts that match a filter to a URL. They are set up in Settings, Integrations, Developer Space, not through the API (https://www.zoho.com/mail/help/dev-platform/webhook.html) | | MCP server | Zoho Mail tools are added to a server in the Zoho MCP console, by hand or from a pre-configured template. Authorisation is OAuth 2.1 per user, or one shared connection approved by the Super Admin. Works with ChatGPT, Gemini, Claude, Cursor, Windsurf, VS Code and Cline per the docs. Tool count not published | | Data centres | US, Europe, India, Australia, Japan, Canada, China, UAE and Saudi Arabia, each with its own API host such as `mail.zoho.eu`, `mail.zoho.in` and `mail.zohocloud.ca` | | SDKs | No REST SDK found. A Java command line tool (ZMail CLI) and a widget SDK for extensions inside the Zoho Mail web client exist | | Free tier | Mail Free, up to five users, one domain, 5 GB a user, no card, no IMAP, POP or ActiveSync, in some regions only. 15-day trial of the highest paid edition with no card | | Audit | Logs API for login history, admin audit records and SMTP logs. Admin console audit logs can be sent to a SIEM tool | | Certifications | ISO/IEC 27001, SOC 2 Type II, ISO 22301 and ISO 9001 per the Zoho Mail compliance page. Bug bounty at bugbounty.zohocorp.com | | Status | status.zoho.com redirects to us.zohostatus.com, with components for Zoho Mail, mail listing, IMAP, POP, SMTP, the MX host and Zoho MCP | | Capabilities | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | | Tags | hosted, closed-source, oauth, mcp, webhooks, free-tier, no-card, llms-txt, email, status-page, bug-bounty, soc2, eu-data-residency | | JSON | https://www.anchorterminal.com/api/v1/tools/zoho-mail.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-09 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 63 | 12.6 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 45 | 7.3 | | Agent ergonomics | 13% | 16.2 | 56 | 9.1 | | Security & auth | 14% | 17.5 | 67 | 11.7 | | Payments & pricing | 10% | 12.5 | 30 | 3.8 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 33 | 2.9 | | Transparency & trust (editorial 51, provenance 95) | 7% | 8.8 | 73 | 6.4 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **53.8 → D** | ### Why each score - Reliability 63: Graded on the REST API, read with the hosted lines. status.zoho.com redirects to us.zohostatus.com, which has components for Zoho Mail, mail listing, IMAP, POP, SMTP and the MX host, with incident history (20). In the 90 days to 9 October 2026 the history has seven notices naming a mail component (IMAP, the MX host and one mail listing), each under 12 minutes, the longest the MX host for 11 minutes 40 seconds on 3 October. Two notices covering several products, on 12 July and 10 August, lasted under 10 minutes, and the status feed shows mail components changing state when they ended. We read that as minor incidents only (20 of 30). Only the US page was read. The getting started guide says each API has its own rate limit and gives no numbers. Sending limits are published, 50 to 500 external emails an hour and 1,000 internal (7 of 15). The response code list has no 429, and no Retry-After, backoff guidance or idempotency key was found. The guide says only that the response will say when a limit is exceeded (2 of 15). The pricing page lists a 99.9% uptime guarantee for paid plans, with no SLA document, measurement or credit terms found (4 of 10). The API carries no beta or preview label (10). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 45: Graded on the REST API. No OpenAPI or similar file was found in the docs or under the zoho organisation on GitHub. The MCP tool definitions sit in a signed-in console and were not read (0 of 25). `https://www.zoho.com/mail/help/llms.txt` indexes a Markdown twin of every reference page (10). Each page states the purpose and names the call that supplies each ID, with little on when not to use a call (13 of 20). Parameters are listed with a type, a mandatory mark, allowed values and defaults, in prose only. Many PUT calls share one URL and differ by a `mode` field, and sample responses carry numbers and booleans as strings (9 of 15). Every page has a curl sample and a sample response. Errors are one shared list of seven status codes, with nothing per endpoint (9 of 15). The path has no version. What's New is a product changelog dated by month, and no API changelog was found (4 of 15). - Agent ergonomics 56: Graded on the REST API. List and search return a summary per message and the body is a separate call, with `limit` from 1 to 200 and a default of 10. There is no field selection. In MCP the owner chooses which tools a server carries, and the tool count is not published (17 of 25). `start` and `limit`, filters for folder, read status, flag, label, thread and attachments, three sort keys and a search syntax (18 of 20). Errors carry a status code, a description and a `moreInfo` message. Seven codes are documented, with no list of messages or recovery steps (10 of 20). No idempotency key or conditional write was found, so a retried send can go out twice. Delete moves to Trash unless `expunge=true`. MCP annotations were not read (5 of 20). Send needs only `fromAddress` and `toAddress`, and defaults are stated. No REST SDK in any language, tokens last an hour, hosts differ by data centre, and reading a body needs an account ID, a folder ID and a message ID (6 of 15). - Security & auth 67: OAuth 2.0 with scopes down to one resource and one operation, one-hour access tokens, revocable refresh tokens, PKCE for mobile and browser clients and a device flow (30). Less 10 because the documented token, refresh and revoke calls carry the client secret and refresh token in the URL query string (20 of 30). READ, CREATE, UPDATE and DELETE are separate scopes per resource, delete goes to Trash by default, and an MCP server holds only the tools its owner adds. Nothing confirms a send, and the MCP URL holds an API key that the FAQ says works like a password (14 of 20). Mail is untrusted content. No prompt-injection guidance was found in the API guide or the MCP pages read (2 of 15). The Logs API returns login history, admin audit records and SMTP logs, and the admin console has audit logs with SIEM export. No per-call API log was found (11 of 15). security.txt valid to 30 June 2028, a bug bounty, and ISO/IEC 27001 and SOC 2 Type II per the Zoho Mail compliance page (20). - Payments & pricing 30: No x402, MPP or L402 (0 of 40). Plan prices are public without a login, $1 to $6 a user a month billed yearly, with API access included and no per-call price (10 of 20). Mail Free covers five users with no card, in some regions only, and the highest paid edition has a 15-day trial with no card (20). A person signs up in a browser, registers an OAuth client in the API console and approves scopes (0 of 20). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 33: Zoho keeps no API changelog, so recency rests on what could be dated. Zoho Mail MCP is listed under May 2026 in What's New, between 131 and 161 days before this check. Product changes are listed for August 2026, none of them to the API (10 of 30, where a reading on product changes would give 20). What's New has more than three entries in the last 90 days, dated by month and none about the API or MCP, so half credit (10 of 20). The pricing page states support by email, chat and phone around the clock, and the changelog is public. We did not test the community forum for replies (9 of 15 for a closed service). No REST SDK. A Java command line tool and the MCP server are official. The MCP registry was not checked (4 of 15). No public repository, package or CI was found (0 of 10). - Transparency & trust 73: The editorial half. A closed service under the Zoho Terms of Service, last updated 2 March 2022, and a Zoho Mail usage policy updated 2 September 2026. No source repository (15 of 30). The privacy policy of 22 December 2025 says Zoho does not sell personal information, and that account data leaves the active database at a clean-up run every six months after termination and backups three months later. It also says anonymised crops of service data are used to improve algorithms and that staff may manually verify emails reported as spam, while the Zoho Mail privacy page says Zoho will never read a customer's emails. The DPA is sent on request by email (21 of 30). No API deprecation policy or dated notices were found (0 of 20). A sub-processor page exists, but its list loads by script and was not read. The data centre page names 20 sites and the certifications of each (15 of 20). The provenance half is computed from the provenance block. Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (19 items): https://www.anchorterminal.com/fixes/zoho-mail.md (JSON https://www.anchorterminal.com/fixes/zoho-mail.json) ### What we couldn't check - unchecked: the number and definitions of Zoho Mail MCP tools, which sit in the signed-in Zoho MCP console - unchecked: the sub-processor list at zoho.com/privacy/sub-processors.html, which loads by script - unchecked: status pages for data centres other than the US - unchecked: the official MCP registry for a Zoho entry - unchecked: whether the token endpoint accepts parameters in the request body, which the OAuth guide does not show - No request rate limit numbers, 429 documentation, SLA document, API changelog, API deprecation policy, OpenAPI file or REST SDK was found - The day Zoho Mail MCP launched is not stated. What's New lists it under May 2026, and a Zoho blog post on an email MCP server is dated 25 March 2026 - Which REST calls the Mail Free plan allows is not stated. The overview says plan and mail policy decide API availability - The usage policy bars automated emails without saying whether a message an agent sends for its owner through the API counts - The lead was right on the vendor, URL, docs link and interface. It did not mention Zoho Mail MCP, the command line tool or the usage policy's bar on automated email ### Sources - API index: (seen 2026-10-09) - API overview: (seen 2026-10-09) - getting started, data centres, errors and rate limiting: (seen 2026-10-09) - OAuth 2.0 guide: (seen 2026-10-09) - response codes: (seen 2026-10-09) - send an email: (seen 2026-10-09) - list emails: (seen 2026-10-09) - search emails: (seen 2026-10-09) - get email content: (seen 2026-10-09) - delete an email: (seen 2026-10-09) - Logs API: (seen 2026-10-09) - help centre llms.txt: (seen 2026-10-09) - product llms.txt: (seen 2026-10-09) - Zoho Mail MCP: (seen 2026-10-09) - MCP server configuration: (seen 2026-10-09) - MCP client configuration: (seen 2026-10-09) - Zoho MCP product page: (seen 2026-10-09) - webhooks: (seen 2026-10-09) - command line tool: (seen 2026-10-09) - rates, limits and policies: (seen 2026-10-09) - usage policy: (seen 2026-10-09) - What's New: (seen 2026-10-09) - pricing: (seen 2026-10-09) - status page: (seen 2026-10-09) - status incident history: (seen 2026-10-09) - status RSS: (seen 2026-10-09) - terms of service: (seen 2026-10-09) - contracting entities: (seen 2026-10-09) - privacy policy: (seen 2026-10-09) - Zoho Mail data privacy page: (seen 2026-10-09) - Zoho Mail certificates and compliance: (seen 2026-10-09) - sub-processors: (seen 2026-10-09) - GDPR and DPA: (seen 2026-10-09) - data centres: (seen 2026-10-09) - security.txt: (seen 2026-10-09) - robots.txt: (seen 2026-10-09) - GitHub search of the zoho organisation for mail repositories: (seen 2026-10-09) - RDAP for zoho.com: (seen 2026-10-09) ## Who's behind it (provenance 95/100, checked 2026-10-09) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Zoho Corporation Private Limited | 20/20 | | Domain age | zoho.com, registered 2004-01-16 (22 years) | 15/15 | | Endpoint on the vendor's domain | zoho.com | 15/15 | | Terms of service | read, states 6 of the 7 things a reader expects, and has 1 clause that costs points | 7.1/10 | | Privacy policy | read, states 8 of the 8 things a reader expects, and has 1 clause that costs points | 8/10 | | Status page | status.zoho.com | 10/10 | | Changelog | published | 10/10 | | security.txt | valid | 10/10 | The Terms of Service (last updated 2 March 2022) are the service agreement for Zoho's online services. The contracting entity depends on the customer's region, Zoho Corporation Private Limited for India and Zoho Corporation for the United States (https://www.zoho.com/legal/zoho-contracting-entities.html). The Zoho Mail usage policy at https://www.zoho.com/mail/help/usage-policy.html, last updated 2 September 2026, adds rules for the mail service and bars automated and bulk email. The privacy policy was last updated on 22 December 2025. Part II covers data Zoho processes on a customer's behalf. security.txt at www.zoho.com gives a bug bounty contact, security@zohocorp.com, a policy link and an expiry of 30 June 2028. What's New is a product changelog dated by month, with the latest entries under August 2026. No API changelog was found. The US API answers on mail.zoho.com. Other data centres use mail.zoho.eu, mail.zoho.in, mail.zoho.com.au, mail.zoho.jp, mail.zohocloud.ca, mail.zoho.com.cn, mail.zoho.ae and mail.zoho.sa. OAuth runs on accounts.zoho.com. RDAP for zoho.com gives a registration date of 2004-01-16 and expiry on 2031-01-16. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://www.zoho.com/terms.html), read 2026-10-08, dated 2022-03-02, states 6 of the 7 things a reader expects. - To know. Restricts benchmarking or competitive use (costs points). "use the Services for any form of competitive or benchmarking purposes" - To know. Has not been updated for three years or more. "Last updated on: 2nd March 2022." - Gives the date it was last updated. Last updated 2022-03-02. - States a limit on its liability. Capped at the fees paid in the 12 months before the claim or $1000. - Says how changes to the terms are announced. Gives 30 days of notice before a change. - Not found in the text. Refers to a service level or uptime commitment. - Also in the text (2026-10-08). Subscriptions renew automatically and the customer must give at least seven days' notice before the renewal date to stop renewal. "If you do not wish to renew the subscription, you must inform us at least seven days prior to the renewal date." - Also in the text (2026-10-08). Unpaid accounts inactive for 120 continuous days may be terminated and their data deleted, with prior notice, and activity in one service does not keep another active. "We reserve the right to terminate unpaid user accounts that are inactive for a continuous period of 120 days." - Also in the text (2026-10-08). If the customer does not answer a forwarded complaint within 10 days, Zoho may give the customer's name and contact information to the complainant. "If you do not respond to the complainant within 10 days from the date of our email to you, we may disclose your name and contact information to the complainant for enabling the complainant to take legal action against you." **Privacy policy** (https://www.zoho.com/privacy.html), read 2026-10-08, dated 2025-12-22, states 8 of the 8 things a reader expects. - To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). "In keeping with Zoho's promise not to exploit your data in a way that is not respectful of your privacy and confidentiality expectations, we make only the following limited use of service data for these technologies: (i) using anonymized crops of service data to improve accuracy of the algorithms;" - Gives the date it was last updated. Last updated 2025-12-22. - Says how long data is kept. Names a period of 6 months. - Gives a privacy contact. privacy@zohocorp.com. - Says where data is transferred or stored. Data goes to the United States. - Also in the text (2026-10-08). Zoho employees and contractors may open service data to resolve errors and to check by hand emails reported as spam and scanned images. "so that they can (i) identify, analyze and resolve errors, (ii) manually verify emails reported as spam to improve spam detection, or (iii) manually verify scanned images that you submit to us to verify the accuracy of optical character recognition." - Also in the text (2026-10-08). Zoho says it uses an organisation's data to develop models specific to that organisation. "(ii) using your organization's data for developing models specific for your organization." - Also in the text (2026-10-08). After an account is terminated, data leaves the active database at a clean-up run once every six months and leaves backups three months later. "Once you terminate your Zoho user account, your data will eventually get deleted from active database during the next clean-up that occurs once in 6 months." ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Prices | Item | Price | Unit | Note | | --- | --- | --- | --- | | Mail Lite, 5 GB | $1 | per seat per month | billed yearly, no monthly plan. $1.25 for 10 GB | | Workplace Standard | $3 | per seat per month | billed yearly. $4 billed monthly. 30 GB mailbox plus the office suite | | Mail Premium | $4 | per seat per month | billed yearly, no monthly plan. 50 GB mailbox with retention and eDiscovery | | Workplace Professional | $6 | per seat per month | billed yearly. 100 GB mailbox | Across all listings: https://www.anchorterminal.com/prices/index.md ## Strengths - OAuth scopes name one resource and one operation, such as `ZohoMail.messages.READ`, so an agent can hold read access without send or delete. - Every reference page has a Markdown twin, indexed in `https://www.zoho.com/mail/help/llms.txt`, with a curl sample and a sample response. - Zoho Mail MCP exposes the API methods as tools on a remote server, and the owner picks which tools a server carries. - The Mail Free plan covers five users on one domain with no card, and the MCP FAQ says free and paid plans both work. - Delete moves a message to Trash unless `expunge=true` is sent, and audit records, login history and SMTP logs are readable through the Logs API. ## Weaknesses - The Zoho Mail usage policy, updated 2 September 2026, lists automated, bulk and transactional emails among uses that are not allowed. - No OpenAPI file, official REST SDK or dated API changelog was found. The path carries no version. - The getting started guide says each API has its own rate limit and gives no numbers. The response code list has no 429. - External sending is capped at 50 to 500 emails an hour by sender reputation, with a block of up to one hour once the cap is reached. - The OAuth guide's token, refresh and revoke examples carry the client secret and refresh token in the URL query string. ## Before you call it (notes for agents) 1. Send `Authorization: Zoho-oauthtoken `, not `Bearer`. The token response says `Bearer`, but the OAuth guide says the Mail API requires the Zoho prefix. 2. Use the host for the account's data centre, such as `mail.zoho.eu` or `mail.zoho.in`. Call `GET /api/accounts` first for the `accountId` every mailbox call needs. 3. Reading a message body needs both `folderId` and `messageId`. List and search calls return a summary only, 10 messages by default and 200 at most. 4. Request `ZohoMail.messages.READ` alone for a reading agent. Add `CREATE` only when it must send, and leave `DELETE` out unless required. 5. Refresh the access token every hour, and post OAuth parameters in the request body where the server accepts it, to keep secrets out of URLs. ## Connect First request: ```bash curl "https://mail.zoho.com/api/accounts" \ -X GET \ -H "Accept: application/json" \ -H "Authorization: Zoho-oauthtoken $ZOHO_ACCESS_TOKEN" ``` Through letme (picks today, calling later): https://letme.dev/zoho-mail. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | Nylas Email API | A | 78.7 | 13 | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | no | https://www.anchorterminal.com/tools/nylas-email.md | | Gmail API | BB | 77.8 | 18 | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | no | https://www.anchorterminal.com/tools/gmail-api.md | | EmailEngine | BB | 71.4 | 123 | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | no | https://www.anchorterminal.com/tools/emailengine.md | | Outlook Mail (Microsoft Graph) | B | 66.3 | 272 | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | no | https://www.anchorterminal.com/tools/outlook-mail-graph.md | | Unipile | C | 58.4 | 524 | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | no | https://www.anchorterminal.com/tools/unipile.md | | Fastmail API (JMAP) | C | 54.1 | 620 | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | no | https://www.anchorterminal.com/tools/fastmail.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The API index lists 16 groups, from Organisation, Domain, Groups, Users and Mail Policy to Accounts, Folders, Labels, Email Messages, Signatures, Threads, Tasks, Bookmarks, Notes, Logs and Anti-spam (source: ) - The Zoho Mail usage policy, last updated 2 September 2026, says Zoho Mail cannot be used for promotional, bulk, marketing, newsletter, automated or transactional emails, and points to ZeptoMail for transactional mail (source: ) - Zoho Mail MCP is listed under May 2026 in the product's What's New page. Tools are added to a server in the Zoho MCP console, which issues a server URL holding an API key (source: ) - The MCP FAQ says the MCP URL must be treated like a password because anyone holding it can reach the mailbox, and that data sent to AI agents is not encrypted by the MCP layer (source: ) - The getting started guide says each API has its own rate limit and that the response says when it is exceeded. It gives no numbers (source: ) - External sending is limited to 50 to 500 emails an hour depending on sender reputation, internal sending to 1,000 an hour, and a message to 150 external recipients on paid accounts (source: ) - The privacy policy, last updated 22 December 2025, says Zoho uses anonymised crops of service data to improve its algorithms and that staff may manually verify emails reported as spam (source: ) - A ZMail command line tool is distributed as a Java JAR that needs Java 17 or later (source: ) - Zoho's API overview points developers building their own email application to Mail360, a separate Zoho product (source: ) ## Compare - [EmailEngine vs Zoho Mail API](https://www.anchorterminal.com/compare/emailengine-vs-zoho-mail.md): BB 71.4 vs D 53.8 - [Fastmail API (JMAP) vs Zoho Mail API](https://www.anchorterminal.com/compare/fastmail-vs-zoho-mail.md): C 54.1 vs D 53.8 - [Gmail API vs Zoho Mail API](https://www.anchorterminal.com/compare/gmail-api-vs-zoho-mail.md): BB 77.8 vs D 53.8 - [Nylas Email API vs Zoho Mail API](https://www.anchorterminal.com/compare/nylas-email-vs-zoho-mail.md): A 78.7 vs D 53.8 - [Outlook Mail (Microsoft Graph) vs Zoho Mail API](https://www.anchorterminal.com/compare/outlook-mail-graph-vs-zoho-mail.md): B 66.3 vs D 53.8 - [Unipile vs Zoho Mail API](https://www.anchorterminal.com/compare/unipile-vs-zoho-mail.md): C 58.4 vs D 53.8 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on zoho.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "zoho-mail", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html Zoho Mail API on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![Zoho Mail API on Anchor Terminal](https://www.anchorterminal.com/badges/zoho-mail.svg)](https://www.anchorterminal.com/tools/zoho-mail) ``` Plain link: ```html Zoho Mail API on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Zoho Mail API is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/zoho-mail-dark.png - Light: https://www.anchorterminal.com/assets/share/zoho-mail-light.png