# imap-service — administration

This port administers one instance of imap-service: the mailbox accounts it deposits
into, the access tokens that authorise depositing, and the mail queue and file pool
behind them.

It is **not** the interface that deposits mail. That one runs on its own port under its
own host name, with its own credentials — an access token issued for a mailbox is not
accepted here, and the token used here is not accepted there.

**This instance has no account yet.** Nothing can deposit mail until one exists. Start with `POST /admin/v1/probe`, then `POST /admin/v1/accounts`.

## What you need

`Authorization: Bearer <admin-token>` on every operation under `/admin/v1` except the
health check. The service takes that token from the environment variable
`IMAP_SERVICE_ADMIN_TOKEN`, otherwise from the file `admin-token` beside its registry,
otherwise it generates one at startup and writes it into the log exactly once.

Treat it as an administrative password, not as an API key: it cannot deposit mail
itself, but it can issue a token that can.

## Where to go

* **The guide** — https://imap.seb.news/skill — what to set up first, what a token means, what
  cannot be changed and why.
* **The interface description** — https://imap.seb.news/admin/v1/openapi.json — every operation,
  every field, every failure, with examples. It is the normative description of the
  mechanics; the guide never repeats it.
* **Browsable** — https://imap.seb.news/admin/v1/docs
* **Liveness** — https://imap.seb.news/admin/v1/healthz — one bit, no token.

## What this port cannot do

It cannot read mail, send mail or deposit mail. It cannot show you a token that was
issued earlier — only its hash is kept. And it cannot change an existing account: the
only alteration is setting a new mailbox password.