Docs — InboxAlarm

Documentation

The API behind the dashboard. Base URL defaults to http://localhost:8095.

AuthenticationSet INBOXALARM_API_KEY to require the X-API-Key header on every endpoint except GET /health. With no key set, bind to localhost or use a trusted reverse proxy.

Quickstart

Run a one-off check

Full SPF/DKIM/DMARC + blocklist check for a domain.

curl -X POST http://localhost:8095/check \
  -H "X-API-Key: $INBOXALARM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com", "dkim_selectors": ["s1", "google"]}'

Watch a domain

Adds it to the watch list and captures a baseline on first add.

curl -X POST http://localhost:8095/domains \
  -H "X-API-Key: $INBOXALARM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

Check everything (cron this)
Runs checks for every watched domain, diffs baselines, and dispatches alerts. Point a cron or systemd timer at it on your plan's cadence.
```
curl -X POST http://localhost:8095/check-all \
  -H "X-API-Key: $INBOXALARM_API_KEY"
```

Read recent alerts

Tail of the alert log.

curl -H "X-API-Key: $INBOXALARM_API_KEY" http://localhost:8095/alerts

API reference

Method	Endpoint	What it does
GET	`/health`	Liveness + version. Public.
POST	`/check`	Full check for one domain. Body: domain, dkim_selectors[].
GET	`/domains`	List watched domains.
POST	`/domains`	Add a domain; captures a baseline on first add.
DELETE	`/domains/<domain>`	Remove a domain from the watch list.
POST	`/check-all`	Check every watched domain; drift and failures dispatch alerts.
GET	`/alerts`	Recent alert log entries.

Full reference with request/response examples ships in the repo as OPENAPI.md.