Kobana Autonomous Inbox API
Public REST API for the Kobana Autonomous Inbox.
Authentication: Bearer JWT (RS256, issued by the Kobana authorization server; aud includes https://api.inbox[.<env>].kobana.com.br) plus mTLS terminated at CloudFront (passed through as the cloudfront-viewer-mtls-client-cert-fingerprint header). The JWT org claim (the Kobana account) resolves the caller organization; sub is the person and is carried for attribution only. Pick a workspace inside the organization with X-Workspace-Id when it has more than one.
Resource {id} endpoints (workspaces, inboxes, agents, webhooks) accept either the internal UUID or the resource external_id. POST endpoints that own an external_id accept it as an optional field and default it to the generated internal id when omitted. The deleted_at field is never returned in responses or in webhook payloads; soft-deleted records are filtered out instead.
All keys in responses and webhook payloads are snake_case. Webhook deliveries share the API serializer: the envelope carries event (slug, id), delivered_at and workspace; data nests resource snapshots (organization, agent, inbox, email, agent_run) plus the event-specific keys.