Domains and mailboxes

The email size limit is 25 MB for each inbound email message (including attachments).

Overview

Tesouro automatically creates mailboxes for partners. These mailboxes are on Tesouro’s domain—tesouro.com; thus, the email address on all Tesouro emails is always noreply@tesouro.com by default. However, partners can opt to set up their email domain for better convenience. Once a domain is created and verified, for example, mycompany.com, the emails Tesouro sends will also have noreply@mycompany.com in the from header by default. This custom domain will also be displayed in the email’s mailed-by and signed-by MIME headers. You can customize the email sender name and username by updating your Tesouro partner settings.

If the organization users already have their own custom emails shared with their vendors to collect their payables, the organization users can automatically forward their received emails to a mailbox of the partner, where the payables will be collected.

Roles and permissions

The following endpoints must be accessed using a partner access token:

/mailbox-domains*
GET /mailboxes/search

The following endpoints can be accessed using both app tokens and organization user access tokens. Organization users need a role with the mailbox permissions to access these endpoints.

GET /mailboxes
POST /mailboxes
DELETE /mailboxes/{mailbox_id}

Manage domains

List all domains

To list all the domains registered in the system, send a GET request to the /mailbox-domains endpoint:

curl -X GET 'https://api.sandbox.tesouro.com/v1/mailbox-domains' \
     -H 'X-Finops-Version: 2025-06-23' \
     -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

The successful response contains information about the domains registered in the system:

{
  "data": [
    {
      "id": "63c40787-97da-4332-9415-9638cb0ea8bd",
      "domain": "domainexample.com",
      "status": "waiting_to_be_verified",
      "dedicated_ip": "123.456.789.101",
      "last_updated_at": "2024-01-15T09:30:00Z",
      "dns_records": {
        "sending_dns_records": [
          {
            "is_active": true,
            "name": "name",
            "record_purpose": "DKIM",
            "valid": "unknown",
            "value": "v=spf1 include:mailgun.org ~all",
            "record_type": "TXT"
          }
        ],
        "receiving_dns_records": [
          {
            "is_active": true,
            "name": "name",
            "record_purpose": "DKIM",
            "valid": "unknown",
            "value": "mxa.eu.mailgun.org",
            "record_type": "TXT"
          }
        ]
      }
    }
  ]
}

Create a domain

To create a new domain, send a POST request to the /mailbox-domains endpoint:

curl -X POST 'https://api.sandbox.tesouro.com/v1/mailbox-domains' \
     -H 'X-Finops-Version: 2025-06-23' \
     -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
     -H 'Content-Type: application/json' \
     -d '{
       "domain": "domainexample.com"
     }'

Different domains per environmentYou must use different domain names in the Sandbox and Production environments. For example, mail.sandbox.mycompany.com in Sandbox and mail.mycompany.com in Production.You cannot create a Production domain with the same domain name as in Sandbox, and vice versa.

The successful response contains information about the created domain:

{
  "id": "8a91507e-63b4-4eb6-9354-dc5ec4251815",
  "domain": "domainexample.com",
  "status": "waiting_to_be_verified",
  "name": "name",
  "record_purpose": "DKIM",
  "dedicated_ip": "dedicated_ip",
  "last_updated_at": "2024-01-15T09:30:00Z",
  "dns_records": {
    "sending_dns_records": [
      {
        "is_active": true,
        "valid": "unknown",
        "value": "v=spf1 include:mailgun.org ~all",
        "record_type": "TXT"
      }
    ],
    "receiving_dns_records": [
      {
        "is_active": true,
        "valid": "unknown",
        "value": "mxa.eu.mailgun.org",
        "record_type": "TXT"
      }
    ]
  }
}

Set up a domain’s DNS records

After receiving the required DNS records in the previous step, you have to enter these settings in the control panel of your domain provider.

Verify a domain

The mail service provider used by Tesouro automatically verifies the associated domains on a regular basis (one or more times a day). However, you can also trigger domain verification manually by calling POST /mailbox-domains/{domain_id}/verify:

curl -X POST 'https://api.sandbox.tesouro.com/v1/mailbox-domains/63c40787...b0ea8bd/verify' \
     -H 'X-Finops-Version: 2025-06-23' \
     -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
     -d ''

In case of successful verification, the response will return status set to verified:

{
  "id": "8a91507e-63b4-4eb6-9354-dc5ec4251815",
  "domain": "domainexample.com",
  "status": "verified"
}

If the verification fails, the response will contain status set to waiting_to_be_verified. To resolve this issue, ensure the DNS records required for this mailbox domain match the records you provided in the control panel of your domain provider in the previous step.

Update a domain

It is not possible to update an existing domain. If some data has to be changed, you need to delete the domain and then create it again. To delete a domain, call DELETE /mailbox-domains/{domain_id}:

curl -X DELETE 'https://api.sandbox.tesouro.com/v1/mailbox-domains/63c40787...b0ea8bd' \
     -H 'X-Finops-Version: 2025-06-23' \
     -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

The successful response indicates that the domain was deleted successfully.

Manage mailboxes

After you have added your custom domain to Tesouro, you can associate specific mailboxes within this domain with specific organizations. These organization mailboxes are not created by default and, thus, need to be created by the partners. The domain should be verified.

The mailbox name can contain only lowercase letters (from a to z), digits (from 0 to 9), and the characters ., _, +, and -.

Associate a mailbox with an organization

To associate a mailbox with an organization, call POST /mailboxes as shown below. The mailbox_name field represents the part of the email address before the @ and the mailbox_domain_id field represents the ID of the domain that you previously added:

curl -X POST 'https://api.sandbox.tesouro.com/v1/mailboxes' \
     -H 'X-Finops-Version: 2025-06-23' \
     -H 'X-Organization-Id: ORGANIZATION_ID' \
     -H 'Authorization: Bearer ACCESS_TOKEN' \
     -H 'Content-Type: application/json' \
     -d '{
       "related_object_type": "payable",
       "mailbox_name": "mailboxexample"
       "mailbox_domain_id": "8a91507e-63b4-4eb6-9354-dc5ec4251815"
     }

The response contains the full email address (mailbox_full_address) associated with this organization:

{
  "id": "e8c884f8-bed3-4d92-afc9-3538c5079014",
  "status": "active",
  "related_object_type": "payable",
  "mailbox_name": "mailboxexample",
  "mailbox_full_address": "mailboxexample@domainexample.com",
  "mailbox_domain_id": "8a91507e-63b4-4eb6-9354-dc5ec4251815"
}

Now the organization can receive invoices to this mailbox. Any invoices sent as email attachments to this mailbox will be registered as new payables for that organization and trigger the related approval policies. You can also set mailboxes for collecting receipts.

List all mailboxes

To retrieve all the mailboxes used to process payables of the connected organization, call GET /mailboxes:

curl -X GET 'https://api.sandbox.tesouro.com/v1/mailboxes' \
     -H 'X-Finops-Version: 2025-06-23' \
     -H 'X-Organization-Id: ORGANIZATION_ID' \
     -H 'Authorization: Bearer ACCESS_TOKEN'

The successful response contains a list of all the mailboxes associated with this organization:

{
  "data": [
    {
      "id": "e8c884f8-bed3-4d92-afc9-3538c5079014",
      "status": "active",
      "related_object_type": "payable",
      "mailbox_name": "1102737648192968373_payables",
      "mailbox_full_address": "1102737648192968373_payables@mg.sandbox.tesouro.com",
      "mailbox_domain_id": null
    }
  ]
}

Partners can list all the mailboxes of a given list of organization IDs by calling POST /mailboxes/search.

Update a mailbox

It is not possible to update an existing mailbox. If some data has to be changed, you need to delete the mailbox and then create it again. To delete a mailbox, call DELETE /mailboxes/{mailbox_id}:

curl -X DELETE 'https://api.sandbox.tesouro.com/v1/mailboxes/e8c884f8-bed3-4d92-afc9-3538c5079014' \
     -H 'X-Finops-Version: 2025-06-23' \
     -H 'X-Organization-Id: ORGANIZATION_ID' \
     -H 'Authorization: Bearer ACCESS_TOKEN'

The successful response indicates that the mailbox was deleted successfully.

Getting started

Embedded components

Authentication

Roles & permissions

Manage organizations

Common objects

Accounts payable

Accounts receivable

Expense management

Payments

Advanced

Accounting integrations

Domains and mailboxes

Overview

Roles and permissions

Manage domains

List all domains

Create a domain

Set up a domain’s DNS records

Verify a domain

Update a domain

Manage mailboxes

Associate a mailbox with an organization

List all mailboxes

Update a mailbox

​Overview

​Roles and permissions

​Manage domains

​List all domains

​Create a domain

​Set up a domain’s DNS records

​Verify a domain

​Update a domain

​Manage mailboxes

​Associate a mailbox with an organization

​List all mailboxes

​Update a mailbox

Overview

Roles and permissions

Manage domains

List all domains

Create a domain

Set up a domain’s DNS records

Verify a domain

Update a domain

Manage mailboxes

Associate a mailbox with an organization

List all mailboxes

Update a mailbox