Create webmail login link for an email account

POST /api/v2/shared-hosting/{accountId}/email-accounts/{address}/actions/sso

Create a one-time webmail login URL for one mailbox on a cPanel-backed shared-hosting account, so the mailbox can be read without knowing or resetting its password.

Get accountId from GET /api/v2/shared-hosting data[].id.

The {address} path value can be the email address ([email protected]) or the public email account ID returned by GET /api/v2/shared-hosting/{accountId}/email-accounts emailAccounts[].id.

Literal addresses may use a Unicode IDN or its punycode spelling.

The mailbox domain must be hosted on the account, otherwise the request fails with 403 domain_not_owned.

The URL is interactive and should be opened by the customer right away, not stored.

Accounts on HostUp's previous hosting platform return 409 account_not_eligible_cpanel; contact support and we will migrate the existing account to cPanel at no extra charge.

Web Hosting Email

Authentication

Required API scopes: console:serviceswrite:hosting

Authenticate with an API key in the Authorization: Bearer <token> header.

Context

Related endpoints

POST /api/v2/shared-hosting/{accountId}/email-accounts/{address}/actions/mail-profile-link Create Apple Mail setup profile link for an email account DELETE /api/v2/shared-hosting/{accountId}/email-accounts/{address} Delete email account PUT /api/v2/shared-hosting/{accountId}/email-accounts/{address}/quota Replace email account quota

Path Parameters

accountId string required Example: acct_01hxa3b4c5d6e7f8g9h0j1k2m3

Public shared-hosting account ID. Get it from GET /api/v2/shared-hosting data[].id. Do not invent this value; use the exact ID returned by the referenced API response.

address string required Example: [email protected]

Email address.

Headers

Authorization Bearer <token>

Accept application/json

Responses

200 Webmail login link. 3 fields

loginUrl string required · Example: https://webmail.example.com/login/session/YOUR_TOKEN

expiresAt string · nullable required · Example: null

Known expiry timestamp, or null when the control panel does not expose the exact token TTL.

singleUse boolean required · Example: true

Whether the generated login URL is intended for one interactive use.

400 Invalid request. The response body is an RFC 7807 Problem Details document. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

401 Unauthorized. Authentication is required. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

403 Forbidden. The caller lacks a required scope or does not own the resource. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

404 Not found. The resource does not exist or is not owned by the caller. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

409 Conflict. code is account_suspended, account_not_eligible_cpanel, or a route-specific blocker with its own recovery fields. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

429 Rate limited. Retry after the limit resets. 429 responses include Retry-After seconds plus X-RateLimit-* headers. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

500 Internal error. Retry later or contact support if the issue persists. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

502 Upstream failure. A dependent provider request failed; the Problem Details code is upstream_failed. Retry later or contact support if the issue persists. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

POST https://cloud.hostup.se/api/v2/shared-hosting/{accountId}/email-accounts/{address}/actions/sso

For AI assistants

View as Markdown

cURL

curl -X POST "https://cloud.hostup.se/api/v2/shared-hosting/acct_01hxa3b4c5d6e7f8g9h0j1k2m3/email-accounts/[email protected]/actions/sso" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"

Response

{
  "loginUrl": "https://webmail.example.com/login/session/YOUR_TOKEN",
  "expiresAt": null,
  "singleUse": true
}

{
  "type": "object",
  "properties": {
    "loginUrl": {
      "type": "string"
    },
    "expiresAt": {
      "type": "string",
      "description": "Known expiry timestamp, or null when the control panel does not expose the exact token TTL.",
      "nullable": true
    },
    "singleUse": {
      "type": "boolean",
      "description": "Whether the generated login URL is intended for one interactive use."
    }
  }
}