Email API for AI accounting and finance agents

The problem

Accounts payable is an email workflow wearing a spreadsheet's clothes. An invoice arrives as a PDF attached to a message from a supplier, often as a reply on a thread that started three months ago. A payment query arrives as a one-line reply with no context. A statement arrives as a CSV nobody asked for.

An agent doing this job needs four things that a send-only email API cannot give it: the attachment, the thread it arrived on, a record it can search later, and a hard stop before money moves.

Why a real inbox

invoices@yourcompany.com as an actual mailbox, not a webhook route.

The attachment is the document. list_attachments and download_attachment pull the PDF or CSV as bytes the agent can send to a model or a parser. No MIME tree walking, no S3 prefix convention you invented and now maintain.

The thread is the context. A supplier's "yes, that one is approved" means nothing on its own. get_thread returns the conversation in order, so the agent reads the approval next to the invoice it approves. When the agent replies, Anjal writes Message-ID, In-Reply-To and References, so the supplier sees a continuation rather than a new email with a confusing subject.

The record is the audit trail. Mail is stored because it is a mailbox. search_messages six months later answers "what did this supplier send about PO 4471", which is the question an auditor actually asks. Log retention measured in days is not an accounting record.

A human can look. Every inbox has IMAP and SMTP credentials, so your finance lead opens invoices@ in Apple Mail or Outlook and sees exactly what the agent saw. That is worth more in this use case than in any other, because somebody will eventually ask.

The part that matters most here: nothing gets paid on the agent's say-so

Business email compromise is not a hypothetical in accounts payable. It is the single most common way companies lose money to email, and it works precisely because a convincing message arrives on a real thread from a real-looking supplier asking to update bank details.

Two mechanisms, and use both.

Drafts, not sends. Have the agent call create_draft for anything outbound and never send_message. The draft sits in the inbox until a person reads it and sends it. For a finance agent this should be the default, not an option.

Quarantine on the way in. Anjal screens every inbound message for prompt injection on the ingest path and holds what it judges hostile, so the agent never reads it. A human releases it from the web app, and an agent cannot release its own quarantine, because the obvious attack is to ask it to.

And the rule that actually holds, which no vendor can do for you: gate side-effects on who, not on what. Decide which senders may trigger which actions and enforce it in code, not in the prompt. A bank-detail change gets a human confirmation every time regardless of what the email says. Read agent safety for the honest limits before you build on any of this.

What it looks like

# the agent's own inbox
curl -X POST https://anjal.app/v1/inboxes \
  -H "X-API-Key: $ANJAL_KEY" -H "Content-Type: application/json" \
  -d '{"username": "invoices", "displayName": "Accounts Payable"}'

Then the loop: a webhook fires on message.received, the agent calls get_thread for context and download_attachment for the PDF, extracts the amount, supplier and PO, writes it to your ledger, and calls create_draft with the acknowledgement. A person presses send. Nothing pays anyone.

Fit

Good fit if invoices and receipts reach you by email, the documents are attachments, you need the history searchable later, and a human must approve anything that moves money.

Not a fit if your AP flows through a portal rather than email, or if you want the agent to execute payments autonomously. We will not help you build the second one.

Cost

Starter is $5/month for 2 inboxes, 6,000 emails and 10 GB. Developer is $15/month for 10 inboxes, 20,000 emails and 30 GB. Attachments count toward storage, and accounting mail is attachment-heavy, so size on storage rather than message count. Extra inboxes are $2/month.

Related

• AI customer support agents for the same drafts-first pattern on a different queue
• Transactional email if you also send the invoices
• Prompt injection in agent inboxes