# description
A credential that opens a mailbox over IMAP and/or the mailbox API. Scoped to one domain and an address pattern within it, so a single password can serve every address on a domain or exactly one. The secret itself is only ever returned once, at creation.

# properties.label.description
User-supplied name, e.g. which client or agent holds it.

# properties.domain_id.description
The hosted domain this password covers (dom_…). Null only for legacy account-wide credentials.

# properties.domain.description
Domain name this password covers. The literal `*` marks a legacy account-wide IMAP credential, which covers every domain the account owns; new passwords always name one domain.

# properties.address.description
Local-part pattern within the domain: `*` (every address), `hello` (exact), `support-*` / `*-agent` (glob). Same wildcard grammar as inbound routes.

# properties.protocols.description
What this password may authenticate: `imap` for IMAP LOGIN, `api` for Bearer auth on the mailbox API. At least one.

# properties.key_prefix.description
First characters of the secret, for display (the rest is never retrievable).

# properties.last_used_at.description
Last authenticated use, ms epoch — null if never used.

# properties.legacy.description
True for pre-existing IMAP-only credentials (mk_imap_…) surfaced in this shape. They keep working indefinitely but cannot grant `api`.

# properties.secret.description
The password itself (mk_pw_…). Returned ONLY in the create response — store it then, it is never shown again.