A pod is a group of inboxes inside your organization. Every organization has a default pod; you only need more if you are building something where your customers each need isolated mail.

The shape that matters: create a pod per customer, and issue a pod-scoped API key for it. That key reaches that pod's inboxes and nothing else — so a bug or a prompt injection in one customer's agent cannot read another customer's mail.

curl -X POST https://api.carlyemail.com/v0/pods \
  -H "Authorization: Bearer $CARLYEMAIL_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"name": "acme-corp"}'

Then create inboxes with pod_id, and mint a key scoped to it.

Every list endpoint is mirrored under /v0/pods/{pod_id}/..., so the same handlers serve a pod-scoped view without a different API to learn.

Metrics, events and suppression lists are all attributable per pod, which is what lets you tell which customer is generating bounces rather than only that somebody is.