diff --git a/src/mail.js b/src/mail.js
index 2a720bbd4..1d32ac67c 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -14,6 +14,11 @@ exports = module.exports = {
 
     sendTestMail: sendTestMail,
 
+    getMailboxes: getMailboxes,
+    getUserMailbox: getUserMailbox,
+    enableUserMailbox: enableUserMailbox,
+    disableUserMailbox: disableUserMailbox,
+
     MailError: MailError
 };
 
@@ -27,6 +32,7 @@ var assert = require('assert'),
     dig = require('./dig.js'),
     domains = require('./domains.js'),
     infra = require('./infra_version.js'),
+    mailboxdb = require('./mailboxdb.js'),
     maildb = require('./maildb.js'),
     mailer = require('./mailer.js'),
     net = require('net'),
@@ -38,6 +44,7 @@ var assert = require('assert'),
     smtpTransport = require('nodemailer-smtp-transport'),
     sysinfo = require('./sysinfo.js'),
     user = require('./user.js'),
+    UserError = user.UserError,
     util = require('util'),
     _ = require('underscore');
 
@@ -611,6 +618,7 @@ function setMailEnabled(domain, enabled, callback) {
 function sendTestMail(domain, to, callback) {
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof to, 'object');
+    assert.strictEqual(typeof callback, 'function');
 
     get(domain, function (error, result) {
         if (error) return callback(error);
@@ -619,4 +627,69 @@ function sendTestMail(domain, to, callback) {
 
         callback();
     });
-}
\ No newline at end of file
+}
+
+function getMailboxes(domain, callback) {
+    assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    mailboxdb.listMailboxes(domain, function (error, result) {
+        if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
+
+        callback(null, result);
+    });
+}
+
+function getUserMailbox(domain, userId, callback) {
+    assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof userId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    user.get(userId, function (error, result) {
+        if (error && error.reason === UserError.NOT_FOUND) return callback(new MailError(MailError.NOT_FOUND, 'no such user'));
+        if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
+
+        mailboxdb.getMailbox(result.username, domain, function (error, result) {
+            if (error && error.reason === DatabaseError.NOT_FOUND) return callback(new MailError(MailError.NOT_FOUND, 'no such mailbox'));
+            if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
+
+            callback(null, result);
+        });
+    });
+}
+
+function enableUserMailbox(domain, userId, callback) {
+    assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof userId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    user.get(userId, function (error, result) {
+        if (error && error.reason === UserError.NOT_FOUND) return callback(new MailError(MailError.NOT_FOUND, 'no such user'));
+        if (error) return callback(new MailError(MailError.INTERNAL_ERROR));
+
+        mailboxdb.add(result.username, domain, userId, mailboxdb.TYPE_USER, function (error) {
+            if (error && error.reason === DatabaseError.ALREADY_EXISTS) return callback(new MailError(MailError.ALREADY_EXISTS, 'mailbox already exists'));
+            if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
+
+            callback(null);
+        });
+    });
+}
+
+function disableUserMailbox(domain, userId, callback) {
+    assert.strictEqual(typeof domain, 'string');
+    assert.strictEqual(typeof userId, 'string');
+    assert.strictEqual(typeof callback, 'function');
+
+    user.get(userId, function (error, result) {
+        if (error && error.reason === UserError.NOT_FOUND) return callback(new MailError(MailError.NOT_FOUND, 'no such user'));
+        if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
+
+        mailboxdb.del(result.username, domain, function (error) {
+            if (error && error.reason === UserError.NOT_FOUND) return callback(new MailError(MailError.NOT_FOUND, 'no such mailbox'));
+            if (error) return callback(new MailError(MailError.INTERNAL_ERROR, error));
+
+            callback(null);
+        });
+    });
+}
diff --git a/src/routes/mail.js b/src/routes/mail.js
index 37a2fe97b..682a57deb 100644
--- a/src/routes/mail.js
+++ b/src/routes/mail.js
@@ -10,7 +10,12 @@ exports = module.exports = {
     setMailRelay: setMailRelay,
     setMailEnabled: setMailEnabled,
 
-    sendTestMail: sendTestMail
+    sendTestMail: sendTestMail,
+
+    getMailboxes: getMailboxes,
+    getUserMailbox: getUserMailbox,
+    enableUserMailbox: enableUserMailbox,
+    disableUserMailbox: disableUserMailbox
 };
 
 var assert = require('assert'),
@@ -122,3 +127,50 @@ function sendTestMail(req, res, next) {
         next(new HttpSuccess(202));
     });
 }
+
+function getMailboxes(req, res, next) {
+    assert.strictEqual(typeof req.params.domain, 'string');
+
+    mail.getMailboxes(req.params.domain, function (error, result) {
+        if (error && error.reason === MailError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(200, { mailboxes: result }));
+    });
+}
+
+function getUserMailbox(req, res, next) {
+    assert.strictEqual(typeof req.params.domain, 'string');
+    assert.strictEqual(typeof req.params.userId, 'string');
+
+    mail.getUserMailbox(req.params.domain, req.params.userId, function (error, result) {
+        if (error && error.reason === MailError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(200, { mailbox: result }));
+    });
+}
+
+function enableUserMailbox(req, res, next) {
+    assert.strictEqual(typeof req.params.domain, 'string');
+    assert.strictEqual(typeof req.params.userId, 'string');
+
+    mail.enableUserMailbox(req.params.domain, req.params.userId, function (error) {
+        if (error && error.reason === MailError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(201, {}));
+    });
+}
+
+function disableUserMailbox(req, res, next) {
+    assert.strictEqual(typeof req.params.domain, 'string');
+    assert.strictEqual(typeof req.params.userId, 'string');
+
+    mail.disableUserMailbox(req.params.domain, req.params.userId, function (error) {
+        if (error && error.reason === MailError.NOT_FOUND) return next(new HttpError(404, error.message));
+        if (error) return next(new HttpError(500, error));
+
+        next(new HttpSuccess(201, {}));
+    });
+}
diff --git a/src/server.js b/src/server.js
index 655ee2ff3..f080a380c 100644
--- a/src/server.js
+++ b/src/server.js
@@ -219,6 +219,10 @@ function initializeExpressSync() {
     router.post('/api/v1/mail/:domain/relay',         settingsScope, routes.user.requireAdmin, routes.mail.setMailRelay);
     router.post('/api/v1/mail/:domain/enable',        settingsScope, routes.user.requireAdmin, routes.mail.setMailEnabled);
     router.post('/api/v1/mail/:domain/send_test_mail',  cloudronScope, routes.user.requireAdmin, routes.mail.sendTestMail);
+    router.get ('/api/v1/mail/:domain/mailbox',  cloudronScope, routes.user.requireAdmin, routes.mail.getMailboxes);
+    router.get ('/api/v1/mail/:domain/mailbox/:userId',  cloudronScope, routes.user.requireAdmin, routes.mail.getUserMailbox);
+    router.post('/api/v1/mail/:domain/mailbox/:userId',  cloudronScope, routes.user.requireAdmin, routes.mail.enableUserMailbox);
+    router.del ('/api/v1/mail/:domain/mailbox/:userId',  cloudronScope, routes.user.requireAdmin, routes.mail.disableUserMailbox);
 
     // feedback
     router.post('/api/v1/feedback', usersScope, routes.cloudron.feedback);