Create Browser Enrollment

Attach a browser enrollment intent to the inbox. Requires `api_key_create`. Before submitting `transaction_jti`, independently verify that the browser page's final origin is exactly `https://auth.agentid.com`. This endpoint is available to every organization using US production. It is not available in EU production. Select `inbox_id` from trusted AgentMail configuration. An AgentID `login_hint` is not authoritative for selecting the inbox; when the transaction includes one, it must match the path inbox. **AgentMail API keys are sent only to `https://api.agentmail.to`; AgentID never requests them.** A new intent returns `202`; an idempotent retry for the same pending transaction, inbox, and bearer key returns `200` with the same receipt. An intent lasts at most five minutes. An activated credential lasts at most 30 days and cannot outlive its authorizing bearer API key. Creation is limited to 20 intents per bearer API key per hour, 100 per organization per hour, and five live unused intents per bearer API key. Browser activation is separately limited to 20 activations per authorizing bearer API key per UTC day. Either kind of limit can return `429`; honor the `Retry-After` header. Cancelling an enrollment releases its live-intent slot but does not reset the daily activation counter.