Every request returns 401
401POST /authenticate returns a token that already includes the Bearer prefix. Use it as the whole Authorization header value. Adding a second Bearer produces a 401 that looks exactly like bad credentials.
400 on a request that looks correct
400 on a request that looks correctCheck whether you combined listingId or bookingCode with readState or a date filter — that combination is rejected. Also check that dateFrom or dateTo is accompanied by dateType.
A conversation I can see in the inbox returns 404
404The conversation belongs to a different host than the token's. Conversations are scoped to the authenticated host on every route.
unreadMessages never reaches zero
unreadMessages never reaches zerounreadMessages counts messages addressed to the host that have no viewed date. Replying clears the ones a reply can clear; a message that Plum has hidden for policy reasons is skipped and can leave a residual count.
An attachment download returns 404
404Use the fileName from the send response, not the original file name, and the messageId the attachment was sent on.