This API was implemented to be used internally by the XNAT Pipeline Engine. It could easily be abused as a phishing vector. XNAT Admins are strongly encouraged to restrict the list of IPs that are allowed to send emails using this REST endpoint. The only IPs that should be allowed are the host IP of the XNAT application and the IP of any machine or processing cluster where pipelines are executed. See https://flywheelio.atlassian.net/wiki/spaces/XNAT17/pages/2507544593
Send Email From XNAT To User
Simple email headers and body must be included in the body of the POST. All of the parameters specified below can be grouped into a single text file, separated by '&' characters, or submitted as a JSON object.
POST - /data/services/mail/send
|to||Required body parameter. Must contain a valid email account that matches a user account in XNAT|
|subject||Required body parameter|
|text||Optional body parameter. Contains a plain-text version of your email body copy.|
|html||Optional body parameter. Contains an HTML-formatted version of your email body copy.|
By default, the "From" field will be populated with the XNAT Site Administrator's email address.