If you click on the Property name in that screen in the UI it will expand and show you the at_property code. I know before the activity will run on a website it checks to make sure that at_property = xyz123etc is in the site code. In that regards I'm not an IO pro however I'm guessing it's expecting that you will pass that at_property somewhere in that call before it will reply with the content. Let me know if this helps. If it does please like, mark as helpful and mark as answer. Otherwise lets keep the conversation going. Hope you have a wonderful day.
Ideally there should not be a need to add the property code while running an API and the content of the mbox should be getting returned. Did you try passing a valid session id in the API request to check if it makes any difference?
If this doesn't work please open a ticket with support and we will help you look into it further.
Thanks for your response, my first thoughts were the same as yours that the POST request would need the at_property. The problem is that I have studied the I/O documentation from end to end and it has no mention of passing an at_property.
Unfortunately I don't have access to the global property to test this theory, any help massively appreciated.