To fix access to the curl API, you need to add a TOTP header, something like:
TOTP="X-Auth-Token: $(oathtool --totp -b -d 6 $TOTP_KEY)"
curl -H "$TOTP" ... rest of curl command
I stole this from this topic. The TOTP_KEY can be found in the mailinabox database under $STORAGE_ROOT/mail/users.sqlite