{ "info": { "name": "Posthaste API v1.0.0", "description": "Transactional email from our own MTA: mail is signed and delivered directly to recipient mail servers.\n\nAcceptance is not delivery. `POST /v1/emails` answers 202 once the message is durably stored and queued; the outcome arrives on a signed webhook or in the message log.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{apiKey}}", "type": "string" } ] }, "variable": [ { "key": "baseUrl", "value": "https://api.posthastemail.dev", "type": "string" }, { "key": "apiKey", "value": "", "type": "string" } ], "item": [ { "name": "Account", "item": [ { "name": "Change your own name", "request": { "method": "PATCH", "description": "Requires a signed-in session, acting on your own record — set your own name. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/profile", "host": ["{{baseUrl}}"], "path": ["v1", "profile"] }, "body": { "mode": "raw", "raw": "{\n \"name\": \"\"\n}" } } }, { "name": "Your account, plan and current sending allowance", "request": { "method": "GET", "description": "Requires an API key with `account:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/me", "host": ["{{baseUrl}}"], "path": ["v1", "me"] } } }, { "name": "Current usage against your allowance", "request": { "method": "GET", "description": "Requires an API key with `account:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/usage", "host": ["{{baseUrl}}"], "path": ["v1", "usage"] } } }, { "name": "Whether the delivery record is intact", "request": { "method": "GET", "description": "The same verdict as `/v1/audit/verify`, in the older, narrower shape: `intact`, `brokenAt`, `problem`. Reachable with `account:read` because it returns no part of the log itself.\n\nRequires an API key with `account:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/account/verify", "host": ["{{baseUrl}}"], "path": ["v1", "account", "verify"] } } }, { "name": "Rename the account", "request": { "method": "PATCH", "description": "Requires a signed-in person with the **admin** role or higher — rename the account. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/account", "host": ["{{baseUrl}}"], "path": ["v1", "account"] }, "body": { "mode": "raw", "raw": "{\n \"name\": \"Your Company\"\n}" } } }, { "name": "Request account deletion", "request": { "method": "POST", "description": "Right to erasure. Scheduled rather than immediate, so it can be cancelled.\n\nRequires a signed-in person with the **owner** role or higher — delete the account. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/account/deletion", "host": ["{{baseUrl}}"], "path": ["v1", "account", "deletion"] } } }, { "name": "Status of a deletion request", "request": { "method": "GET", "description": "Requires a signed-in session, acting on your own record — see whether a deletion is scheduled. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/account/deletion", "host": ["{{baseUrl}}"], "path": ["v1", "account", "deletion"] } } }, { "name": "Cancel a deletion request", "request": { "method": "DELETE", "description": "Requires a signed-in person with the **owner** role or higher — cancel a scheduled deletion. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/account/deletion", "host": ["{{baseUrl}}"], "path": ["v1", "account", "deletion"] } } } ] }, { "name": "Alerts", "item": [ { "name": "List alert rules", "request": { "method": "GET", "description": "Every threshold on the account, with the live firing state and the last measurement. Also returns the vocabulary — the available kinds, their units and their defaults — so a client never has to hard-code them.\n\nRequires an API key with `alerts:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/alerts/rules", "host": ["{{baseUrl}}"], "path": ["v1", "alerts", "rules"] } } }, { "name": "Create an alert rule", "request": { "method": "POST", "description": "With a body, creates one rule. With NO body, creates the default set for every kind — which is the \"switch alerting on\" call, because picking four thresholds before you have ever seen one fire is guesswork.\n\nOne rule per kind: a second one answers 409. Two rules watching one signal would mean two emails about it, which is the failure alerting exists to avoid.\n\n`threshold` is a fraction for the rate kinds (`0.003` is 0.3%) and a count for `dns_drift`. It is refused above the point at which the account would be suspended for the same numbers, since an alert that can only arrive after the suspension is not an alert.\n\nRequires an API key with `alerts:write`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/alerts/rules", "host": ["{{baseUrl}}"], "path": ["v1", "alerts", "rules"] }, "body": { "mode": "raw", "raw": "{\n \"kind\": \"complaint_rate\",\n \"threshold\": 0.003,\n \"windowDays\": 7\n}" } } }, { "name": "Change a threshold, a channel, or switch a rule off", "request": { "method": "PATCH", "description": "Editing a rule never re-arms it. An alert that is currently firing stays firing, and raising the threshold while it is open is not a way to be told about it a second time.\n\nRequires an API key with `alerts:write`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/alerts/rules/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "alerts", "rules", "{id}"] }, "body": { "mode": "raw", "raw": "{\n \"threshold\": 0.005,\n \"notifyEmail\": false\n}" } } }, { "name": "Stop watching a signal", "request": { "method": "DELETE", "description": "Requires an API key with `alerts:write`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/alerts/rules/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "alerts", "rules", "{id}"] } } }, { "name": "What has fired, and where it went", "request": { "method": "GET", "description": "Newest first, keyset-paginated. Each row carries the value and the threshold AS THEY STOOD, not as they are now, plus which channels the notice was delivered on — so \"you never told us\" has an answer that survives somebody editing the rule afterwards.\n\nRequires an API key with `alerts:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/alerts/events", "host": ["{{baseUrl}}"], "path": ["v1", "alerts", "events"] } } } ] }, { "name": "API keys", "item": [ { "name": "List API keys", "request": { "method": "GET", "description": "Requires an API key with `account:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/api-keys", "host": ["{{baseUrl}}"], "path": ["v1", "api-keys"] } } }, { "name": "Mint an API key", "request": { "method": "POST", "description": "The secret is returned once and never again.\n\nRequires a signed-in person with the **admin** role or higher — mint an API key. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/api-keys", "host": ["{{baseUrl}}"], "path": ["v1", "api-keys"] }, "body": { "mode": "raw", "raw": "{\n \"name\": \"Production\",\n \"scopes\": [\n \"emails:send\",\n \"messages:read\"\n ]\n}" } } }, { "name": "Revoke an API key", "request": { "method": "DELETE", "description": "Requires a signed-in person with the **admin** role or higher — revoke an API key. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/api-keys/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "api-keys", "{id}"] } } } ] }, { "name": "Audit", "item": [ { "name": "Page the account audit log", "request": { "method": "GET", "description": "The append-only, hash-chained record of everything that has happened to this account’s mail, newest first. Each entry carries its own `hash` and `prevHash`, so a single row can be checked without downloading the whole log.\n\nDeliberately does NOT verify the chain: verification replays the entire history, and doing that per page would make paging cost more the longer you have been a customer. Use `/v1/audit/verify` for the verdict.\n\nRequires an API key with `messages:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/audit/events", "host": ["{{baseUrl}}"], "path": ["v1", "audit", "events"], "query": [ { "key": "limit", "value": "", "disabled": true }, { "key": "before", "value": "", "disabled": true }, { "key": "type", "value": "", "disabled": true }, { "key": "from", "value": "", "disabled": true }, { "key": "until", "value": "", "disabled": true } ] } } }, { "name": "Prove the audit chain is intact", "request": { "method": "GET", "description": "Replays every event on the account, in order, and reports the first break by sequence number. Answers 200 whether or not the record holds — a broken chain is evidence, not a server fault, and returning 5xx would make it look like a transient error worth retrying.\n\n`purgedThroughSeq` is non-zero when the oldest events have aged out of your plan’s retention window through the audited purge path. That is why a chain may legitimately start above 1.\n\nRequires an API key with `messages:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/audit/verify", "host": ["{{baseUrl}}"], "path": ["v1", "audit", "verify"] } } }, { "name": "Export the audit log as a file", "request": { "method": "GET", "description": "Streams the whole chain as newline-delimited JSON, oldest first, with a header record describing how the hash is constructed and a trailer record carrying the event count and the verdict.\n\n`payload` is the exact text the database hashed and `occurredAt` the exact timestamp string. Hash them as given — re-serialising the parsed JSON changes the bytes and fails verification on an untouched record.\n\nA file with no trailer record is INCOMPLETE. The response status is sent before the last row is read, so a failure mid-transfer can only truncate the download; the trailer is how you tell a whole export from half of one.\n\nRequires an API key with `messages:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/audit/export", "host": ["{{baseUrl}}"], "path": ["v1", "audit", "export"], "query": [ { "key": "from", "value": "", "disabled": true }, { "key": "until", "value": "", "disabled": true } ] } } } ] }, { "name": "Auth", "item": [ { "name": "Create an account", "request": { "method": "POST", "description": "No authentication: creates the first account.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/auth/signup", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "signup"] }, "body": { "mode": "raw", "raw": "{\n \"email\": \"recipient@example.com\",\n \"password\": \"\"\n}" }, "auth": { "type": "noauth" } } }, { "name": "Sign in", "request": { "method": "POST", "description": "No authentication: is how a session is obtained.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/auth/login", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "login"] }, "body": { "mode": "raw", "raw": "{\n \"email\": \"recipient@example.com\",\n \"password\": \"\"\n}" }, "auth": { "type": "noauth" } } }, { "name": "Sign out", "request": { "method": "POST", "description": "No authentication: must work even with a dead session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/logout", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "logout"] }, "auth": { "type": "noauth" } } }, { "name": "Who am I", "request": { "method": "GET", "description": "How the dashboard learns its auth state on boot; no token is readable from JavaScript.\n\nNo authentication: answers \"am I signed in\" for the dashboard on boot.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/me", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "me"] }, "auth": { "type": "noauth" } } }, { "name": "Begin Google sign-in", "request": { "method": "GET", "description": "No authentication: is how a session is obtained.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/google/start", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "google", "start"] }, "auth": { "type": "noauth" } } }, { "name": "Google sign-in callback", "request": { "method": "GET", "description": "No authentication: is how a session is obtained.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/google/callback", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "google", "callback"] }, "auth": { "type": "noauth" } } }, { "name": "Nonce for Google One Tap", "request": { "method": "GET", "description": "No authentication: is how a session is obtained.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/google/nonce", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "google", "nonce"] }, "auth": { "type": "noauth" } } }, { "name": "Sign in with a Google One Tap credential", "request": { "method": "POST", "description": "No authentication: is how a session is obtained.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/google/one-tap", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "google", "one-tap"] }, "auth": { "type": "noauth" } } }, { "name": "Begin passkey sign-in", "request": { "method": "POST", "description": "No authentication: is how a session is obtained.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/passkeys/login/options", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "passkeys", "login", "options"] }, "auth": { "type": "noauth" } } }, { "name": "Complete passkey sign-in", "request": { "method": "POST", "description": "No authentication: is how a session is obtained.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/passkeys/login/verify", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "passkeys", "login", "verify"] }, "auth": { "type": "noauth" } } }, { "name": "Request a password reset", "request": { "method": "POST", "description": "Answers the same way whether or not the address is known, so it cannot be used to test which addresses exist.\n\nNo authentication: is reached by somebody who has by definition failed to sign in.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/password/forgot", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "password", "forgot"] }, "auth": { "type": "noauth" } } }, { "name": "Set a new password with a reset token", "request": { "method": "POST", "description": "No header credential. A single-use token in the request body IS the credential, and it is reached from a mailbox.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/password/reset", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "password", "reset"] }, "auth": { "type": "noauth" } } }, { "name": "Verify an email address", "request": { "method": "POST", "description": "No header credential. A single-use token in the request body IS the credential, and it is reached from a mailbox.", "header": [], "url": { "raw": "{{baseUrl}}/v1/auth/verify-email", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "verify-email"] }, "auth": { "type": "noauth" } } }, { "name": "Change your password", "request": { "method": "POST", "description": "Requires a signed-in session, acting on your own record — change your own password. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/password/change", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "password", "change"] } } }, { "name": "Resend the verification email", "request": { "method": "POST", "description": "Requires a signed-in session, acting on your own record — resend your own confirmation. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/verify-email/send", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "verify-email", "send"] } } }, { "name": "List your active sessions", "request": { "method": "GET", "description": "Requires a signed-in session, acting on your own record — list your own sessions. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/sessions", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "sessions"] } } }, { "name": "Sign out everywhere else", "request": { "method": "POST", "description": "Requires a signed-in session, acting on your own record — sign your other devices out. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/sessions/revoke-others", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "sessions", "revoke-others"] } } }, { "name": "Begin TOTP enrolment", "request": { "method": "POST", "description": "Requires a signed-in session, acting on your own record — enrol your own authenticator. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/2fa/setup", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "2fa", "setup"] } } }, { "name": "Enable TOTP", "request": { "method": "POST", "description": "Requires a signed-in session, acting on your own record — enrol your own authenticator. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/2fa/enable", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "2fa", "enable"] } } }, { "name": "Disable TOTP", "request": { "method": "POST", "description": "Requires a signed-in session, acting on your own record — remove your own authenticator. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/2fa/disable", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "2fa", "disable"] } } }, { "name": "List your registered passkeys", "request": { "method": "GET", "description": "Requires a signed-in session, acting on your own record — list your own passkeys. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/passkeys", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "passkeys"] } } }, { "name": "Begin registering a passkey", "request": { "method": "POST", "description": "Requires a signed-in session, acting on your own record — add your own passkey. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/passkeys/register/options", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "passkeys", "register", "options"] } } }, { "name": "Finish registering a passkey", "request": { "method": "POST", "description": "Requires a signed-in session, acting on your own record — add your own passkey. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/passkeys/register/verify", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "passkeys", "register", "verify"] } } }, { "name": "Remove a passkey", "request": { "method": "DELETE", "description": "Requires a signed-in session, acting on your own record — remove your own passkey. Deliberately not role-gated, because the row being changed is the caller’s own.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/auth/passkeys/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "auth", "passkeys", "{id}"] } } } ] }, { "name": "Billing", "item": [ { "name": "Payment provider webhook", "request": { "method": "POST", "description": "Authenticated by the provider signature over the RAW body, so it cannot be re-signed from a parsed copy.\n\nNo header credential. The caller is a payment or mail provider and is authenticated by its signature over the RAW request body — so this operation cannot be re-signed from a parsed copy.", "header": [], "url": { "raw": "{{baseUrl}}/v1/billing/{provider}/webhook", "host": ["{{baseUrl}}"], "path": ["v1", "billing", "{provider}", "webhook"] }, "auth": { "type": "noauth" } } }, { "name": "Subscription and plan", "request": { "method": "GET", "description": "Requires an API key with `billing:read` or `account:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/billing", "host": ["{{baseUrl}}"], "path": ["v1", "billing"] } } }, { "name": "Billing history", "request": { "method": "GET", "description": "Requires an API key with `billing:read` or `account:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/billing/history", "host": ["{{baseUrl}}"], "path": ["v1", "billing", "history"] } } }, { "name": "List invoices", "request": { "method": "GET", "description": "Requires an API key with `billing:read` or `account:read` (checked via `canReadBilling`), or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/billing/invoices", "host": ["{{baseUrl}}"], "path": ["v1", "billing", "invoices"] } } }, { "name": "Download an invoice", "request": { "method": "GET", "description": "Requires an API key with `billing:read` or `account:read` (checked via `canReadBilling`), or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/billing/invoices/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "billing", "invoices", "{id}"] } } }, { "name": "Start a checkout", "request": { "method": "POST", "description": "Requires a signed-in person with the **admin** role or higher — start a checkout. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/billing/checkout", "host": ["{{baseUrl}}"], "path": ["v1", "billing", "checkout"] }, "body": { "mode": "raw", "raw": "{\n \"plan\": \"starter\",\n \"interval\": \"month\",\n \"profile\": {\n \"country\": \"IN\",\n \"legalName\": \"Your Company Pvt Ltd\"\n }\n}" } } }, { "name": "Abandon a checkout in progress", "request": { "method": "POST", "description": "Requires a signed-in person with the **admin** role or higher — abandon a checkout. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/billing/checkout/abandon", "host": ["{{baseUrl}}"], "path": ["v1", "billing", "checkout", "abandon"] } } }, { "name": "Cancel the subscription at period end", "request": { "method": "POST", "description": "Requires a signed-in person with the **admin** role or higher — cancel the plan. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/billing/cancel", "host": ["{{baseUrl}}"], "path": ["v1", "billing", "cancel"] } } }, { "name": "Pause the subscription", "request": { "method": "POST", "description": "Requires a signed-in person with the **admin** role or higher — pause the plan. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/billing/pause", "host": ["{{baseUrl}}"], "path": ["v1", "billing", "pause"] } } }, { "name": "Resume a paused subscription", "request": { "method": "POST", "description": "Requires a signed-in person with the **admin** role or higher — resume the plan. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/billing/resume", "host": ["{{baseUrl}}"], "path": ["v1", "billing", "resume"] } } }, { "name": "Set the legal name and tax id printed on invoices", "request": { "method": "PATCH", "description": "Requires a signed-in person with the **admin** role or higher — change the billing details. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/billing/profile", "host": ["{{baseUrl}}"], "path": ["v1", "billing", "profile"] } } } ] }, { "name": "Deliverability", "item": [ { "name": "Delivery rate and time to inbox, by receiving domain or by tag", "request": { "method": "GET", "description": "Answers \"is Outlook slower than Gmail for our mail\". Returns the delivery rate and the p50/p95 time to inbox for each receiving domain, or for each of your own tags, over a window you choose.\n\nTime to inbox is measured between two events on the message: `accepted`, when it entered the delivery queue, and `delivered`, when the receiving mail server accepted it. It does not include what that server does afterwards, which no sender can observe.\n\nA rate with nothing settled behind it and a percentile with no delivered message behind it are both `null`, never `0`. Every row carries the number of messages its percentiles were computed from.\n\nRequires an API key with `analytics:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/analytics/delivery", "host": ["{{baseUrl}}"], "path": ["v1", "analytics", "delivery"], "query": [ { "key": "days", "value": "", "disabled": true }, { "key": "groupBy", "value": "", "disabled": true }, { "key": "stream", "value": "", "disabled": true }, { "key": "tag", "value": "", "disabled": true }, { "key": "limit", "value": "", "disabled": true }, { "key": "cursor", "value": "", "disabled": true } ] } } }, { "name": "Who is sending as your domains, and whether it aligns", "request": { "method": "GET", "description": "Summarises the DMARC aggregate reports receiving providers send back about your domains, grouped by the IP that sent the mail and ranked by volume.\n\n`messages` is the volume the reporters accounted for, summed from each report row's own count — not a number of rows, since a single row can stand for millions of messages. A message counts as aligned when SPF **or** DKIM aligned with the From domain, which is what DMARC itself requires; a mechanism that passed for some unrelated domain does not count.\n\nA source with volume and no alignment is either a legitimate sender you have forgotten about or somebody spoofing you. The two are indistinguishable from here, so this reports what the receivers observed and leaves that judgement to you.\n\n`alignmentRate` is `null` rather than `0` when no reports have arrived yet, because \"nothing reported\" and \"everything failed\" are opposite situations.\n\nRequires an API key with `analytics:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/analytics/dmarc", "host": ["{{baseUrl}}"], "path": ["v1", "analytics", "dmarc"], "query": [ { "key": "days", "value": "", "disabled": true }, { "key": "domain", "value": "", "disabled": true } ] } } } ] }, { "name": "Domains", "item": [ { "name": "List sending domains", "request": { "method": "GET", "description": "Requires an API key with `domains:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/domains", "host": ["{{baseUrl}}"], "path": ["v1", "domains"] } } }, { "name": "Add a sending domain", "request": { "method": "POST", "description": "Returns the DNS records to publish. Mail cannot be sent until it verifies.\n\nRequires an API key with `domains:write`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/domains", "host": ["{{baseUrl}}"], "path": ["v1", "domains"] }, "body": { "mode": "raw", "raw": "{\n \"name\": \"mail.your-company.com\"\n}" } } }, { "name": "Remove a domain", "request": { "method": "DELETE", "description": "Requires an API key with `domains:write`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/domains/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "domains", "{id}"] } } }, { "name": "Check the DNS records now", "request": { "method": "POST", "description": "Requires an API key with `domains:write`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/domains/{id}/verify", "host": ["{{baseUrl}}"], "path": ["v1", "domains", "{id}", "verify"] } } }, { "name": "The DNS records to publish", "request": { "method": "GET", "description": "Requires an API key with `domains:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/domains/{id}/setup", "host": ["{{baseUrl}}"], "path": ["v1", "domains", "{id}", "setup"] } } }, { "name": "Publish the records via a connected Cloudflare account", "request": { "method": "POST", "description": "Requires an API key with `domains:write`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/domains/{id}/cloudflare", "host": ["{{baseUrl}}"], "path": ["v1", "domains", "{id}", "cloudflare"] } } }, { "name": "Disconnect Cloudflare", "request": { "method": "DELETE", "description": "Requires an API key with `domains:write`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/account/cloudflare", "host": ["{{baseUrl}}"], "path": ["v1", "account", "cloudflare"] } } } ] }, { "name": "Emails", "item": [ { "name": "Send an email", "request": { "method": "POST", "description": "Accepts a message, stores it durably, and queues it for delivery. Returns 202 with the message id — acceptance is not delivery, and the delivery outcome arrives on the webhook or in the message log.\n\nSupply `html`/`text`, or a `template` with `variables`. A missing required template variable is a refusal, not a blank: rendering fails and nothing is sent.\n\nRequires an API key with `emails:send`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/emails", "host": ["{{baseUrl}}"], "path": ["v1", "emails"] }, "body": { "mode": "raw", "raw": "{\n \"from\": \"you@your-verified-domain.com\",\n \"to\": \"recipient@example.com\",\n \"subject\": \"Your password reset\",\n \"text\": \"Use the link below to choose a new password.\",\n \"html\": \"

Use the link below to choose a new password.

\"\n}" } } }, { "name": "Send up to 100 emails in one call", "request": { "method": "POST", "description": "Partial success is the contract: each item succeeds or fails on its own and one bad recipient never fails the batch. Each item commits independently, so an accepted message stays accepted whatever happens to the rest.\n\nRequires an API key with `emails:send`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/emails/batch", "host": ["{{baseUrl}}"], "path": ["v1", "emails", "batch"] }, "body": { "mode": "raw", "raw": "{\n \"messages\": [\n {\n \"from\": \"you@your-verified-domain.com\",\n \"to\": \"recipient@example.com\",\n \"subject\": \"Your receipt\",\n \"text\": \"Thanks — your receipt is attached.\"\n }\n ]\n}" } } }, { "name": "Cancel a scheduled message", "request": { "method": "DELETE", "description": "Requires an API key with `emails:send`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/emails/{id}/schedule", "host": ["{{baseUrl}}"], "path": ["v1", "emails", "{id}", "schedule"] } } } ] }, { "name": "Inbound", "item": [ { "name": "List inbound addresses", "request": { "method": "GET", "description": "Requires an API key with `domains:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/inbound/addresses", "host": ["{{baseUrl}}"], "path": ["v1", "inbound", "addresses"] } } }, { "name": "Create an inbound address", "request": { "method": "POST", "description": "Requires an API key with `domains:write`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/inbound/addresses", "host": ["{{baseUrl}}"], "path": ["v1", "inbound", "addresses"] }, "body": { "mode": "raw", "raw": "{\n \"address\": \"support@mail.your-company.com\"\n}" } } }, { "name": "Delete an inbound address", "request": { "method": "DELETE", "description": "Requires an API key with `domains:write`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/inbound/addresses/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "inbound", "addresses", "{id}"] } } }, { "name": "List received messages", "request": { "method": "GET", "description": "Requires an API key with `messages:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/inbound/messages", "host": ["{{baseUrl}}"], "path": ["v1", "inbound", "messages"] } } }, { "name": "Fetch a received message", "request": { "method": "GET", "description": "HTML is sanitised on the way out, without exception.\n\nRequires an API key with `messages:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/inbound/messages/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "inbound", "messages", "{id}"] } } }, { "name": "Delete a received message", "request": { "method": "DELETE", "description": "Requires an API key with `domains:write`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/inbound/messages/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "inbound", "messages", "{id}"] } } } ] }, { "name": "Messages", "item": [ { "name": "List messages", "request": { "method": "GET", "description": "Filterable by status, tag, stream, recipient domain, metadata and date. Repeated `tag` parameters are ANDed.\n\nRequires an API key with `messages:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/messages", "host": ["{{baseUrl}}"], "path": ["v1", "messages"], "query": [ { "key": "limit", "value": "", "disabled": true }, { "key": "before", "value": "", "disabled": true }, { "key": "status", "value": "", "disabled": true }, { "key": "to", "value": "", "disabled": true }, { "key": "search", "value": "", "disabled": true }, { "key": "domain", "value": "", "disabled": true }, { "key": "stream", "value": "", "disabled": true }, { "key": "tag", "value": "", "disabled": true }, { "key": "metadata", "value": "", "disabled": true }, { "key": "from", "value": "", "disabled": true }, { "key": "until", "value": "", "disabled": true } ] } } }, { "name": "Stream message events as they happen", "request": { "method": "GET", "description": "A Server-Sent Events stream of the same events the message log holds, delivered as they are written. Nothing polls: the connection is idle until an event lands.\n\nEach `message` event carries the account `seq` as its SSE id. Reconnect with `Last-Event-ID` (browsers send it automatically) or `?after=` and everything after that position is replayed, so a dropped connection loses nothing.\n\nA `ready` event opens the stream, `heartbeat` arrives every 15 seconds, and `bye` says why we closed. The stream is closed after 15 minutes with no message event; reconnect and resume. Five concurrent tails per account — a sixth is refused with `too_many_streams`.\n\nRequires an API key with `messages:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/messages/tail", "host": ["{{baseUrl}}"], "path": ["v1", "messages", "tail"], "query": [ { "key": "status", "value": "", "disabled": true }, { "key": "stream", "value": "", "disabled": true }, { "key": "tag", "value": "", "disabled": true }, { "key": "replay", "value": "", "disabled": true }, { "key": "after", "value": "", "disabled": true } ] } } }, { "name": "Fetch one message", "request": { "method": "GET", "description": "Requires an API key with `messages:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/messages/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "messages", "{id}"] } } }, { "name": "Download an attachment", "request": { "method": "GET", "description": "Served `Content-Disposition: attachment` — never rendered inline on our origin, whatever the declared content type.\n\nRequires an API key with `messages:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/messages/{id}/attachments/{attachmentId}", "host": ["{{baseUrl}}"], "path": ["v1", "messages", "{id}", "attachments", "{attachmentId}"] } } }, { "name": "Message counts over time", "request": { "method": "GET", "description": "Requires an API key with `messages:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/stats/messages", "host": ["{{baseUrl}}"], "path": ["v1", "stats", "messages"], "query": [ { "key": "days", "value": "", "disabled": true }, { "key": "domain", "value": "", "disabled": true }, { "key": "tz", "value": "", "disabled": true } ] } } } ] }, { "name": "Other", "item": [ { "name": "This document", "request": { "method": "GET", "description": "Served from the running server, so it always describes the API you are calling.\n\nNo authentication: describes only the public API, which is equally discoverable by trying it.", "header": [], "url": { "raw": "{{baseUrl}}/v1/openapi.json", "host": ["{{baseUrl}}"], "path": ["v1", "openapi.json"] }, "auth": { "type": "noauth" } } }, { "name": "Contact-form enquiry", "request": { "method": "POST", "description": "Requires the platform account's own key: the marketing contact form.", "header": [], "url": { "raw": "{{baseUrl}}/v1/leads", "host": ["{{baseUrl}}"], "path": ["v1", "leads"] } } } ] }, { "name": "Streams", "item": [ { "name": "List message streams", "request": { "method": "GET", "description": "Requires an API key with `streams:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/streams", "host": ["{{baseUrl}}"], "path": ["v1", "streams"] } } }, { "name": "Create a message stream", "request": { "method": "POST", "description": "Streams separate suppression scope and statistics, so a complaint on one stream can never suppress a password reset on another.\n\nRequires an API key with `streams:write`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/streams", "host": ["{{baseUrl}}"], "path": ["v1", "streams"] }, "body": { "mode": "raw", "raw": "{\n \"slug\": \"broadcast\",\n \"name\": \"Broadcast\"\n}" } } } ] }, { "name": "Sub-accounts", "item": [ { "name": "List the accounts you pay for", "request": { "method": "GET", "description": "Returns what a payer is entitled to know — name, status and volume this month. Never the sub-account’s mail, domains or suppressions: the billing relationship is not a window into its data.\n\nRequires an API key with `account:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/sub-accounts", "host": ["{{baseUrl}}"], "path": ["v1", "sub-accounts"] } } }, { "name": "Create a sub-account", "request": { "method": "POST", "description": "A fully isolated account with its own domains, keys and suppression list, billed to you and sharing your monthly allowance. It inherits your plan and cannot hold a subscription of its own.\n\nRequires a signed-in person with the **admin** role or higher — add an account to the bill. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/sub-accounts", "host": ["{{baseUrl}}"], "path": ["v1", "sub-accounts"] }, "body": { "mode": "raw", "raw": "{\n \"name\": \"Acme Ltd\"\n}" } } }, { "name": "One sub-account’s standing", "request": { "method": "GET", "description": "Requires an API key with `account:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/sub-accounts/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "sub-accounts", "{id}"] } } } ] }, { "name": "Suppressions", "item": [ { "name": "List suppressed addresses", "request": { "method": "GET", "description": "Every entry carries its cause: the reason, the receiving server’s own words, its status code, and the message whose bounce or complaint caused it. An entry added by hand has no causing message, and neither has one whose message has since aged out of retention.\n\nRequires an API key with `suppressions:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/suppressions", "host": ["{{baseUrl}}"], "path": ["v1", "suppressions"], "query": [ { "key": "limit", "value": "", "disabled": true }, { "key": "before", "value": "", "disabled": true }, { "key": "search", "value": "", "disabled": true }, { "key": "reason", "value": "", "disabled": true } ] } } }, { "name": "Suppress an address", "request": { "method": "POST", "description": "Requires an API key with `suppressions:write`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/suppressions", "host": ["{{baseUrl}}"], "path": ["v1", "suppressions"] }, "body": { "mode": "raw", "raw": "{\n \"address\": \"recipient@example.com\",\n \"reason\": \"manual\"\n}" } } }, { "name": "Remove a suppression", "request": { "method": "DELETE", "description": "Removes a `manual` or `unsubscribe` entry. A hard bounce cannot be removed this way (422 suppression_hard_bounce): re-sending to an address that does not exist is what costs a sender its reputation, and a genuinely stale one is lifted by support after review. A complaint or spam trap can never be removed at all (422 suppression_protected).\n\nRequires an API key with `suppressions:write`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/suppressions/{address}", "host": ["{{baseUrl}}"], "path": ["v1", "suppressions", "{address}"] } } } ] }, { "name": "Team", "item": [ { "name": "Accept an invitation", "request": { "method": "POST", "description": "Sets the password and verifies the address. Does not sign you in.\n\nNo header credential. A single-use token in the request body IS the credential, and it is reached from a mailbox.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/team/invites/accept", "host": ["{{baseUrl}}"], "path": ["v1", "team", "invites", "accept"] }, "body": { "mode": "raw", "raw": "{\n \"token\": \"\",\n \"password\": \"\"\n}" }, "auth": { "type": "noauth" } } }, { "name": "List members and pending invitations", "request": { "method": "GET", "description": "Requires an API key with `team:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/team", "host": ["{{baseUrl}}"], "path": ["v1", "team"] } } }, { "name": "Invite somebody", "request": { "method": "POST", "description": "Requires a signed-in person with the **admin** role or higher — invite a colleague. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/team/invites", "host": ["{{baseUrl}}"], "path": ["v1", "team", "invites"] }, "body": { "mode": "raw", "raw": "{\n \"email\": \"recipient@example.com\",\n \"role\": \"owner\"\n}" } } }, { "name": "Change a member's role", "request": { "method": "PATCH", "description": "The person is signed out everywhere, because their permissions changed.\n\nRequires a signed-in person with the **admin** role or higher — change a colleague's role. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/team/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "team", "{id}"] }, "body": { "mode": "raw", "raw": "{\n \"role\": \"owner\"\n}" } } }, { "name": "Remove somebody from the account", "request": { "method": "DELETE", "description": "The last owner cannot be removed — an account with no owner has nobody who can administer it.\n\nRequires a signed-in person with the **admin** role or higher — remove a colleague. NOT reachable with an API key: this is an action where a leaked server-side credential would be catastrophic.", "header": [ { "key": "X-Note", "value": "Requires a browser session, not an API key", "disabled": true } ], "url": { "raw": "{{baseUrl}}/v1/team/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "team", "{id}"] } } } ] }, { "name": "Templates", "item": [ { "name": "List templates", "request": { "method": "GET", "description": "Requires an API key with `templates:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/templates", "host": ["{{baseUrl}}"], "path": ["v1", "templates"] } } }, { "name": "Create a template", "request": { "method": "POST", "description": "Requires an API key with `templates:write`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/templates", "host": ["{{baseUrl}}"], "path": ["v1", "templates"] }, "body": { "mode": "raw", "raw": "{}" } } }, { "name": "Fetch a template", "request": { "method": "GET", "description": "Requires an API key with `templates:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/templates/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "templates", "{id}"] } } }, { "name": "Edit a template, publishing a new version", "request": { "method": "PATCH", "description": "A published version is immutable. Editing content publishes the next version and leaves the previous one byte-identical, so a send can always be traced to the exact content that went out.\n\nRequires an API key with `templates:write`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/templates/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "templates", "{id}"] }, "body": { "mode": "raw", "raw": "{}" } } }, { "name": "Delete a template", "request": { "method": "DELETE", "description": "Requires an API key with `templates:write`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/templates/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "templates", "{id}"] } } }, { "name": "List template versions", "request": { "method": "GET", "description": "Requires an API key with `templates:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/templates/{id}/versions", "host": ["{{baseUrl}}"], "path": ["v1", "templates", "{id}", "versions"] } } }, { "name": "Render a template without sending", "request": { "method": "POST", "description": "Returns the rendered HTML and text for sample variables, and reports the same refusals a send would — so a preview cannot pass where the send fails.\n\nRequires an API key with `templates:read`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/templates/{id}/preview", "host": ["{{baseUrl}}"], "path": ["v1", "templates", "{id}", "preview"] }, "body": { "mode": "raw", "raw": "{}" } } }, { "name": "Render content without saving it", "request": { "method": "POST", "description": "Renders what you supply rather than what you have published, so an editor can show a template before it exists. Reports the same refusals and the same lint a send would, and stores nothing.\n\nRequires an API key with `templates:read`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/templates/preview", "host": ["{{baseUrl}}"], "path": ["v1", "templates", "preview"] }, "body": { "mode": "raw", "raw": "{\n \"subject\": \"Welcome to {{company}}\",\n \"html\": \"

Hi {{first_name}}, your account is ready.

\",\n \"variables\": [\n {\n \"name\": \"company\"\n },\n {\n \"name\": \"first_name\"\n }\n ],\n \"values\": {\n \"company\": \"Acme Ltd\",\n \"first_name\": \"Ada\"\n }\n}" } } } ] }, { "name": "Webhooks", "item": [ { "name": "List webhook endpoints", "request": { "method": "GET", "description": "Requires an API key with `webhooks:read`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/webhooks", "host": ["{{baseUrl}}"], "path": ["v1", "webhooks"] } } }, { "name": "Create a webhook endpoint", "request": { "method": "POST", "description": "Deliveries are signed; verify the signature before trusting a payload. Retried with backoff and idempotent on redelivery.\n\nRequires an API key with `webhooks:write`, or a signed-in session.", "header": [ { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/v1/webhooks", "host": ["{{baseUrl}}"], "path": ["v1", "webhooks"] }, "body": { "mode": "raw", "raw": "{\n \"url\": \"https://example.com/hook\"\n}" } } }, { "name": "Delete a webhook endpoint", "request": { "method": "DELETE", "description": "Requires an API key with `webhooks:write`, or a signed-in session.", "header": [], "url": { "raw": "{{baseUrl}}/v1/webhooks/{id}", "host": ["{{baseUrl}}"], "path": ["v1", "webhooks", "{id}"] } } } ] } ] }