The Sendmux Management API gives you programmatic access to your email infrastructure: read providers, metrics, and delivery logs; manage domains, mailboxes, API keys, and webhook subscriptions; track billing balance and history. Use it to build monitoring dashboards, automate provisioning, and integrate Sendmux into your own back-office tooling.Documentation Index
Fetch the complete documentation index at: https://docs.sendmux.ai/llms.txt
Use this file to discover all available pages before exploring further.
Base URL
All API requests should be made to:Authentication
Authenticate using an API key from the Sendmux app. Pass it as a Bearer token in theAuthorization header.
Permissions
Each endpoint requires a specific permission. Keys with wildcard permissions (e.g.domain.*) satisfy any permission in that namespace, and the built-in root:full role includes every wildcard.
| Endpoint group | Required permission(s) |
|---|---|
| Providers | provider.read |
| Email metrics | analytics.read |
| Email logs | logs.read |
| Billing | billing.read |
| Domains | domain.read for reads; domain.create, domain.verify, domain.delete for the matching mutations. |
| Mailboxes | mailbox.admin.read for reads; mailbox.admin.create for create; mailbox.admin.delete for delete; mailbox.admin.manage for update, filter management, and per-mailbox API-key management. |
| Webhooks | webhook.read for reads; webhook.create, webhook.update, webhook.delete for the matching mutations; webhook.manage for rotate-secret and test. |
Response format
All responses use a consistent JSON envelope.Success
Paginated success
List endpoints include apagination object alongside data.
Error
retryable flag distinguishes transient failures (back off and retry) from permanent ones (fix the request). See the errors reference for the full envelope shape, the accumulated errors[] array on validation failures, and the Retry-After header semantics for 429/503.
Errors
| HTTP status | Error code | Default retryable | Description |
|---|---|---|---|
| 400 | invalid_parameter | false | Bad query parameter format or syntactic body validation failure. |
| 400 | missing_parameter | false | Required parameter missing. |
| 401 | authentication_required | false | No or invalid API key. |
| 403 | insufficient_permissions | false | Key lacks required permission. |
| 404 | not_found | false | Resource does not exist or belongs to a different team. |
| 409 | conflict | false | Resource state forbids the operation (e.g. If-Match mismatch). |
| 409 | idempotency_conflict | false | Idempotency-Key reused with a different body or while in-flight. |
| 413 | payload_too_large | false | Request body exceeds the server-side size limit. |
| 422 | validation_error | false | Body parsed but violates a semantic rule. |
| 429 | rate_limit_exceeded | true | Rate limit hit. Retry-After header included. |
| 500 | internal_error | true | Unexpected server error. |
| 503 | service_unavailable | true | Downstream component briefly unavailable. May include Retry-After. |
Rate limiting
Each API key is rate-limited to 600 requests per minute. Rate limit headers are included on every response:429 status with a Retry-After header.
Conventions
- snake_case fields in all JSON responses
- UTC ISO 8601 timestamps in RFC 3339 format:
2026-03-19T10:30:00Z - Public IDs only — internal database IDs are never exposed
Cache-Control: no-storeon all responses- JSON only —
Content-Type: application/json