API key administration
Canonical request fields, permissions, and MCP coverage generated from the Sendbound API.
This page uses the same generated contract as the OpenAPI download and remote MCP server. Project API keys never grant access to another project's resources. See the inbound guide for receiving setup, webhook payloads, signatures, retries, and attachments.
This reference is generated from the API’s routes and request validators. Download the OpenAPI specification. JSON bodies go directly to the API; MCP tools use a body object and a query object.
Generated request examples contain placeholders. Replace addresses, URLs, resource IDs and other placeholder values before sending. Conditional rules and refinements are enforced by the API at runtime.
/api-keyslist (api-keys)
Authentication: Dashboard user session; API keys cannot perform this account/security operation.
MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.
| Parameter | Location | Required | Type |
|---|---|---|---|
X-Project-Id | header | No | string |
Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.
Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.
/api-keyscreate (api-keys)
Authentication: Dashboard user session; API keys cannot perform this account/security operation.
MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.
| Parameter | Location | Required | Type |
|---|---|---|---|
X-Project-Id | header | No | string |
Request body: application/json
| Field | Required | Type / constraints |
|---|---|---|
name | Yes | string |
Complete request JSON Schema
{
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 64
}
},
"required": [
"name"
],
"additionalProperties": false
}Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.
Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.
/api-keys/usageusage (api-keys)
Authentication: Dashboard user session; API keys cannot perform this account/security operation.
MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.
| Parameter | Location | Required | Type |
|---|---|---|---|
X-Project-Id | header | No | string |
Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.
Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.
/api-keys/:idrevoke (api-keys)
Authentication: Dashboard user session; API keys cannot perform this account/security operation.
MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.
| Parameter | Location | Required | Type |
|---|---|---|---|
id | path | Yes | string |
X-Project-Id | header | No | string |
Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.
Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.