Coverage and permissions
Every backend route, its authentication boundary, and whether it is available to MCP.
Secret API keys act only within their project. Account ownership, membership, billing, identity-provider configuration, and API-key administration retain dashboard-session authorization. Provider callbacks use their own authentication.
Third-party import credentials must not be pasted into AI tool arguments. Use the authenticated integration setup/API for those operations.
Every decorated backend route is classified below. “Not exposed to MCP” is an explicit access boundary, not permission to bypass it. Download the machine-readable inventory.
| Operation | Access | MCP | Reason |
|---|---|---|---|
POST /ai/compose | secret-key | Yes | Project-scoped customer operation |
POST /ai/rewrite | secret-key | Yes | Project-scoped customer operation |
POST /ai/subject-lines | secret-key | Yes | Project-scoped customer operation |
POST /ai/preview-text | secret-key | Yes | Project-scoped customer operation |
POST /ai/spam-check | secret-key | Yes | Project-scoped customer operation |
POST /ai/segment-rules | secret-key | Yes | Project-scoped customer operation |
POST /ai/campaign-debrief | secret-key | Yes | Project-scoped customer operation |
POST /ai/send-time | secret-key | Yes | Project-scoped customer operation |
POST /v1/track | public-key | No | Browser tracking only; not a private project API |
POST /v1/send | secret-key | Yes | Project-scoped customer operation |
POST /v1/verify | secret-key | Yes | Project-scoped customer operation |
GET /activity | secret-key | Yes | Project-scoped customer operation |
GET /activity/stats | secret-key | Yes | Project-scoped customer operation |
GET /activity/recent-count | secret-key | Yes | Project-scoped customer operation |
GET /activity/types | secret-key | Yes | Project-scoped customer operation |
GET /activity/upcoming | secret-key | Yes | Project-scoped customer operation |
GET /admin/me | internal | No | Administrator/provider callback; not a customer API tool |
GET /admin/overview | internal | No | Administrator/provider callback; not a customer API tool |
GET /admin/users | internal | No | Administrator/provider callback; not a customer API tool |
GET /admin/projects | internal | No | Administrator/provider callback; not a customer API tool |
GET /admin/security | internal | No | Administrator/provider callback; not a customer API tool |
GET /admin/activity | internal | No | Administrator/provider callback; not a customer API tool |
GET /admin/users/{id} | internal | No | Administrator/provider callback; not a customer API tool |
GET /admin/projects/{id} | internal | No | Administrator/provider callback; not a customer API tool |
PUT /admin/projects/{id}/limits | internal | No | Administrator/provider callback; not a customer API tool |
PUT /admin/projects/{id}/plan | internal | No | Administrator/provider callback; not a customer API tool |
GET /admin/postal-health | internal | No | Administrator/provider callback; not a customer API tool |
POST /admin/impersonate/{id} | internal | No | Administrator/provider callback; not a customer API tool |
POST /admin/projects/{id}/disable | internal | No | Administrator/provider callback; not a customer API tool |
POST /admin/projects/{id}/enable | internal | No | Administrator/provider callback; not a customer API tool |
POST /admin/users/{id}/verify-email | internal | No | Administrator/provider callback; not a customer API tool |
POST /admin/users/{id}/ban | internal | No | Administrator/provider callback; not a customer API tool |
POST /admin/users/{id}/unban | internal | No | Administrator/provider callback; not a customer API tool |
DELETE /admin/users/{id} | internal | No | Administrator/provider callback; not a customer API tool |
DELETE /admin/projects/{id} | internal | No | Administrator/provider callback; not a customer API tool |
GET /admin/impersonation-status | internal | No | Administrator/provider callback; not a customer API tool |
POST /admin/stop-impersonating | internal | No | Administrator/provider callback; not a customer API tool |
GET /analytics/timeseries | secret-key | Yes | Project-scoped customer operation |
GET /analytics/top-campaigns | secret-key | Yes | Project-scoped customer operation |
GET /analytics/campaign-stats | secret-key | Yes | Project-scoped customer operation |
GET /analytics/top-events | secret-key | Yes | Project-scoped customer operation |
GET /api-keys | session | No | Account/security operation requires a dashboard user session |
POST /api-keys | session | No | Account/security operation requires a dashboard user session |
GET /api-keys/usage | session | No | Account/security operation requires a dashboard user session |
DELETE /api-keys/{id} | session | No | Account/security operation requires a dashboard user session |
POST /auth/login | public | No | Public/token-authenticated application flow |
POST /auth/signup | public | No | Public/token-authenticated application flow |
GET /auth/logout | public | No | Public/token-authenticated application flow |
GET /auth/oauth-config | public | No | Public/token-authenticated application flow |
POST /auth/verify-email | public | No | Public/token-authenticated application flow |
POST /auth/request-verification | public | No | Public/token-authenticated application flow |
POST /auth/request-password-reset | public | No | Public/token-authenticated application flow |
POST /auth/reset-password | public | No | Public/token-authenticated application flow |
POST /auth/magic-link/request | public | No | Public/token-authenticated application flow |
POST /auth/magic-link/verify | public | No | Public/token-authenticated application flow |
POST /campaigns | secret-key | Yes | Project-scoped customer operation |
GET /campaigns | secret-key | Yes | Project-scoped customer operation |
POST /campaigns/bulk-update | secret-key | Yes | Project-scoped customer operation |
GET /campaigns/{id} | secret-key | Yes | Project-scoped customer operation |
PUT /campaigns/{id} | secret-key | Yes | Project-scoped customer operation |
DELETE /campaigns/{id} | secret-key | Yes | Project-scoped customer operation |
POST /campaigns/{id}/duplicate | secret-key | Yes | Project-scoped customer operation |
POST /campaigns/{id}/send | secret-key | Yes | Project-scoped customer operation |
POST /campaigns/{id}/cancel | secret-key | Yes | Project-scoped customer operation |
GET /campaigns/{id}/stats | secret-key | Yes | Project-scoped customer operation |
POST /campaigns/{id}/pick-winner | secret-key | Yes | Project-scoped customer operation |
GET /campaigns/{id}/analytics | secret-key | Yes | Project-scoped customer operation |
POST /campaigns/{id}/test | secret-key | Yes | Project-scoped customer operation |
GET /config | public | No | Public/token-authenticated application flow |
GET /contacts | secret-key | Yes | Project-scoped customer operation |
GET /contacts/export | secret-key | Yes | Project-scoped customer operation |
GET /contacts/fields | secret-key | Yes | Project-scoped customer operation |
GET /contacts/suppressions | secret-key | Yes | Project-scoped customer operation |
POST /contacts/suppressions | secret-key | Yes | Project-scoped customer operation |
DELETE /contacts/suppressions/{contactId} | secret-key | Yes | Project-scoped customer operation |
GET /contacts/suppressions/stats | secret-key | Yes | Project-scoped customer operation |
GET /contacts/suppressions/export | secret-key | Yes | Project-scoped customer operation |
GET /contacts/fields/{field}/values | secret-key | Yes | Project-scoped customer operation |
GET /contacts/{id} | secret-key | Yes | Project-scoped customer operation |
POST /contacts | secret-key | Yes | Project-scoped customer operation |
PATCH /contacts/{id} | secret-key | Yes | Project-scoped customer operation |
POST /contacts/{id}/tags | secret-key | Yes | Project-scoped customer operation |
DELETE /contacts/{id}/tags/{tagId} | secret-key | Yes | Project-scoped customer operation |
GET /contacts/{id}/emails | secret-key | Yes | Project-scoped customer operation |
DELETE /contacts/{id} | secret-key | Yes | Project-scoped customer operation |
GET /contacts/public/{id} | public | No | Public/token-authenticated application flow |
POST /contacts/public/{id}/subscribe | public | No | Public/token-authenticated application flow |
POST /contacts/public/{id}/unsubscribe | public | No | Public/token-authenticated application flow |
POST /contacts/lookup | secret-key | Yes | Project-scoped customer operation |
POST /contacts/import | secret-key | Yes | Project-scoped customer operation |
GET /contacts/import/{jobId} | secret-key | Yes | Project-scoped customer operation |
GET /contacts/fields/{field}/usage | secret-key | Yes | Project-scoped customer operation |
DELETE /contacts/fields/{field} | secret-key | Yes | Project-scoped customer operation |
POST /contacts/bulk-subscribe | secret-key | Yes | Project-scoped customer operation |
POST /contacts/bulk-unsubscribe | secret-key | Yes | Project-scoped customer operation |
POST /contacts/bulk-delete | secret-key | Yes | Project-scoped customer operation |
GET /contacts/bulk/{jobId} | secret-key | Yes | Project-scoped customer operation |
GET /dedicated-ips | secret-key | Yes | Project-scoped customer operation |
POST /dedicated-ips | secret-key | Yes | Project-scoped customer operation |
PATCH /dedicated-ips/{id} | secret-key | Yes | Project-scoped customer operation |
DELETE /dedicated-ips/{id} | secret-key | Yes | Project-scoped customer operation |
POST /developer/smtp/test | session | No | Account/security operation requires a dashboard user session |
GET /v2/domainTemplates/providers/sendbound.com/services/email-sending | public | No | Public/token-authenticated application flow |
GET /domains | secret-key | Yes | Project-scoped customer operation |
GET /domains/project/{projectId} | secret-key | Yes | Project-scoped customer operation |
POST /domains | secret-key | Yes | Project-scoped customer operation |
GET /domains/{id} | secret-key | Yes | Project-scoped customer operation |
GET /domains/{id}/verify | secret-key | Yes | Project-scoped customer operation |
GET /domains/{id}/dns-check | secret-key | Yes | Project-scoped customer operation |
PATCH /domains/{id}/toggle | secret-key | Yes | Project-scoped customer operation |
DELETE /domains/{id} | secret-key | Yes | Project-scoped customer operation |
POST /emails/batch | secret-key | Yes | Project-scoped customer operation |
GET /emails | secret-key | Yes | Project-scoped customer operation |
GET /emails/inbound | secret-key | Yes | Project-scoped customer operation |
GET /emails/{id}/attachments/{attachmentId} | secret-key | Yes | Project-scoped customer operation |
GET /emails/{id} | secret-key | Yes | Project-scoped customer operation |
POST /events/track | secret-key | Yes | Project-scoped customer operation |
GET /events | secret-key | Yes | Project-scoped customer operation |
GET /events/stats | secret-key | Yes | Project-scoped customer operation |
GET /events/contact/{contactId} | secret-key | Yes | Project-scoped customer operation |
GET /events/names | secret-key | Yes | Project-scoped customer operation |
GET /events/{eventName}/usage | secret-key | Yes | Project-scoped customer operation |
DELETE /events/{eventName} | secret-key | Yes | Project-scoped customer operation |
POST /integrations/mailchimp/import | secret-key | No | Third-party credentials: use the authenticated dashboard/API, not AI tool arguments |
POST /integrations/klaviyo/import | secret-key | No | Third-party credentials: use the authenticated dashboard/API, not AI tool arguments |
POST /integrations/convertkit/import | secret-key | No | Third-party credentials: use the authenticated dashboard/API, not AI tool arguments |
POST /integrations/brevo/import | secret-key | No | Third-party credentials: use the authenticated dashboard/API, not AI tool arguments |
POST /integrations/hubspot/import | secret-key | No | Third-party credentials: use the authenticated dashboard/API, not AI tool arguments |
GET /logs | secret-key | Yes | Project-scoped customer operation |
GET /projects/@me/preference-page | secret-key | Yes | Project-scoped customer operation |
PATCH /projects/@me/preference-page | secret-key | Yes | Project-scoped customer operation |
GET /preferences/{contactId} | public | No | Public/token-authenticated application flow |
POST /preferences/{contactId} | public | No | Public/token-authenticated application flow |
POST /preferences/{contactId}/unsubscribe-all | public | No | Public/token-authenticated application flow |
GET /unsubscribe-groups | secret-key | Yes | Project-scoped customer operation |
POST /unsubscribe-groups | secret-key | Yes | Project-scoped customer operation |
PATCH /unsubscribe-groups/{id} | secret-key | Yes | Project-scoped customer operation |
DELETE /unsubscribe-groups/{id} | secret-key | Yes | Project-scoped customer operation |
GET /projects/{projectId}/webhooks | secret-key | No | Dashboard alias; MCP uses canonical /webhooks |
POST /projects/{projectId}/webhooks | secret-key | No | Dashboard alias; MCP uses canonical /webhooks |
GET /projects/{projectId}/webhooks/{id} | secret-key | No | Dashboard alias; MCP uses canonical /webhooks |
GET /projects/{projectId}/webhooks/{id}/deliveries | secret-key | No | Dashboard alias; MCP uses canonical /webhooks |
PATCH /projects/{projectId}/webhooks/{id} | secret-key | No | Dashboard alias; MCP uses canonical /webhooks |
POST /projects/{projectId}/webhooks/{id}/test | secret-key | No | Dashboard alias; MCP uses canonical /webhooks |
DELETE /projects/{projectId}/webhooks/{id} | secret-key | No | Dashboard alias; MCP uses canonical /webhooks |
GET /projects/@me/smtp/credentials | secret-key | No | Project configuration/credential boundary; use the authenticated API/dashboard |
PUT /projects/@me/smtp | session | No | Account/security operation requires a dashboard user session |
POST /projects/@me/smtp/test | secret-key | Yes | Project-scoped customer operation |
GET /projects/@me/deliverability | secret-key | Yes | Project-scoped customer operation |
GET /projects/{id}/setup-state | session | No | Account/security operation requires a dashboard user session |
GET /projects/{id}/security | session | No | Account/security operation requires a dashboard user session |
GET /projects/{id}/members | session | No | Account/security operation requires a dashboard user session |
POST /projects/{id}/members | session | No | Account/security operation requires a dashboard user session |
PATCH /projects/{id}/members/{userId} | session | No | Account/security operation requires a dashboard user session |
DELETE /projects/{id}/members/{userId} | session | No | Account/security operation requires a dashboard user session |
GET /segments | secret-key | Yes | Project-scoped customer operation |
GET /segments/{id} | secret-key | Yes | Project-scoped customer operation |
GET /segments/{id}/contacts | secret-key | Yes | Project-scoped customer operation |
POST /segments | secret-key | Yes | Project-scoped customer operation |
PATCH /segments/{id} | secret-key | Yes | Project-scoped customer operation |
DELETE /segments/{id} | secret-key | Yes | Project-scoped customer operation |
POST /segments/{id}/members | secret-key | Yes | Project-scoped customer operation |
DELETE /segments/{id}/members | secret-key | Yes | Project-scoped customer operation |
POST /segments/{id}/compute | secret-key | Yes | Project-scoped customer operation |
POST /segments/{id}/refresh | secret-key | Yes | Project-scoped customer operation |
GET /sso/config | secret-key | No | Project configuration/credential boundary; use the authenticated API/dashboard |
POST /sso/configure | session | No | Account/security operation requires a dashboard user session |
POST /sso/verify-domain | session | No | Account/security operation requires a dashboard user session |
POST /sso/set-require | session | No | Account/security operation requires a dashboard user session |
POST /sso/disable | session | No | Account/security operation requires a dashboard user session |
GET /sso/saml/metadata | secret-key | No | Project configuration/credential boundary; use the authenticated API/dashboard |
GET /sso/check | public | No | Public/token-authenticated application flow |
GET /sso/initiate | public | No | Public/token-authenticated application flow |
POST /sso/saml/callback | public | No | Public/token-authenticated application flow |
GET /sso/callback | public | No | Public/token-authenticated application flow |
GET /admin/system-settings/provider | internal | No | Administrator/provider callback; not a customer API tool |
PUT /admin/system-settings/postal | internal | No | Administrator/provider callback; not a customer API tool |
POST /admin/system-settings/postal/test | internal | No | Administrator/provider callback; not a customer API tool |
PUT /admin/system-settings/provider/select | internal | No | Administrator/provider callback; not a customer API tool |
GET /tags | secret-key | Yes | Project-scoped customer operation |
POST /tags | secret-key | Yes | Project-scoped customer operation |
PATCH /tags/{id} | secret-key | Yes | Project-scoped customer operation |
DELETE /tags/{id} | secret-key | Yes | Project-scoped customer operation |
GET /templates | secret-key | Yes | Project-scoped customer operation |
GET /templates/{id} | secret-key | Yes | Project-scoped customer operation |
POST /templates | secret-key | Yes | Project-scoped customer operation |
PATCH /templates/{id} | secret-key | Yes | Project-scoped customer operation |
DELETE /templates/{id} | secret-key | Yes | Project-scoped customer operation |
POST /templates/bulk-update | secret-key | Yes | Project-scoped customer operation |
POST /templates/{id}/duplicate | secret-key | Yes | Project-scoped customer operation |
GET /templates/{id}/usage | secret-key | Yes | Project-scoped customer operation |
POST /templates/convert | public | No | Public/token-authenticated application flow |
POST /unsubscribe/{id} | public | No | Public/token-authenticated application flow |
GET /unsubscribe/{id} | public | No | Public/token-authenticated application flow |
POST /uploads/image | secret-key | Yes | Project-scoped customer operation |
GET /webhooks | secret-key | Yes | Project-scoped customer operation |
POST /webhooks | secret-key | Yes | Project-scoped customer operation |
GET /webhooks/{id} | secret-key | Yes | Project-scoped customer operation |
GET /webhooks/{id}/deliveries | secret-key | Yes | Project-scoped customer operation |
PATCH /webhooks/{id} | secret-key | Yes | Project-scoped customer operation |
POST /webhooks/{id}/test | secret-key | Yes | Project-scoped customer operation |
DELETE /webhooks/{id} | secret-key | Yes | Project-scoped customer operation |
GET /users/@me | session | No | Account/security operation requires a dashboard user session |
GET /users/@me/projects | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects | session | No | Account/security operation requires a dashboard user session |
PATCH /users/@me/projects/{id} | session | No | Account/security operation requires a dashboard user session |
GET /users/@me/projects/{id}/secret | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/regenerate-keys | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/checkout | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/checkout-embedded | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/subscribe | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/subscribe/activate | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/change-plan | session | No | Account/security operation requires a dashboard user session |
DELETE /users/@me/projects/{id}/addon/{addonId} | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/billing-portal | session | No | Account/security operation requires a dashboard user session |
GET /users/@me/projects/{id}/billing-limits | session | No | Account/security operation requires a dashboard user session |
GET /users/@me/projects/{id}/billing-daily | session | No | Account/security operation requires a dashboard user session |
PUT /users/@me/projects/{id}/billing-limits | session | No | Account/security operation requires a dashboard user session |
GET /users/@me/projects/{id}/billing-consumption | session | No | Account/security operation requires a dashboard user session |
GET /users/@me/projects/{id}/billing-invoices | session | No | Account/security operation requires a dashboard user session |
GET /users/@me/projects/{id}/subscription-status | session | No | Account/security operation requires a dashboard user session |
GET /users/@me/projects/{id}/payment-method | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/cancel-subscription | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/reactivate-subscription | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/setup-intent | session | No | Account/security operation requires a dashboard user session |
PUT /users/@me/projects/{id}/payment-method | session | No | Account/security operation requires a dashboard user session |
GET /users/@me/projects/{id}/security | session | No | Account/security operation requires a dashboard user session |
POST /users/@me/projects/{id}/reset | session | No | Account/security operation requires a dashboard user session |
DELETE /users/@me/projects/{id} | session | No | Account/security operation requires a dashboard user session |
GET /warmup | secret-key | Yes | Project-scoped customer operation |
POST /warmup | secret-key | Yes | Project-scoped customer operation |
GET /warmup/{id} | secret-key | Yes | Project-scoped customer operation |
PATCH /warmup/{id} | secret-key | Yes | Project-scoped customer operation |
DELETE /warmup/{id} | secret-key | Yes | Project-scoped customer operation |
POST /warmup/{id}/advance | secret-key | Yes | Project-scoped customer operation |
POST /webhooks/sns | internal | No | Administrator/provider callback; not a customer API tool |
POST /webhooks/incoming/stripe | internal | No | Administrator/provider callback; not a customer API tool |
POST /webhooks/inbound | internal | No | Administrator/provider callback; not a customer API tool |
POST /webhooks/postal | internal | No | Administrator/provider callback; not a customer API tool |
POST /webhooks/postal-events | internal | No | Administrator/provider callback; not a customer API tool |
GET /workflows | secret-key | Yes | Project-scoped customer operation |
GET /workflows/fields | secret-key | Yes | Project-scoped customer operation |
POST /workflows/bulk-update | secret-key | Yes | Project-scoped customer operation |
POST /workflows/{id}/ai-generate | secret-key | Yes | Project-scoped customer operation |
GET /workflows/{id} | secret-key | Yes | Project-scoped customer operation |
POST /workflows | secret-key | Yes | Project-scoped customer operation |
PATCH /workflows/{id} | secret-key | Yes | Project-scoped customer operation |
DELETE /workflows/{id} | secret-key | Yes | Project-scoped customer operation |
POST /workflows/{id}/duplicate | secret-key | Yes | Project-scoped customer operation |
POST /workflows/{id}/steps | secret-key | Yes | Project-scoped customer operation |
PATCH /workflows/{id}/steps/{stepId} | secret-key | Yes | Project-scoped customer operation |
DELETE /workflows/{id}/steps/{stepId} | secret-key | Yes | Project-scoped customer operation |
POST /workflows/{id}/transitions | secret-key | Yes | Project-scoped customer operation |
POST /workflows/{id}/transitions/{transitionId}/insert-step | secret-key | Yes | Project-scoped customer operation |
DELETE /workflows/{id}/transitions/{transitionId} | secret-key | Yes | Project-scoped customer operation |
POST /workflows/{id}/executions | secret-key | Yes | Project-scoped customer operation |
GET /workflows/{id}/executions | secret-key | Yes | Project-scoped customer operation |
GET /workflows/{id}/executions/{executionId} | secret-key | Yes | Project-scoped customer operation |
DELETE /workflows/{id}/executions/{executionId} | secret-key | Yes | Project-scoped customer operation |
POST /workflows/{id}/executions/cancel-all | secret-key | Yes | Project-scoped customer operation |