Complete API catalog

Authentication: Secret project API key. Resources are scoped to that project.

MCP: ai_compose

{
  "type": "object",
  "properties": {
    "prompt": {},
    "tone": {},
    "emailType": {},
    "existingHtml": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: ai_rewrite

{
  "type": "object",
  "properties": {
    "html": {},
    "mode": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: ai_subject_lines

{
  "type": "object",
  "properties": {
    "emailHtml": {},
    "campaignName": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: ai_preview_text

{
  "type": "object",
  "properties": {
    "emailHtml": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: ai_spam_check

{
  "type": "object",
  "properties": {
    "subject": {},
    "html": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: ai_segment_rules

{
  "type": "object",
  "properties": {
    "prompt": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: ai_campaign_debrief

{
  "type": "object",
  "properties": {
    "campaignId": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: ai_send_time

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public tracking key; never use a secret key in browser code.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "event": {
      "type": "string",
      "minLength": 1
    },
    "email": {
      "type": "string",
      "format": "email"
    },
    "subscribed": {
      "type": "boolean"
    },
    "data": {
      "anyOf": [
        {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "number"
            },
            {
              "type": "boolean"
            },
            {
              "enum": [
                "null"
              ],
              "nullable": true
            },
            {
              "type": "string",
              "format": "date-time"
            }
          ]
        },
        {
          "type": "array",
          "items": {}
        },
        {
          "type": "object",
          "additionalProperties": {}
        }
      ]
    }
  },
  "required": [
    "event",
    "email"
  ],
  "additionalProperties": false
}

Browser tracking only; not a private project API. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: send_email

{
  "type": "object",
  "properties": {
    "to": {
      "anyOf": [
        {
          "type": "string",
          "format": "email"
        },
        {
          "type": "object",
          "properties": {
            "name": {
              "type": "string",
              "pattern": "^[^\\r\\n]*$"
            },
            "email": {
              "type": "string",
              "format": "email"
            }
          },
          "required": [
            "email"
          ],
          "additionalProperties": false
        },
        {
          "type": "array",
          "items": {
            "anyOf": [
              {
                "type": "string",
                "format": "email"
              },
              {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string",
                    "pattern": "^[^\\r\\n]*$"
                  },
                  "email": {
                    "type": "string",
                    "format": "email"
                  }
                },
                "required": [
                  "email"
                ],
                "additionalProperties": false
              }
            ]
          }
        }
      ]
    },
    "subject": {
      "type": "string",
      "minLength": 1,
      "maxLength": 998,
      "pattern": "^[^\\r\\n]*$"
    },
    "body": {
      "type": "string",
      "minLength": 1
    },
    "template": {
      "type": "string",
      "format": "uuid"
    },
    "subscribed": {
      "type": "boolean"
    },
    "name": {
      "type": "string"
    },
    "from": {
      "anyOf": [
        {
          "type": "string",
          "format": "email"
        },
        {
          "type": "object",
          "properties": {
            "name": {
              "type": "string",
              "pattern": "^[^\\r\\n]*$"
            },
            "email": {
              "type": "string",
              "format": "email"
            }
          },
          "required": [
            "email"
          ],
          "additionalProperties": false
        }
      ]
    },
    "reply": {
      "type": "string",
      "format": "email"
    },
    "cc": {
      "anyOf": [
        {
          "type": "string",
          "format": "email"
        },
        {
          "type": "object",
          "properties": {
            "name": {
              "type": "string"
            },
            "email": {
              "type": "string",
              "format": "email"
            }
          },
          "required": [
            "email"
          ],
          "additionalProperties": false
        },
        {
          "type": "array",
          "items": {
            "anyOf": [
              {
                "type": "string",
                "format": "email"
              },
              {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string"
                  },
                  "email": {
                    "type": "string",
                    "format": "email"
                  }
                },
                "required": [
                  "email"
                ],
                "additionalProperties": false
              }
            ]
          }
        }
      ]
    },
    "bcc": {
      "anyOf": [
        {
          "type": "string",
          "format": "email"
        },
        {
          "type": "object",
          "properties": {
            "name": {
              "type": "string"
            },
            "email": {
              "type": "string",
              "format": "email"
            }
          },
          "required": [
            "email"
          ],
          "additionalProperties": false
        },
        {
          "type": "array",
          "items": {
            "anyOf": [
              {
                "type": "string",
                "format": "email"
              },
              {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string"
                  },
                  "email": {
                    "type": "string",
                    "format": "email"
                  }
                },
                "required": [
                  "email"
                ],
                "additionalProperties": false
              }
            ]
          }
        }
      ]
    },
    "text": {
      "type": "string"
    },
    "headers": {
      "type": "object",
      "additionalProperties": {
        "type": "string",
        "maxLength": 998,
        "pattern": "^[^\\r\\n]*$"
      }
    },
    "data": {
      "anyOf": [
        {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "number"
            },
            {
              "type": "boolean"
            },
            {
              "enum": [
                "null"
              ],
              "nullable": true
            },
            {
              "type": "string",
              "format": "date-time"
            }
          ]
        },
        {
          "type": "array",
          "items": {}
        },
        {
          "type": "object",
          "additionalProperties": {}
        }
      ]
    },
    "attachments": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "filename": {
            "type": "string",
            "minLength": 1,
            "maxLength": 255,
            "pattern": "^[^\\r\\n\"]+$"
          },
          "content": {
            "type": "string",
            "minLength": 1
          },
          "contentType": {
            "type": "string",
            "minLength": 1,
            "maxLength": 255
          },
          "contentId": {
            "type": "string",
            "minLength": 1,
            "maxLength": 255,
            "pattern": "^[^<>\\r\\n]+$"
          },
          "disposition": {
            "type": "string",
            "enum": [
              "attachment",
              "inline"
            ],
            "default": "attachment"
          }
        },
        "required": [
          "filename",
          "content",
          "contentType"
        ],
        "additionalProperties": false
      },
      "maxItems": 10
    }
  },
  "required": [
    "to"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: actions_verify

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    }
  },
  "required": [
    "email"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: activity_get_activities

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: activity_get_stats

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: activity_get_recent_count

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: activity_get_types

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: activity_get_upcoming

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: analytics_get_time_series

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: analytics_get_top_campaigns

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: analytics_get_campaign_stats

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: analytics_get_top_events

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64
    }
  },
  "required": [
    "name"
  ],
  "additionalProperties": false
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    },
    "password": {
      "type": "string",
      "minLength": 6
    }
  },
  "required": [
    "email",
    "password"
  ],
  "additionalProperties": false
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    },
    "password": {
      "type": "string",
      "minLength": 6
    },
    "firstName": {
      "type": "string",
      "minLength": 1,
      "maxLength": 50
    },
    "lastName": {
      "type": "string",
      "minLength": 1,
      "maxLength": 50
    },
    "company": {
      "type": "string",
      "minLength": 1,
      "maxLength": 100
    },
    "cf-turnstile-response": {
      "type": "string"
    }
  },
  "required": [
    "email",
    "password",
    "firstName",
    "lastName",
    "company"
  ],
  "additionalProperties": false
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string",
      "minLength": 64,
      "maxLength": 64
    },
    "code": {
      "type": "string",
      "minLength": 6,
      "maxLength": 6,
      "pattern": "^\\d{6}$"
    }
  },
  "additionalProperties": false
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    }
  },
  "required": [
    "email"
  ],
  "additionalProperties": false
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string",
      "minLength": 64,
      "maxLength": 64
    },
    "newPassword": {
      "type": "string",
      "minLength": 6
    }
  },
  "required": [
    "token",
    "newPassword"
  ],
  "additionalProperties": false
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    }
  },
  "required": [
    "email"
  ],
  "additionalProperties": false
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string",
      "minLength": 64,
      "maxLength": 64
    }
  },
  "required": [
    "token"
  ],
  "additionalProperties": false
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: create_campaign

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "minLength": 1
    },
    "description": {
      "type": "string"
    },
    "subject": {
      "type": "string",
      "minLength": 1
    },
    "body": {
      "type": "string",
      "minLength": 1
    },
    "from": {
      "type": "string",
      "format": "email"
    },
    "fromName": {
      "type": "string",
      "maxLength": 100,
      "nullable": true
    },
    "replyTo": {
      "type": "string",
      "format": "email",
      "nullable": true
    },
    "type": {
      "type": "string",
      "enum": [
        "TRANSACTIONAL",
        "MARKETING",
        "HEADLESS"
      ],
      "default": "MARKETING"
    },
    "audienceType": {
      "type": "string",
      "enum": [
        "ALL",
        "FILTERED",
        "SEGMENT"
      ]
    },
    "audienceCondition": {
      "type": "object",
      "properties": {
        "logic": {
          "type": "string",
          "enum": [
            "AND",
            "OR"
          ]
        },
        "groups": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "filters": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "field": {
                      "type": "string",
                      "minLength": 1
                    },
                    "operator": {
                      "type": "string",
                      "enum": [
                        "equals",
                        "notEquals",
                        "contains",
                        "notContains",
                        "greaterThan",
                        "lessThan",
                        "greaterThanOrEqual",
                        "lessThanOrEqual",
                        "exists",
                        "notExists",
                        "within",
                        "olderThan",
                        "triggered",
                        "triggeredWithin",
                        "triggeredOlderThan",
                        "notTriggered",
                        "notTriggeredWithin",
                        "memberOfSegment",
                        "notMemberOfSegment"
                      ]
                    },
                    "value": {},
                    "unit": {
                      "type": "string",
                      "enum": [
                        "days",
                        "hours",
                        "minutes"
                      ]
                    }
                  },
                  "required": [
                    "field",
                    "operator"
                  ],
                  "additionalProperties": false
                }
              },
              "conditions": {}
            },
            "required": [
              "filters"
            ],
            "additionalProperties": false
          },
          "minItems": 1
        }
      },
      "required": [
        "logic",
        "groups"
      ],
      "additionalProperties": false
    },
    "segmentId": {
      "type": "string",
      "format": "uuid"
    },
    "isABTest": {
      "type": "boolean"
    },
    "abVariantSubject": {
      "type": "string",
      "minLength": 1
    },
    "abVariantBody": {
      "type": "string",
      "minLength": 1
    },
    "abSplitPercent": {
      "type": "integer",
      "minimum": 1,
      "maximum": 99
    },
    "abTestDuration": {
      "type": "integer",
      "minimum": 1,
      "maximum": 168
    }
  },
  "required": [
    "name",
    "subject",
    "body",
    "from",
    "audienceType"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: list_campaigns

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: campaigns_bulk_update

{
  "type": "object",
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uuid"
      },
      "minItems": 1,
      "maxItems": 1000
    },
    "delete": {
      "type": "boolean"
    }
  },
  "required": [
    "ids"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: get_campaign

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: campaigns_update

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string"
    },
    "description": {
      "type": "string"
    },
    "subject": {
      "type": "string"
    },
    "body": {
      "type": "string"
    },
    "from": {
      "type": "string"
    },
    "fromName": {
      "type": "string",
      "maxLength": 100,
      "nullable": true
    },
    "replyTo": {
      "type": "string",
      "nullable": true
    },
    "type": {
      "type": "string",
      "enum": [
        "TRANSACTIONAL",
        "MARKETING",
        "HEADLESS"
      ]
    },
    "audienceType": {
      "type": "string",
      "enum": [
        "ALL",
        "FILTERED",
        "SEGMENT"
      ]
    },
    "audienceCondition": {
      "type": "object",
      "properties": {
        "logic": {
          "type": "string",
          "enum": [
            "AND",
            "OR"
          ]
        },
        "groups": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "filters": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "field": {
                      "type": "string",
                      "minLength": 1
                    },
                    "operator": {
                      "type": "string",
                      "enum": [
                        "equals",
                        "notEquals",
                        "contains",
                        "notContains",
                        "greaterThan",
                        "lessThan",
                        "greaterThanOrEqual",
                        "lessThanOrEqual",
                        "exists",
                        "notExists",
                        "within",
                        "olderThan",
                        "triggered",
                        "triggeredWithin",
                        "triggeredOlderThan",
                        "notTriggered",
                        "notTriggeredWithin",
                        "memberOfSegment",
                        "notMemberOfSegment"
                      ]
                    },
                    "value": {},
                    "unit": {
                      "type": "string",
                      "enum": [
                        "days",
                        "hours",
                        "minutes"
                      ]
                    }
                  },
                  "required": [
                    "field",
                    "operator"
                  ],
                  "additionalProperties": false
                }
              },
              "conditions": {}
            },
            "required": [
              "filters"
            ],
            "additionalProperties": false
          },
          "minItems": 1
        }
      },
      "required": [
        "logic",
        "groups"
      ],
      "additionalProperties": false
    },
    "segmentId": {
      "type": "string"
    },
    "isABTest": {
      "type": "boolean"
    },
    "abVariantSubject": {
      "type": "string",
      "minLength": 1,
      "nullable": true
    },
    "abVariantBody": {
      "type": "string",
      "minLength": 1,
      "nullable": true
    },
    "abSplitPercent": {
      "type": "integer",
      "minimum": 1,
      "maximum": 99
    },
    "abTestDuration": {
      "type": "integer",
      "minimum": 1,
      "maximum": 168
    }
  },
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: campaigns_delete

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: campaigns_duplicate

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: send_campaign

{
  "type": "object",
  "properties": {
    "scheduledFor": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: cancel_campaign

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: get_campaign_stats

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: campaigns_pick_winner

{
  "type": "object",
  "properties": {
    "variant": {
      "type": "string",
      "enum": [
        "A",
        "B"
      ]
    }
  },
  "required": [
    "variant"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: campaigns_analytics

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: campaigns_send_test

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    }
  },
  "required": [
    "email"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: list_contacts

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: create_contact

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    },
    "data": {
      "type": "object",
      "additionalProperties": {}
    },
    "subscribed": {
      "type": "boolean"
    }
  },
  "required": [
    "email"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_export_contacts

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_get_available_fields

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_list_suppressions

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_add_suppression

{
  "type": "object",
  "properties": {
    "email": {},
    "reason": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_remove_suppression

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_suppression_stats

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_export_suppressions

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_get_field_values

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: get_contact

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: update_contact

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    },
    "data": {
      "type": "object",
      "additionalProperties": {}
    },
    "subscribed": {
      "type": "boolean"
    }
  },
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: delete_contact

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 204, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_add_tags

{
  "type": "object",
  "properties": {
    "tagIds": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_remove_tag

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 204, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_get_emails

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_lookup

{
  "type": "object",
  "properties": {
    "emails": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_import_csv

{
  "type": "object",
  "required": [
    "file"
  ],
  "properties": {
    "file": {
      "type": "string",
      "format": "binary"
    }
  }
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 202, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_get_import_status

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_get_field_usage

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_delete_field

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_bulk_subscribe

{
  "anyOf": [
    {
      "type": "object",
      "properties": {
        "mode": {
          "type": "string",
          "enum": [
            "ids"
          ]
        },
        "contactIds": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uuid"
          },
          "minItems": 1,
          "maxItems": 1000
        }
      },
      "required": [
        "mode",
        "contactIds"
      ],
      "additionalProperties": false
    },
    {
      "type": "object",
      "properties": {
        "mode": {
          "type": "string",
          "enum": [
            "query"
          ]
        },
        "filter": {
          "type": "object",
          "properties": {
            "search": {
              "type": "string",
              "maxLength": 255
            },
            "subscribed": {
              "type": "boolean"
            },
            "tagId": {
              "type": "string",
              "format": "uuid"
            }
          },
          "additionalProperties": false,
          "default": {}
        },
        "excludeIds": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uuid"
          },
          "maxItems": 10000
        }
      },
      "required": [
        "mode"
      ],
      "additionalProperties": false
    }
  ]
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 202, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_bulk_unsubscribe

{
  "anyOf": [
    {
      "type": "object",
      "properties": {
        "mode": {
          "type": "string",
          "enum": [
            "ids"
          ]
        },
        "contactIds": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uuid"
          },
          "minItems": 1,
          "maxItems": 1000
        }
      },
      "required": [
        "mode",
        "contactIds"
      ],
      "additionalProperties": false
    },
    {
      "type": "object",
      "properties": {
        "mode": {
          "type": "string",
          "enum": [
            "query"
          ]
        },
        "filter": {
          "type": "object",
          "properties": {
            "search": {
              "type": "string",
              "maxLength": 255
            },
            "subscribed": {
              "type": "boolean"
            },
            "tagId": {
              "type": "string",
              "format": "uuid"
            }
          },
          "additionalProperties": false,
          "default": {}
        },
        "excludeIds": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uuid"
          },
          "maxItems": 10000
        }
      },
      "required": [
        "mode"
      ],
      "additionalProperties": false
    }
  ]
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 202, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_bulk_delete

{
  "anyOf": [
    {
      "type": "object",
      "properties": {
        "mode": {
          "type": "string",
          "enum": [
            "ids"
          ]
        },
        "contactIds": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uuid"
          },
          "minItems": 1,
          "maxItems": 1000
        }
      },
      "required": [
        "mode",
        "contactIds"
      ],
      "additionalProperties": false
    },
    {
      "type": "object",
      "properties": {
        "mode": {
          "type": "string",
          "enum": [
            "query"
          ]
        },
        "filter": {
          "type": "object",
          "properties": {
            "search": {
              "type": "string",
              "maxLength": 255
            },
            "subscribed": {
              "type": "boolean"
            },
            "tagId": {
              "type": "string",
              "format": "uuid"
            }
          },
          "additionalProperties": false,
          "default": {}
        },
        "excludeIds": {
          "type": "array",
          "items": {
            "type": "string",
            "format": "uuid"
          },
          "maxItems": 10000
        }
      },
      "required": [
        "mode"
      ],
      "additionalProperties": false
    }
  ]
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 202, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: contacts_get_bulk_action_status

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: dedicated_ips_list

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: dedicated_ips_create

{
  "type": "object",
  "properties": {
    "ip": {},
    "notes": {},
    "dailySendCap": {},
    "warmupTarget": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: dedicated_ips_update

{
  "type": "object",
  "properties": {
    "status": {},
    "notes": {},
    "advanceDays": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: dedicated_ips_remove

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "projectId": {}
  },
  "required": [
    "projectId"
  ],
  "additionalProperties": true
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: list_domains

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: add_domain

{
  "type": "object",
  "properties": {
    "domain": {
      "type": "string",
      "minLength": 3,
      "maxLength": 253
    }
  },
  "required": [
    "domain"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: domains_get_project_domains

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: domains_get_domain

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: domains_remove_domain

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: verify_domain

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: domains_check_dns

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: domains_toggle_feature

{
  "type": "object",
  "properties": {
    "feature": {},
    "enabled": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: batch_send_email

{
  "type": "object",
  "properties": {
    "emails": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "to": {
            "anyOf": [
              {
                "type": "string",
                "format": "email"
              },
              {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string"
                  },
                  "email": {
                    "type": "string",
                    "format": "email"
                  }
                },
                "required": [
                  "email"
                ],
                "additionalProperties": false
              },
              {
                "type": "array",
                "items": {
                  "anyOf": [
                    {
                      "type": "string",
                      "format": "email"
                    },
                    {
                      "type": "object",
                      "properties": {
                        "name": {
                          "type": "string"
                        },
                        "email": {
                          "type": "string",
                          "format": "email"
                        }
                      },
                      "required": [
                        "email"
                      ],
                      "additionalProperties": false
                    }
                  ]
                }
              }
            ]
          },
          "from": {
            "anyOf": [
              {
                "type": "string",
                "format": "email"
              },
              {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string"
                  },
                  "email": {
                    "type": "string",
                    "format": "email"
                  }
                },
                "required": [
                  "email"
                ],
                "additionalProperties": false
              }
            ]
          },
          "subject": {
            "type": "string"
          },
          "body": {
            "type": "string"
          },
          "template": {
            "type": "string"
          },
          "data": {
            "type": "object",
            "additionalProperties": {}
          },
          "reply": {
            "type": "string",
            "format": "email"
          },
          "headers": {
            "type": "object",
            "additionalProperties": {
              "type": "string"
            }
          },
          "attachments": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "filename": {
                  "type": "string"
                },
                "content": {
                  "type": "string"
                },
                "contentType": {
                  "type": "string"
                }
              },
              "required": [
                "filename",
                "content",
                "contentType"
              ],
              "additionalProperties": false
            }
          },
          "subscribed": {
            "type": "boolean"
          }
        },
        "required": [
          "to",
          "from"
        ],
        "additionalProperties": false
      },
      "minItems": 1,
      "maxItems": 100
    }
  },
  "required": [
    "emails"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: list_emails

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: list_inbound_emails

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: download_inbound_attachment

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: get_email

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: events_track

{
  "type": "object",
  "properties": {
    "name": {},
    "contactId": {},
    "emailId": {},
    "data": {}
  },
  "required": [
    "name"
  ],
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: events_list

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: events_stats

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: events_get_contact_events

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: events_get_event_names

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: events_get_event_usage

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: events_delete_event

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "apiKey": {},
    "audienceId": {}
  },
  "additionalProperties": true
}

Third-party credentials: use the authenticated dashboard/API, not AI tool arguments. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "apiKey": {},
    "listId": {}
  },
  "additionalProperties": true
}

Third-party credentials: use the authenticated dashboard/API, not AI tool arguments. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "apiKey": {}
  },
  "additionalProperties": true
}

Third-party credentials: use the authenticated dashboard/API, not AI tool arguments. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "apiKey": {},
    "listId": {}
  },
  "additionalProperties": true
}

Third-party credentials: use the authenticated dashboard/API, not AI tool arguments. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "accessToken": {}
  },
  "additionalProperties": true
}

Third-party credentials: use the authenticated dashboard/API, not AI tool arguments. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: logs_list

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: preferences_get_preference_page

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: preferences_update_preference_page

{
  "type": "object",
  "properties": {},
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "token": {},
    "groupId": {},
    "subscribed": {}
  },
  "additionalProperties": true
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "token": {}
  },
  "additionalProperties": true
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: preferences_list_groups

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: preferences_create_group

{
  "type": "object",
  "properties": {
    "name": {},
    "description": {},
    "isDefault": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: preferences_update_group

{
  "type": "object",
  "properties": {
    "name": {},
    "description": {},
    "isDefault": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: preferences_delete_group

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 204, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Project configuration/credential boundary; use the authenticated API/dashboard. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {},
  "additionalProperties": true
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: projects_test_smtp_settings

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: projects_get_deliverability

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "email": {
      "type": "string",
      "format": "email"
    },
    "role": {
      "type": "string",
      "enum": [
        "ADMIN",
        "MEMBER"
      ],
      "default": "MEMBER"
    }
  },
  "required": [
    "email"
  ],
  "additionalProperties": false
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "role": {
      "type": "string",
      "enum": [
        "ADMIN",
        "MEMBER"
      ]
    }
  },
  "required": [
    "role"
  ],
  "additionalProperties": false
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: list_segments

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: create_segment

{
  "type": "object",
  "properties": {
    "name": {},
    "description": {},
    "type": {},
    "condition": {},
    "trackMembership": {}
  },
  "required": [
    "name"
  ],
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: get_segment

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: segments_update

{
  "type": "object",
  "properties": {
    "name": {},
    "description": {},
    "condition": {},
    "trackMembership": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: delete_segment

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 204, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: segments_get_contacts

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: segments_add_members

{
  "type": "object",
  "properties": {
    "emails": {},
    "createMissing": {},
    "subscribed": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: segments_remove_members

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: segments_compute

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: segments_refresh

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Project configuration/credential boundary; use the authenticated API/dashboard. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "anyOf": [
    {
      "type": "object",
      "properties": {
        "protocol": {
          "type": "string",
          "enum": [
            "oidc"
          ]
        },
        "issuerUrl": {
          "type": "string",
          "format": "uri"
        },
        "clientId": {
          "type": "string",
          "minLength": 1
        },
        "clientSecret": {
          "type": "string"
        },
        "domain": {
          "type": "string",
          "minLength": 1,
          "pattern": "^[a-z0-9]+([\\-\\.]{1}[a-z0-9]+)*\\.[a-z]{2,}$"
        }
      },
      "required": [
        "protocol",
        "issuerUrl",
        "clientId",
        "domain"
      ],
      "additionalProperties": false
    },
    {
      "type": "object",
      "properties": {
        "protocol": {
          "type": "string",
          "enum": [
            "saml"
          ]
        },
        "samlEntryPoint": {
          "type": "string",
          "format": "uri"
        },
        "samlCertificate": {
          "type": "string",
          "minLength": 1
        },
        "samlIssuer": {
          "type": "string"
        },
        "domain": {
          "type": "string",
          "minLength": 1,
          "pattern": "^[a-z0-9]+([\\-\\.]{1}[a-z0-9]+)*\\.[a-z]{2,}$"
        }
      },
      "required": [
        "protocol",
        "samlEntryPoint",
        "samlCertificate",
        "domain"
      ],
      "additionalProperties": false
    }
  ]
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "requireSso": {
      "type": "boolean"
    }
  },
  "required": [
    "requireSso"
  ],
  "additionalProperties": false
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Project configuration/credential boundary; use the authenticated API/dashboard. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 302, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "RelayState": {}
  },
  "additionalProperties": true
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 302, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 302, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: tags_list

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: tags_create

{
  "type": "object",
  "properties": {
    "name": {},
    "color": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: tags_update

{
  "type": "object",
  "properties": {
    "name": {},
    "color": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: tags_delete

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 204, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: list_templates

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: create_template

{
  "type": "object",
  "properties": {
    "name": {},
    "description": {},
    "subject": {},
    "body": {},
    "from": {},
    "fromName": {},
    "replyTo": {},
    "type": {}
  },
  "required": [
    "name",
    "subject",
    "body",
    "from"
  ],
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: get_template

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: update_template

{
  "type": "object",
  "properties": {
    "name": {},
    "description": {},
    "subject": {},
    "body": {},
    "from": {},
    "fromName": {},
    "replyTo": {},
    "type": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: delete_template

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 204, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: templates_bulk_update

{
  "type": "object",
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uuid"
      },
      "minItems": 1,
      "maxItems": 1000
    },
    "delete": {
      "type": "boolean"
    }
  },
  "required": [
    "ids"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: templates_duplicate

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: templates_get_usage

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "format": {},
    "content": {}
  },
  "additionalProperties": true
}

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Public/application-specific authentication; see the flow-specific guide.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Public/token-authenticated application flow. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 302, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: uploads_upload_image

{
  "type": "object",
  "required": [
    "image"
  ],
  "properties": {
    "image": {
      "type": "string",
      "format": "binary"
    }
  }
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: list_webhooks

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: create_webhook

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "minLength": 1
    },
    "description": {
      "type": "string",
      "maxLength": 500
    },
    "events": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "email.sent",
          "email.opened",
          "email.clicked",
          "email.bounced",
          "email.complained",
          "email.unsubscribed",
          "email.received",
          "contact.created",
          "contact.updated",
          "contact.subscribed",
          "contact.unsubscribed",
          "contact.deleted",
          "campaign.scheduled",
          "campaign.sent",
          "campaign.cancelled"
        ]
      }
    },
    "inboundDomain": {
      "type": "string",
      "maxLength": 253,
      "nullable": true
    },
    "inboundPattern": {
      "type": "string",
      "maxLength": 64,
      "nullable": true
    },
    "enabled": {
      "type": "boolean"
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: get_webhook

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: update_webhook

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "minLength": 1
    },
    "description": {
      "type": "string",
      "maxLength": 500
    },
    "events": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "email.sent",
          "email.opened",
          "email.clicked",
          "email.bounced",
          "email.complained",
          "email.unsubscribed",
          "email.received",
          "contact.created",
          "contact.updated",
          "contact.subscribed",
          "contact.unsubscribed",
          "contact.deleted",
          "campaign.scheduled",
          "campaign.sent",
          "campaign.cancelled"
        ]
      }
    },
    "inboundDomain": {
      "type": "string",
      "maxLength": 253,
      "nullable": true
    },
    "inboundPattern": {
      "type": "string",
      "maxLength": 64,
      "nullable": true
    },
    "enabled": {
      "type": "boolean"
    },
    "rotateSecret": {
      "type": "boolean"
    }
  },
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: delete_webhook

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: list_webhook_deliveries

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: test_webhook

{
  "type": "object",
  "properties": {
    "event": {
      "type": "string",
      "enum": [
        "test",
        "email.received"
      ]
    },
    "recipient": {
      "type": "string",
      "maxLength": 320,
      "format": "email"
    }
  },
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "minLength": 1,
      "maxLength": 100
    }
  },
  "required": [
    "name"
  ],
  "additionalProperties": false
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "minLength": 1,
      "maxLength": 100
    },
    "tracking": {
      "type": "string",
      "enum": [
        "ENABLED",
        "DISABLED",
        "MARKETING_ONLY"
      ]
    },
    "language": {
      "type": "string",
      "pattern": "^[a-z]{2}(-[A-Z]{2})?$"
    }
  },
  "additionalProperties": false
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "workflows": {
      "type": "integer",
      "exclusiveMinimum": true,
      "minimum": 0,
      "nullable": true
    },
    "campaigns": {
      "type": "integer",
      "exclusiveMinimum": true,
      "minimum": 0,
      "nullable": true
    },
    "transactional": {
      "type": "integer",
      "exclusiveMinimum": true,
      "minimum": 0,
      "nullable": true
    },
    "inbound": {
      "type": "integer",
      "exclusiveMinimum": true,
      "minimum": 0,
      "nullable": true
    }
  },
  "required": [
    "workflows",
    "campaigns",
    "transactional",
    "inbound"
  ],
  "additionalProperties": false
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

{
  "type": "object",
  "properties": {
    "paymentMethodId": {}
  },
  "required": [
    "paymentMethodId"
  ],
  "additionalProperties": true
}

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Dashboard user session; API keys cannot perform this account/security operation.

MCP: Not exposed through remote MCP; account administration, credentials, browser tracking, and dashboard aliases retain their own authorization.

Account/security operation requires a dashboard user session. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: warmup_list

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: warmup_create

{
  "type": "object",
  "properties": {
    "domain": {},
    "fromAddress": {},
    "toAddresses": {},
    "maxLimit": {},
    "rampupDays": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: warmup_get

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: warmup_update

{
  "type": "object",
  "properties": {
    "enabled": {},
    "toAddresses": {},
    "maxLimit": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: warmup_remove

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 204, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: warmup_advance

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_list

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_create

{
  "type": "object",
  "properties": {
    "name": {},
    "description": {},
    "triggerType": {},
    "eventName": {},
    "cronExpression": {},
    "enabled": {},
    "allowReentry": {}
  },
  "required": [
    "name"
  ],
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_get_available_fields

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_bulk_update

{
  "type": "object",
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uuid"
      },
      "minItems": 1,
      "maxItems": 1000
    },
    "delete": {
      "type": "boolean"
    },
    "enabled": {
      "type": "boolean"
    }
  },
  "required": [
    "ids"
  ],
  "additionalProperties": false
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_generate_with_ai

{
  "type": "object",
  "properties": {
    "prompt": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_get

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_update

{
  "type": "object",
  "properties": {
    "name": {},
    "description": {},
    "triggerType": {},
    "triggerConfig": {},
    "enabled": {},
    "allowReentry": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_delete

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 204, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_duplicate

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_add_step

{
  "type": "object",
  "properties": {
    "type": {},
    "name": {},
    "position": {},
    "config": {},
    "templateId": {},
    "autoConnect": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_update_step

{
  "type": "object",
  "properties": {
    "name": {},
    "position": {},
    "config": {},
    "templateId": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 200, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_delete_step

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 204, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_create_transition

{
  "type": "object",
  "properties": {
    "fromStepId": {},
    "toStepId": {},
    "condition": {},
    "priority": {}
  },
  "additionalProperties": true
}

Project-scoped customer operation. Server enforces project ownership and additional cross-field validation. IDs are UUIDs, not prefixed placeholders.

Response codes: 201, 400, 401, 403, 404, 429, 500, 503. Errors do not imply that an uncertain send is safe to repeat. A successful sending response confirms API acceptance, not inbox delivery.

Authentication: Secret project API key. Resources are scoped to that project.

MCP: workflows_insert_step_on_transition