Base URL
All Sending API requests should be made to:This is a different base URL from the Management
API (
app.sendmux.ai).Authentication
Authenticate using an API key with theemail.send permission. Pass it as a Bearer token in the Authorization header.
email.send permission. Send-only keys and mailbox keys use the smx_mbx_ prefix; root keys use smx_root_.
Permissions
| Endpoint | Required permission |
|---|---|
POST /api/v1/emails/send | email.send |
POST /api/v1/emails/send/batch | email.send |
GET /api/v1/openapi.json | None (public) |
provider.* permissions.
Response format
All responses use the same JSON envelope as the Management API.Success
Error
code, message, param, doc_url, retryable, accumulated errors[], X-Request-Id, and Retry-After. See the Sending API error reference for email delivery codes.
Rate limits
Each send-only or mailbox key used on the Sending API is rate-limited to 1,800 requests per 60 seconds. A batch send counts as 1 request, regardless of how many messages it contains. Management API keys are limited separately to 600 requests per 60 seconds. See the Management API introduction. Every response carries the current rate-limit state plus a request identifier:X-Request-Id matches meta.request_id in the JSON envelope. Include it when contacting support.
When the limit is exceeded, the API returns a 429 status with a Retry-After header indicating how many seconds to wait before retrying.
Conditional requests
Single-resourceGET responses return a weak ETag. Send it back in an If-None-Match header on the next request; if the resource is unchanged the API responds 304 Not Modified with no body, saving bandwidth. This is supported across the Sending API and the Management API mailbox, domain, webhook, and log resources.
Conventions
- snake_case fields in all JSON request and response bodies
- UTC ISO 8601 timestamps in RFC 3339 format:
2026-03-19T10:30:00Z - Public IDs only. Private numeric IDs are never exposed.
Cache-Control: no-storeon all authenticated responses (the OpenAPI spec endpoint usespublic, max-age=3600)- JSON only. Use
Content-Type: application/json.