Sending mail from your own scripts (send API)
Your website's contact form, a monitoring script or a small service can send mail as your mailbox over the web, with one HTTPS request: no mail server and no SMTP settings. Mail sent this way goes through the same checks as mail you send yourself (your sending limits, risky attachments, virus scanning), is signed with your domain's DKIM key, and is kept in the compliance archive when your organization has one. It is not filed in your Sent folder.
This needs a plan that includes Send API.
Making a token
In webmail, open Settings → Account and security → Send API, give the token a name (such as "Website contact form"), enter your current password and choose Make token. If you sign in with Zappocity, you confirm it's you there instead.
The token (cs_mt_...) is shown once: copy it into your script's settings then. Treat it like a password. It can only send, and only as your own mailbox. Your recovery address is told whenever one is made. Remove a token there and anything using it stops at once.
A token stops working when your plan no longer includes the send API or your mailbox is suspended. While your sending is suspended or paused, what it sends is refused, as mail you send yourself would be.
Sending
Send a POST to /api/mail/send on your webmail address, with the token and a JSON body:
curl https://mail.example.com/api/mail/send \
-H 'Authorization: Bearer cs_mt_...' \
-H 'Content-Type: application/json' \
-d '{"to": ["amy@example.com"], "subject": "Hello", "text": "Hi Amy", "html": "<p>Hi Amy</p>"}'| Field | What it is |
|---|---|
to | addresses, at least one |
cc, bcc | more addresses; Bcc recipients are not shown to the others |
replyTo | where replies go (up to 5) |
subject | one line |
text, html | the message, as plain text, HTML or both |
fromName | the name shown with your address |
attachments | files: {"filename": "invoice.pdf", "contentType": "application/pdf", "content": "<base64>"}, up to 20 |
Addresses are plain (amy@example.com, not Amy <amy@example.com>), at most 50 recipients in all. The message is always from your own address; fromName only changes the name shown. The whole message must fit your plan's message size.
The answer is 202 with {"sent": 3} (the recipients it went to). A refusal says why: 401 for a missing, removed or no longer allowed token, 422 for a bad address, too many recipients or something your limits do not allow (with the reason), 413 for a message too large.
When you send only to, subject, text and fromName, each recipient gets a copy of their own, addressed only to them.
Questions
- Can I send as another address? No: the API sends as your mailbox only. For a server that sends for many addresses on your domain, your administrator can set up a relay credential.
- Where are the messages? In the recipients' mailboxes, and in your organization's archive if it keeps one. The message trace shows each one.