API Docs

API reference

A curated map of supported customer integrations and the contracts that explain them.

Customer integration endpoints

Identity

  • GET /api/v1/account

Transactional email

  • POST /api/v1/outbound-messages
  • GET /api/v1/outbound-messages
  • GET /api/v1/outbound-messages/{id}

Mailgun compatibility

  • POST /api/compat/mailgun/v3/{domain}/messages

Public forms

  • GET /api/v1/forms/{form_id}
  • GET /api/v1/forms/{form_id}/captcha
  • POST /api/v1/forms/{form_id}/submissions

Inbound routes

Report routes can be created with an authorized API token or a signed-in session.

  • GET /api/v1/inbound-routes
  • POST /api/v1/inbound-routes
  • POST /api/v1/inbound-routes/dmarc-report
  • POST /api/v1/inbound-routes/tls-report
  • GET /api/v1/inbound-routes/{id}
  • PATCH /api/v1/inbound-routes/{id}
  • DELETE /api/v1/inbound-routes/{id}
  • POST /api/v1/inbound-routes/{id}/test-webhook
  • POST /api/v1/inbound-routes/{id}/signing-secret/regenerate

TLS reports

Reading TLS reports requires a signed-in session. API tokens are not accepted.

  • GET /api/v1/tls-reports
  • GET /api/v1/tls-reports/{id}
  • GET /api/v1/tls-reports/import-health
  • GET /api/v1/tls-reports/alerts

Inbound messages

  • GET /api/v1/inbound-messages
  • GET /api/v1/inbound-messages/{id}
  • GET /api/v1/inbound-messages/{id}/raw

Agent protocols

  • POST /mcp
  • GET /.well-known/agent-card.json
  • POST /a2a

OpenAPI file

The complete OpenAPI file is available in Console Settings together with the correct API access information for your deployment. Authentication is required because that file covers more than the stable customer-integration surface summarized here.

Generate clients selectively and review generated operations before exposing them in your product. The friendly guides define supported workflows, security requirements, and operational behavior that a schema alone cannot explain.

Compatibility

Mailgun compatibility covers the documented sending subset only; it is not a claim that every Mailgun endpoint, field, SDK, or behavior is implemented. MCP and A2A support the tools and skills documented in the transactional email guide. Do not infer support from an unlisted path.

Versioning and deprecation

Paths under /api/v1 and versioned webhook headers identify their contract generation. New optional response fields may be added compatibly, so clients must ignore unknown fields.

A breaking request, response, authentication, or signature change will use a new contract version and migration guidance. Deprecations will be announced through customer-facing documentation or account communication when practicable. Operational limits may change independently; follow current documentation and response headers.

Security checklist

  • Keep API tokens and signing secrets server-side and out of URLs and logs.
  • Use the least-capable token scope and revoke credentials that are no longer needed.
  • Verify webhook signatures over the unchanged request bytes.
  • Validate all addresses, message content, form fields, and received email before using them in another system.
  • Do not include credentials or message content in support requests unless support explicitly provides a secure method.