REST API
Automate what your team does today. Every UI action has an endpoint.
Manage providers, routing rules, ramps, inboxes, parsers, suppression lists, DMARC domains and webhooks from a script. Every key is scoped, revocable and rotatable — no shared admin credential your CI job hangs on.
Sound familiar?
“It works in the dashboard; we can’t automate it.”
Your ESP has an admin dashboard and an API. The two do not cover the same operations. The bounce-list cleaner runs by a human clicking a button; the provider-failover switch is UI-only; the suppression export needs a support ticket. So your on-call runbook is a screenshot walkthrough, and your Terraform never touches email.
sendrules is API-parity by design. Every UI action has an endpoint behind it, in the same versioned REST API. Whatever your team does by hand today, a script can do tomorrow — with an audit-trail entry naming the API key that fired it.
API surface
What you can automate on day one.
Providers
Add, update, test, pause, resume, and delete providers. Rotate provider credentials without touching the app. Configure per-provider daily and per-minute limits.
Routing rules
Create rules, attach providers, set strategy (round-robin, weighted, priority, random, sticky, MX-based ISP), configure quality-gate policy per rule, and rotate SMTP credentials — all programmatic.
Ramps
Start, pause, safe-bump, override, and lift-cap on every warm-up ramp. Read ramp status and daily projections for dashboards you already have.
Inbound and parsers
Manage inboxes, forward webhooks, autoresponder parsers, and rules within parsers. Bulk-export parsed contacts as CSV.
Suppression and allow lists
Bulk-import, export as CSV, single-address add and delete. Every entry respects tenant scope; nothing bleeds between workspaces.
Deliverability
List DMARC domains, add and verify, query aggregate report data, list Postmaster domains, kick off a seed-list run, list current blocklist status per monitored IP or domain.
Activity and reports
Query messages by any filter available in the UI, page through them, request a report over any measure set and grouping, subscribe to a saved view, generate a share link for a filtered slice.
Webhooks
Create, list, edit, delete, and test webhook subscriptions. Query the deliveries log per webhook. Trigger a replay.
Key management
Scoped. Rotatable. Revocable without a support ticket.
Per-key permissions
Every API key carries its own permission set — the same fine-grained catalogue the roles system uses. A key for a CI job that only creates suppression entries gets exactly one permission. A key for a bounce-list scrubber gets read on activity, write on suppression, and nothing else.
Per-key expiry
Every key can carry an expiry. The default for a new key is 12 months; you can set anything from 24 hours to indefinite. Keys past their expiry return a clean 401 with the expiry timestamp so your monitor can page.
Per-key IP allow-list
Restrict a key to a specific list of network ranges (CIDR blocks). A leaked key from outside your CI runner’s network cannot authenticate, even with the correct value.
Prefix in every log line
Keys use a public prefix (`grid_sk_`) followed by a unique id + secret. The secret half is only shown once at creation; every log line and audit entry records the id so you can trace an action to the exact key without ever seeing the secret.
Rotation
Rotating a key generates a new secret against the same id + permission set + expiry. Old secret stops working immediately (no grace window — a rotation is always a response to a suspected leak).
Revocation
Deleting a key returns 401 for every subsequent request. Every deletion is captured in the audit trail with the reason field the deleter typed.
Integration patterns
What teams actually build.
Bounce-list scrubber
Nightly job reads yesterday’s bounces from Activity, cross-references against your own user table, deletes users who are hard-bounced, and adds them to a permanent suppression entry.
Provider failover automation
Wire the provider-health-change webhook to your incident runbook. When provider A drops below the health threshold, a script pauses it via the API so the routing rule falls through to provider B without waiting for the built-in failover to kick in.
Terraform-managed rules
Manage every routing rule + provider attachment in Terraform so the sending config is version-controlled alongside the rest of your infrastructure. Changes flow through PR review; no drift between UI and code.
Regulator export
Quarterly script pulls the audit trail + activity for the previous three months into a CSV bundle, drops it in your compliance bucket, and emails the risk team. No human clicks Export.