MailStack
API reference

API reference

A RESTful JSON API over HTTPS. The base URL is https://api.mailstack.voostack.com. The send API is authenticated with a Bearer API key; dashboard resources use a user token and an organization header. Pick a resource to see every endpoint with request/response JSON and code samples in cURL, Node, .NET, Go, and Flutter.

Authentication

The send API (/v1/emails) authenticates with an API key — it resolves to your organization automatically:

Authorization: Bearer ms_live_xxxxxxxxxxxxxxxxxxxx

The dashboard resources (domains, senders, templates, API keys, webhooks, billing, messages) authenticate with a user token plus your organization id:

Authorization: Bearer <token>
X-MailStack-Org: org_xxxxxxxxxxxx

Resources

Emails

API key

Send transactional email — single, batch, and personalized bulk sends — plus pre-send lint, scheduling, cancellation, and status lookups.

7 endpoints

Messages

Token

Read the message log — the Activity feed and Dev Inbox — and a per-message delivery timeline for end-to-end observability.

3 endpoints

Domains

Token

Register sending domains, publish DNS records, verify SPF/DKIM/DMARC alignment, and check domains against public blocklists.

6 endpoints

Senders

Token

Manage from-identities (e.g. support@yourdomain.com) backed by your verified sending domains, including the default sender.

4 endpoints

Templates

Token

Create and publish reusable email templates from the canonical block document — compiled server-side to MJML and cross-client HTML.

7 endpoints

API keys

Token

Create scoped API keys (live and test mode), list their metadata, and revoke them. Full secrets are shown exactly once.

3 endpoints

Webhooks

Token

Subscribe to delivery events, inspect the delivery feed, replay failed deliveries, and verify signatures with the shared secret.

8 endpoints

Billing

Token

Read usage for the current period, attach a payment method via Stripe, open the billing portal, and set a monthly spend cap.

5 endpoints

Errors & status codes

  • 200 OK — a read/list/verify succeeded.
  • 202 Accepted — a send was queued.
  • 400 Bad Request — validation failed (e.g. unverified from-domain).
  • 401 Unauthorized — missing or invalid credentials.
  • 402 Payment Required — free tier exhausted with no payment method, or spend cap reached.
  • 403 Forbidden — missing scope or no active organization.
  • 404 Not Found — resource doesn't exist in your org.
  • 409 Conflict — duplicate (e.g. domain or key name already exists).

Error responses are JSON with an error message and a traceId. New to the API? Start with the quickstart or pick an official SDK.