honkio-ca Email Suppressions API

openapi: 3.2.0
info:
  title: HonkIO Email Suppressions API
  description: 'Canadian-focused SMS gateway API.


    ## Canadian Compliance

    - **CASL**: All commercial messages require consent. Use `/v1/compliance/consents` to record.

    - **DNCL**: CRTC Do Not Call List checking is coming soon (not yet enforced).

    - **PIPEDA / Quebec Law 25**: Data is stored in Canada (ca-central-1). Requests are processed in the United States in transit. Right-to-erasure available.


    ## Authentication

    Provide your API key via `Authorization: Bearer mk_live_...` or `X-API-Key: mk_live_...`.

    Test keys never send, never charge and can''t change live data; they work before your first top-up.


    ## Rate limits

    100 requests per second per account. Every authenticated response carries `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`.


    ## Pagination

    Shape follows the route family, not one convention across the API: documented here rather than changed. Messages listings return `{ data, meta: { page, limit, total, pages } }`. Contacts, Contact Groups, Lists and Verify listings return `{ data, total, limit, offset }`. Compliance consent and opt-out listings accept `page`/`limit` and return `{ data }`, with no total. Account transactions use a cursor: pass `before`, get back `has_more`.'
  version: 1.0.0
  contact:
    name: HonkIO Support
    email: support@honkio.ca
servers:
- url: https://api.honkio.ca
  description: Production
- url: http://localhost:3000
  description: Local development
security:
- apiKey: []
- apiKeyHeader: []
tags:
- name: Email Suppressions
  description: Manage email suppression lists
paths:
  /v1/email-suppressions:
    post:
      summary: Suppress an email address
      tags:
      - Email Suppressions
      description: 'Adds the address to the suppression list with the reason `manual`. A send to a suppressed address is refused with `EMAIL_SUPPRESSED`. Live keys only: the list has no test mode.


        Requires `email_suppressions:w`.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                email_address:
                  type: string
                  format: email
                  description: The address. No email is sent to it again until you remove it.
                reason:
                  type: string
                  enum:
                  - manual
                  description: 'Always manual: bounces, complaints and unsubscribes are added automatically.'
              required:
              - email_address
              - reason
              description: The address to block.
        description: The address to block.
      security:
      - apiKey: []
      - apiKeyHeader: []
      x-honkio-permission: email_suppressions:w
      responses:
        '201':
          description: The suppressed address, lowercased.
          content:
            application/json:
              schema:
                description: The suppressed address, lowercased.
                type: object
                additionalProperties: true
                required:
                - email_address
                - reason
                properties:
                  email_address:
                    type: string
                  reason:
                    type: string
                    enum:
                    - manual
        '401':
          description: Missing, invalid, revoked or expired API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '402':
          description: The account has no balance, or a LIVE key was used before the first top-up.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: 'LIVE_KEY_REQUIRED: the suppression list has no test mode and live sends are checked against it, so a test key can read it but not change it. Also FORBIDDEN when the key lacks the permission this operation requires, or the account is suspended or closed.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: 'VALIDATION_ERROR: the request failed validation; details names the fields.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: 'Rate limit reached: 100 requests per second per account, or a route-specific limit (Retry-After set where one applies).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: postV1EmailSuppressions
      x-operation-id-source: derived
    get:
      summary: List suppressed email addresses
      tags:
      - Email Suppressions
      description: 'Newest first. Filter with `reason` (`hard_bounce`, `complaint`, `unsubscribe` or `manual`) and page with `limit` (default 50, up to 100) and `cursor`.


        Requires `email_suppressions:r`.'
      security:
      - apiKey: []
      - apiKeyHeader: []
      x-honkio-permission: email_suppressions:r
      responses:
        '401':
          description: Missing, invalid, revoked or expired API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '402':
          description: The account has no balance, or a LIVE key was used before the first top-up.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: The API key lacks the permission this operation requires, or the account is suspended or closed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: 'Rate limit reached: 100 requests per second per account, or a route-specific limit (Retry-After set where one applies).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: getV1EmailSuppressions
      x-operation-id-source: derived
  /v1/email-suppressions/{address}:
    delete:
      summary: Remove an address from the suppression list
      tags:
      - Email Suppressions
      description: 'Answers 204, or 404 when the address is not suppressed. Live keys only: the list has no test mode.


        Requires `email_suppressions:d`.'
      security:
      - apiKey: []
      - apiKeyHeader: []
      x-honkio-permission: email_suppressions:d
      parameters:
      - schema:
          type: string
        in: path
        name: address
        required: true
      responses:
        '204':
          description: 'Removed: the address can receive email again.'
        '401':
          description: Missing, invalid, revoked or expired API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '402':
          description: The account has no balance, or a LIVE key was used before the first top-up.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: 'LIVE_KEY_REQUIRED: the suppression list has no test mode and live sends are checked against it, so a test key can read it but not change it. Also FORBIDDEN when the key lacks the permission this operation requires, or the account is suspended or closed.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: 'NOT_FOUND (details.resource "email_suppression"): the address is not suppressed.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: 'Rate limit reached: 100 requests per second per account, or a route-specific limit (Retry-After set where one applies).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: deleteV1EmailSuppressionsByAddress
      x-operation-id-source: derived
components:
  schemas:
    Error:
      type: object
      description: Standard error body. The one visible exception is the OAuth 2.1 surface (/oauth/token, /oauth/register, /oauth/revoke), which follows RFC 6749/7591/7009 and answers { error, error_description } instead.
      required:
      - code
      - message
      - statusCode
      properties:
        code:
          type: string
          description: Machine-readable error code, e.g. VALIDATION_ERROR.
        message:
          type: string
          description: Human-readable message in the request's locale (Accept-Language).
        messageEn:
          type: string
          description: English message, always present alongside message.
        messageFr:
          type: string
          description: French message, always present alongside message.
        statusCode:
          type: integer
          description: The HTTP status, repeated in the body.
        details:
          description: 'Present on some errors: an AJV validation array, or error-specific structured detail.'
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: Use `mk_live_...` for production or `mk_test_...` for testing.
    apiKeyHeader:
      type: apiKey
      in: header
      name: X-API-Key
      description: 'Alternative to the Authorization header: send `mk_live_...` or `mk_test_...` as X-API-Key directly.'