sendmux-ai Domains API

openapi: 3.2.0
info:
  description: Programmatic access to your Sendmux email infrastructure.
  title: Sendmux Domains API
  version: 1.0.0
servers:
- description: API v1
  url: https://app.sendmux.ai/api/v1
security:
- bearerAuth: []
- oauth2: []
tags:
- name: Domains
paths:
  /domains:
    get:
      description: Returns a cursor-paginated list of sending domains configured for the team, ordered by `created_at` descending. Each entry includes the DNS records the customer must place, the current verification status, and the SES DKIM state. Pass `cursor=` from the previous response to fetch the next page.
      operationId: managementListDomains
      parameters:
      - in: query
        name: cursor
        required: false
        schema:
          description: Pagination cursor — the `next_cursor` from the previous response.
          type: string
      - in: query
        name: limit
        required: false
        schema:
          description: Maximum results (default 50, max 100)
          maximum: 100
          minimum: 1
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DomainItemCursorListResponse'
          description: Domain list
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Authentication required
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Insufficient permissions
      security:
      - bearerAuth: []
      - oauth2:
        - domain.read
      summary: List mailbox domains
      tags:
      - Domains
    post:
      description: 'Creates a new domain and returns the DNS records the customer must place before verification can succeed. `send_only` configures outbound sending without changing MX records. `send_receive` also configures the domain for hosted mailboxes. Provisioning touches our email platform and Amazon SES; on any failure the partial state is automatically rolled back.


        Supply an `Idempotency-Key` header (any unique string, max 255 chars) to safely retry on network errors. Replays with the same key return the original response; replays with a different body return `409 idempotency_conflict`.'
      operationId: managementCreateDomain
      parameters:
      - in: header
        name: Idempotency-Key
        required: false
        schema:
          description: Client-chosen unique key to safely retry the request. Cached for 24h per (team, endpoint, key). Different body with same key returns 409 idempotency_conflict.
          example: domains-create-20260424-001
          maxLength: 255
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                domain:
                  description: Fully qualified domain name. Must be lowercased and domain-only (no scheme).
                  example: mail.acme.com
                  type: string
                mode:
                  description: Domain usage mode. Defaults to `send_receive` when omitted.
                  enum:
                  - send_only
                  - send_receive
                  example: send_only
                  type: string
              required:
              - domain
              type: object
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DomainItemResponse'
          description: Domain created. The response carries a `Location` header pointing at the canonical GET URL for the new domain.
          headers:
            Location:
              description: Canonical GET URL for the newly created domain.
              schema:
                example: /api/v1/domains/mdom_clxxxxxxxxxxxxxxxxxxxxxxxxx
                type: string
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Invalid request body
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Domain already in use, or `Idempotency-Key` was replayed with a different body.
        '413':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Request body too large
        '503':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: SES tenant not yet provisioned for this team
      security:
      - bearerAuth: []
      - oauth2:
        - domain.create
      summary: Add a mailbox domain
      tags:
      - Domains
  /domains/{public_id}:
    delete:
      description: Removes a domain from our mail platform, Amazon SES, and Sendmux. Blocked if any active mailbox still uses the domain — delete those mailboxes first.
      operationId: managementDeleteDomain
      parameters:
      - in: path
        name: public_id
        required: true
        schema:
          description: Domain public ID
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DomainDeletedResponse'
          description: Deletion result
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Domain not found
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Domain still has active mailboxes (error code `conflict`).
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected server error.
        '503':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Deletion is temporarily unavailable; retry after the indicated delay.
          headers:
            Retry-After:
              description: Seconds to wait before retrying.
              schema:
                example: 30
                type: integer
      security:
      - bearerAuth: []
      - oauth2:
        - domain.delete
      summary: Delete a mailbox domain
      tags:
      - Domains
    get:
      description: Returns a single domain including its DNS records and latest verification state. Responses carry a weak `ETag` header — send it back as `If-None-Match` on the next request and the server will return `304 Not Modified` (no body) when the resource has not changed.
      operationId: managementGetDomain
      parameters:
      - in: path
        name: public_id
        required: true
        schema:
          description: Domain public ID
          example: mdom_clxxxxxxxxxxxxxxxxxxxxxxxxx
          type: string
      - in: header
        name: If-None-Match
        required: false
        schema:
          description: Weak ETag from a previous response. Returns 304 when unchanged.
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DomainItemResponse'
          description: Domain
          headers:
            ETag:
              description: Weak ETag for conditional GETs.
              schema:
                example: W/"a1b2c3d4e5f60718"
                type: string
        '304':
          description: Not Modified — the client's cached copy (matching `If-None-Match`) is still current.
          headers:
            ETag:
              description: Current weak ETag (same as request's `If-None-Match`).
              schema:
                type: string
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Domain not found
      security:
      - bearerAuth: []
      - oauth2:
        - domain.read
      summary: Get a mailbox domain
      tags:
      - Domains
    patch:
      description: Upgrades a send-only domain to sending and receiving. Downgrades are rejected. After upgrade, the domain returns to `pending` until the required MX record verifies.
      operationId: managementUpdateDomain
      parameters:
      - in: path
        name: public_id
        required: true
        schema:
          description: Domain public ID
          example: mdom_clxxxxxxxxxxxxxxxxxxxxxxxxx
          type: string
      - in: header
        name: If-Match
        required: false
        schema:
          description: Weak ETag from a prior GET. Reject with 409 conflict when the server's current ETag differs.
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              properties:
                mode:
                  description: The only supported update is upgrading to `send_receive`.
                  enum:
                  - send_receive
                  example: send_receive
                  type: string
              required:
              - mode
              type: object
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DomainItemResponse'
          description: Updated domain
          headers:
            ETag:
              description: Weak ETag for the post-update resource.
              schema:
                type: string
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Invalid request body
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Domain not found
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: '`If-Match` mismatch, or the domain cannot be upgraded in its current state.'
        '413':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Request body too large
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: 'Unsupported update. Only `{ mode: "send_receive" }` is accepted.'
      security:
      - bearerAuth: []
      - oauth2:
        - domain.create
      summary: Update a mailbox domain
      tags:
      - Domains
  /domains/{public_id}/verify:
    post:
      description: Checks the domain's published DNS records and latest Amazon SES DKIM and MAIL FROM statuses. If every required check passes, the domain is marked verified. A previously failed domain remains failed until a complete check succeeds. Domains automatically re-verify every 6 hours — this endpoint is only needed to trigger a check on demand.
      operationId: managementVerifyDomain
      parameters:
      - in: path
        name: public_id
        required: true
        schema:
          description: Domain public ID
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DomainVerifyResponse'
          description: Verification result
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Domain not found
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The domain changed while verification was running.
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected server error.
        '503':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Verification is temporarily unavailable; retry after the indicated delay.
          headers:
            Retry-After:
              description: Seconds to wait before retrying.
              schema:
                example: 30
                type: integer
      security:
      - bearerAuth: []
      - oauth2:
        - domain.verify
      summary: Verify a mailbox domain
      tags:
      - Domains
  /domains/{public_id}/zone-file:
    get:
      description: Returns the domain's DNS records formatted as a BIND-style zone file fragment. Suitable for direct paste into a DNS provider that accepts zone-file imports.
      operationId: managementGetDomainZoneFile
      parameters:
      - in: path
        name: public_id
        required: true
        schema:
          description: Domain public ID
          type: string
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: Zone file (text/plain)
          headers:
            Content-Disposition:
              description: Attachment filename `<domain>.zone`.
              schema:
                example: attachment; filename="mail.acme.com.zone"
                type: string
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Domain not found
      security:
      - bearerAuth: []
      - oauth2:
        - domain.read
      summary: Download a domain as a zone file
      tags:
      - Domains
components:
  schemas:
    ResponseMeta:
      additionalProperties: false
      properties:
        request_id:
          example: req_clxxxxxxxxxxxxxxxxxxxxxxxxx
          type: string
      required:
      - request_id
      type: object
    DomainDeletedResponse:
      allOf:
      - $ref: '#/components/schemas/SuccessEnvelope'
      - properties:
          data:
            additionalProperties: false
            properties:
              deleted:
                enum:
                - true
                type: boolean
              id:
                type: string
            required:
            - deleted
            - id
            type: object
          meta:
            $ref: '#/components/schemas/ResponseMeta'
        required:
        - data
        type: object
      unevaluatedProperties: false
    MailboxDomain:
      additionalProperties: false
      properties:
        created_at:
          description: ISO 8601 creation timestamp
          type: string
        dns_records:
          $ref: '#/components/schemas/MailboxDomainDnsRecords'
        domain:
          description: Fully qualified domain name
          example: mail.acme.com
          type: string
        id:
          description: Public ID
          example: mdom_clxxxxxxxxxxxxxxxxxxxxxxxxx
          type: string
        mailbox_count:
          description: Active mailboxes currently using this domain
          example: 14
          minimum: 0
          type: integer
        mode:
          description: '`send_only` verifies outbound DNS only. `send_receive` also verifies MX records and can host mailboxes.'
          enum:
          - send_only
          - send_receive
          example: send_receive
          type: string
        ses_dkim_signing_enabled:
          description: Whether Amazon SES DKIM signing is currently enabled for this identity
          type:
          - boolean
          - 'null'
        ses_dkim_status:
          description: Amazon SES DKIM status (pending/success/failed/temporary_failure/not_started)
          type:
          - string
          - 'null'
        ses_identity_checked_at:
          description: ISO 8601 timestamp of the latest complete Amazon SES identity check
          type:
          - string
          - 'null'
        ses_identity_verification_status:
          description: Latest Amazon SES identity verification status
          type:
          - string
          - 'null'
        ses_mail_from_status:
          description: Amazon SES MAIL FROM status (pending/success/failed/temporary_failure/not_started)
          type:
          - string
          - 'null'
        ses_verified_for_sending:
          description: Whether Amazon SES currently permits sending for this identity
          type:
          - boolean
          - 'null'
        verification_status:
          description: Current verification state
          enum:
          - pending
          - verified
          - failed
          type: string
        verified_at:
          description: ISO 8601 timestamp of last successful verification
          type:
          - string
          - 'null'
      required:
      - id
      - domain
      - mode
      - verification_status
      - ses_identity_verification_status
      - ses_verified_for_sending
      - ses_dkim_status
      - ses_dkim_signing_enabled
      - ses_identity_checked_at
      - ses_mail_from_status
      - verified_at
      - created_at
      - mailbox_count
      - dns_records
      type: object
    MailboxDomainMxRecord:
      additionalProperties: false
      properties:
        priority:
          example: 10
          type: integer
        target:
          example: mail.sendmux.ai
          type: string
      required:
      - priority
      - target
      type: object
    MailboxDomainNamedMxRecord:
      additionalProperties: false
      description: MX record for Amazon SES bounce handling
      properties:
        name:
          example: bounce.acme.com
          type: string
        priority:
          example: 10
          type: integer
        target:
          example: feedback-smtp.eu-central-1.amazonses.com
          type: string
      required:
      - name
      - priority
      - target
      type: object
    ApiErrorDetail:
      additionalProperties: false
      properties:
        code:
          description: Machine-readable issue code from the validator (e.g. zod issue code).
          example: invalid_string
          type: string
        field:
          description: Dot-path of the offending request field.
          example: recipient.email
          type: string
        message:
          description: Human-readable issue description.
          type: string
      required:
      - field
      - code
      - message
      type: object
    SuccessEnvelope:
      properties:
        meta:
          additionalProperties: {}
          properties: {}
          type: object
        ok:
          enum:
          - true
          type: boolean
      required:
      - ok
      - meta
      type: object
    DomainItemCursorListResponse:
      allOf:
      - $ref: '#/components/schemas/SuccessEnvelope'
      - properties:
          data:
            items:
              $ref: '#/components/schemas/MailboxDomain'
            type: array
          meta:
            $ref: '#/components/schemas/ResponseMeta'
          pagination:
            $ref: '#/components/schemas/CursorPagination'
        required:
        - data
        - pagination
        type: object
      unevaluatedProperties: false
    MailboxDomainVerifyResult:
      additionalProperties: false
      properties:
        checks:
          $ref: '#/components/schemas/MailboxDomainVerifyChecks'
        ses_dkim_signing_enabled:
          description: Whether Amazon SES DKIM signing is enabled
          type: boolean
        ses_dkim_status:
          description: Latest Amazon SES DKIM status
          type: string
        ses_identity_checked_at:
          description: ISO 8601 time of this SES identity check
          type: string
        ses_identity_verification_status:
          description: Latest Amazon SES identity status
          type: string
        ses_mail_from_status:
          description: Latest Amazon SES MAIL FROM status
          type: string
        ses_verified_for_sending:
          description: Whether Amazon SES permits identity sending
          type: boolean
        status:
          description: Post-check verification status
          enum:
          - verified
          - pending
          - failed
          type: string
      required:
      - status
      - ses_identity_verification_status
      - ses_verified_for_sending
      - ses_dkim_status
      - ses_dkim_signing_enabled
      - ses_identity_checked_at
      - ses_mail_from_status
      - checks
      type: object
    MailboxDomainNameValueRecord:
      additionalProperties: false
      description: SPF TXT record for the custom MAIL FROM subdomain
      properties:
        name:
          example: _sendmux.acme.com
          type: string
        value:
          example: sendmux-verify=team_abc123
          type: string
      required:
      - name
      - value
      type: object
    DomainItemResponse:
      allOf:
      - $ref: '#/components/schemas/SuccessEnvelope'
      - properties:
          data:
            $ref: '#/components/schemas/MailboxDomain'
          meta:
            $ref: '#/components/schemas/ResponseMeta'
        required:
        - data
        type: object
      unevaluatedProperties: false
    MailboxDomainVerifyChecks:
      additionalProperties: false
      properties:
        dmarc:
          description: A DMARC record containing v=DMARC1 is present.
          type: boolean
        mail_from_mx:
          description: Custom MAIL FROM MX record matches expected value
          type: boolean
        mail_from_spf:
          description: Custom MAIL FROM SPF policy is compatible with the required Amazon SES sender authorisation.
          type: boolean
        mx:
          description: MX record present when the domain is configured for receiving. Always true for send-only domains.
          type: boolean
        spf:
          description: Published SPF policy is compatible with the required Amazon SES sender authorisation.
          type: boolean
        verification_txt:
          description: Ownership TXT record present with correct value
          type: boolean
      required:
      - mx
      - verification_txt
      - spf
      - dmarc
      - mail_from_mx
      - mail_from_spf
      type: object
    MailboxDomainMailFromRecords:
      additionalProperties: false
      description: Custom MAIL FROM records for Amazon SES bounce handling
      properties:
        mx:
          $ref: '#/components/schemas/MailboxDomainNamedMxRecord'
        spf:
          $ref: '#/components/schemas/MailboxDomainNameValueRecord'
      required:
      - mx
      - spf
      type: object
    DomainVerifyResponse:
      allOf:
      - $ref: '#/components/schemas/SuccessEnvelope'
      - properties:
          data:
            $ref: '#/components/schemas/MailboxDomainVerifyResult'
          meta:
            $ref: '#/components/schemas/ResponseMeta'
        required:
        - data
        type: object
      unevaluatedProperties: false
    CursorPagination:
      additionalProperties: false
      properties:
        has_more:
          type: boolean
        next_cursor:
          type: string
      required:
      - has_more
      type: object
    MailboxDomainDnsRecords:
      additionalProperties: false
      properties:
        dkim:
          description: Three Amazon SES DKIM CNAME records
          items:
            $ref: '#/components/schemas/MailboxDomainNameValueRecord'
          type: array
        dmarc:
          allOf:
          - $ref: '#/components/schemas/MailboxDomainNameValueRecord'
          - description: DMARC enforcement record (quarantine, no reporting)
        mail_from:
          $ref: '#/components/schemas/MailboxDomainMailFromRecords'
        mx:
          description: MX records the customer must place. All point at Sendmux's inbound mail servers.
          items:
            $ref: '#/components/schemas/MailboxDomainMxRecord'
          type: array
        spf:
          allOf:
          - $ref: '#/components/schemas/MailboxDomainNameValueRecord'
          - description: SPF TXT record covering Amazon SES sending
        verification:
          allOf:
          - $ref: '#/components/schemas/MailboxDomainNameValueRecord'
          - description: Ownership-proof TXT record (Sendmux-specific)
      required:
      - mx
      - mail_from
      - spf
      - dmarc
      - dkim
      - verification
      type: object
    ApiError:
      additionalProperties: false
      properties:
        error:
          additionalProperties: false
          properties:
            code:
              description: Machine-readable error code
              enum:
              - invalid_parameter
              - missing_parameter
              - authentication_required
              - insufficient_permissions
              - not_found
              - conflict
              - limit_exceeded
              - idempotency_conflict
              - payload_too_large
              - validation_error
              - rate_limit_exceeded
              - service_unavailable
              - internal_error
              example: invalid_parameter
              type: string
            doc_url:
              description: Link to relevant documentation
              type: string
            errors:
              description: Accumulated per-field issues for validation errors. Only present on 400/422 responses.
              items:
                $ref: '#/components/schemas/ApiErrorDetail'
              type: array
            message:
              description: Human-readable error description
              type: string
            param:
              description: The parameter that caused the error
              type: string
            retryable:
              description: Whether the caller may safely retry this request. 4xx are typically false (except 429); 5xx are typically true.
              example: false
              type: boolean
          required:
          - code
          - message
          - retryable
          type: object
        meta:
          additionalProperties: false
          properties:
            request_id:
              example: req_clxxxxxxxxxxxxxxxxxxxxxxxxx
              type: string
          required:
          - request_id
          type: object
        ok:
          enum:
          - false
          type: boolean
      required:
      - ok
      - error
      - meta
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: API Key
      description: Sendmux API key. Use a root API key for Management API routes, or a mailbox credential for Mailbox API routes. Obtain keys from the dashboard under API Keys.
      scheme: bearer
      type: http
    oauth2:
      description: Use the authorisation-code flow with S256 PKCE and resource=https://sendmux.ai/api. The user selects the team, API access and mailboxes during consent. OAuth access tokens authenticate HTTP API requests; use separate credentials for SMTP and IMAP.
      flows:
        authorizationCode:
          authorizationUrl: https://app.sendmux.ai/oauth/authorize
          refreshUrl: https://app.sendmux.ai/oauth/token
          scopes:
            analytics.*: All analytics operations
            analytics.read: View key usage analytics and verification logs
            billing.*: All billing operations
            billing.auto_topup: Configure auto top-up settings
            billing.read: View balance, transactions, invoices
            billing.topup: Purchase balance top-ups
            calendar.read: Read calendars and events in this mailbox
            calendar.write: Create calendars and create, edit and delete events in this mailbox
            domain.*: All domain operations
            domain.create: Add sending domains
            domain.delete: Remove domains
            domain.read: List/view domains and DNS status
            domain.verify: Trigger domain verification
            email.receive: Authorise email reception
            email.send: Send email through the HTTP API
            key.*: All key management operations
            key.create: Create new API keys (both root and mailbox)
            key.read: List/view API keys and their metadata
            key.revoke: Revoke API keys
            key.rotate: Rotate API keys
            logs.*: All log operations
            logs.read: View delivery logs
            mailbox.admin.*: All mailbox admin operations
            mailbox.admin.create: Create mailboxes (admin-level)
            mailbox.admin.delete: Delete mailboxes (admin-level)
            mailbox.admin.manage: Manage all mailbox settings
            mailbox.admin.read: List/view mailboxes (admin-level)
            mailbox.drafts.write: Create and edit saved mailbox drafts
            mailbox.read: Read mailbox contents (folders, messages)
            mailbox.settings.update: Update own mailbox settings (signature, auto-reply)
            provider.*: All provider operations
            provider.create: Add email provider accounts (Google, Microsoft, SMTP)
            provider.delete: Remove provider accounts
            provider.read: List/view provider accounts and connection status
            provider.update: Update provider settings, refresh tokens
            routing.*: All routing operations
            routing.create: Create delivery groups
            routing.delete: Remove delivery groups
            routing.read: List/view delivery groups and routing rules
            routing.update: Update delivery group configuration
            team.*: All team operations
            team.members.invite: Invite team members
            team.members.remove: Remove team members
            team.members.roles: Change member roles
            team.read: View team settings and members
            team.update: Update team settings
            webhook.*: All webhook operations
            webhook.create: Create webhook subscriptions
            webhook.delete: Delete webhook subscriptions
            webhook.manage: Rotate signing secret + send test events
            webhook.read: List/view webhook subscriptions
            webhook.update: Update webhook URL, event types, enabled flag
          tokenUrl: https://app.sendmux.ai/oauth/token
      type: oauth2