Developer platform
A real cold-email API, on every plan.
Build against the same versioned contract used by MailSequence: scoped keys, cursor pagination, idempotent writes, signed webhooks, public OpenAPI documentation, and a hosted MCP server.
REST API·Signed webhooks·Hosted MCP·No enterprise-only paywall
API surface
Automate the operating workflow.
Contacts and imports
Create, update, list, and bulk-import contacts with deduplication, suppression safety, and plan-cap enforcement.
Sequences and campaigns
Create and update sequence definitions and campaigns through workspace-scoped credentials.
Enrollments
Enroll contacts, then pause, resume, or stop lifecycle execution with idempotent writes.
Inboxes and threads
Read credential-free inbox metadata, reply threads, and nested messages without crossing workspace boundaries.
Analytics
Read daily metrics for automation, reporting, and client-facing operational views.
Provisioning
Create and seed workspaces using an organization-scoped provisioning key, subject to workspace limits.
Contract and safety
Built for retries, scopes, and tenant boundaries.
API keys determine organization or workspace tenancy. Unsafe writes accept idempotency keys, collections use cursor pagination, and authenticated requests receive per-key rate limits with retry guidance.
- Workspace and organization key tiers
- Capability scopes for each resource
- Idempotency-Key support on side-effecting writes
- Per-key throttling and Retry-After behavior
Events
Signed webhooks that expect production failure.
Register workspace endpoints for operational events. Deliveries are HMAC-signed, retried, and automatically disabled after persistent failure.
| Event family | Examples | Use |
|---|---|---|
| Message delivery | sent, replied, bounced | Update downstream reporting and workflows |
| Contacts | contact.created | Synchronize approved contact records |
| Enrollments | enrollment.completed | Trigger handoff or post-sequence automation |
Connect agent workflows
The hosted MCP server uses workspace-scoped authorization and the same product primitives as the public API. It does not create a privileged path around scopes, tenancy, rate limits, or plan capacity.
Read the public API contract
The public OpenAPI 3.1 specification and browsable reference are generated from the application routes so documentation drift is caught by contract tests.
Implementation guides
Build one safe workflow at a time.
API quickstart
Create a scoped key, verify its identity, page through resources, make an idempotent write, and handle errors.
Lead import and enrollment
Submit an asynchronous batch, reconcile its result, and enroll eligible contacts into a prepared campaign.
Webhook verification and retries
Verify the raw request body, deduplicate event IDs, acknowledge safely, and recover persistent failures.
MCP setup and agent workflows
Approve one workspace and the minimum scopes, inspect the available tools, and retain human confirmation for consequential writes.
Agency workspace provisioning
Create and seed client workspaces with an organization key, then hand off a separate workspace operating key.
n8n, Clay, and Apollo workflows
See which customer-owned connection paths are production-ready, contract-driven, or still incomplete.
FAQ
Frequently asked questions
Which plans include API access?
Every MailSequence plan includes the public REST API, signed webhooks, and hosted MCP access. Resource capacity and per-key rate limits still apply.
How is tenant isolation enforced?
Tenancy comes from the API key. Workspace keys bind data-plane requests to one workspace; organization provisioning keys can create and seed workspaces only inside their organization.
Can I safely retry a failed write?
Side-effecting create and update routes support Idempotency-Key handling so a repeated request does not silently duplicate the operation. Follow the endpoint documentation for exact behavior.
Does MCP bypass API permissions?
No. MCP uses workspace-scoped authentication and inherits the same scopes, tenant boundary, rate limits, and plan constraints as the underlying public operations.
Are webhook payloads signed?
Yes. Outbound webhook deliveries use HMAC signatures, retries, and automatic endpoint disablement after persistent failure.
Is the OpenAPI specification public?
Yes. The browsable documentation and OpenAPI 3.1 document are public. They contain schemas and exclude customer data and live credentials.
Automate repeatable operating work.
Start with a scoped key, read the public contract, and build against the same workflow the product uses.