API Documentation - Sender Audit

Authentication

All API requests require an API key passed in the Authorization header.

API keys are created from your dashboard. Each key is tied to your account and shares its scan quota.

Authorization: Bearer sa_live_your_api_key_here

Security: Keep your API key secret. Do not expose it in client-side code, public repositories, or logs. If compromised, delete it immediately from your dashboard and create a new one.

Rate limits

Scan creation	5 requests / minute + daily plan quota
Other endpoints	30 requests / minute

When a limit is exceeded, the API returns 429 Too Many Requests.

Errors

Errors return a JSON body with a detail field:

{ "detail": "Invalid API key" }

Code	Meaning
400	Bad request (missing or invalid parameters)
401	Invalid or missing API key
404	Resource not found
429	Rate limit or daily quota exceeded
500	Internal server error

Guides by task

Each guide chains the calls in the order you make them, shows what to read in each response, then where to find the detail. Examples in curl and Python.

Test your emails before sending Create a scan, send your email, read the score and what cost points. Ready for a CI gate. Track your DMARC data Policy and compliance of every domain, pass and fail volumes, and the sources behind a bad day. Classify who sends on your behalf Work through the sender catalogue with the evidence for each source, one by one or in bulk. Monitor your domains Add and verify a domain, publish what it is missing, read its health score and its events. Monitor your sending IPs Add an IP or a range, prove you control it, follow blocklists and reputation. Analyse your sending performance Connect your ESP and Google Postmaster, read delivery, bounces, complaints and engagement. Supervise your account The state of the whole account in one call, recommendations to act on, TLS reporting. Manage several brands or clients Group domains and IPs per client, scope every figure to one group, watch the quotas.

Endpoint reference

Every endpoint is generated from the API itself, so it cannot drift from what the service actually accepts. Paste your API key once on that page and call any of them from there.

Calls you send from there are real. They run against production with the key you provide, count against your quotas, and operations marked as destructive delete data for good. There is no sandbox.

Open the API reference

Prefer the raw schema? Download the OpenAPI document and generate a client from it.