Integration endpoints

Six endpoints for automation tools such as Zapier, n8n, Make, Pipedream and Activepieces. A tool uses them to check a key, fill its template and automation drop-downs, and turn triggers on and off. You can call them from your own code too.

• GET /me — check the key and get the site’s name.
• GET /templates — list your saved templates.
• GET /sequences — list your automations (follow-up sequences).
• POST /hooks — turn a trigger on.
• DELETE /hooks/{id} — turn a trigger off.
• GET /hooks/sample — get an example event.

For all six endpoints#

Send the site’s API key in the x-securessmtp-api-key header. Bodies and answers are JSON. A good answer has "ok": true. An error has "ok": false and a reason.

Each site can make 120 calls a minute to these six endpoints together. Above that they answer 429 until the minute has passed. Calls that are refused count too, including 429 answers. Only calls refused because of the key or the site (401 and 403) do not count.

Headers#

Errors every endpoint can give

GET /me#

Checks that the key works and says which site it belongs to. A tool calls it when someone connects, and names the connection after the site.

curl https://securessmtp.com/api/v1/me \
  -H "x-securessmtp-api-key: $SECURESSMTP_API_KEY"

{
  "ok": true,
  "site": {
    "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
    "name": "Acme Store",
    "domain": "acme.example"
  },
  "plan": "free"
}

The answer never includes the API key.

GET /templates#

Lists the templates saved by the account that owns the site, so a tool can fill a template drop-down. The starter templates from the gallery are not included.

curl https://securessmtp.com/api/v1/templates \
  -H "x-securessmtp-api-key: $SECURESSMTP_API_KEY"

{
  "ok": true,
  "templates": [
    {
      "id": "5c0f2e8a-3b7d-4a91-b6e4-9d2f1a7c8e03",
      "slug": "order-shipped",
      "name": "Order shipped",
      "subject": "Your order {{order_number}} has shipped",
      "variables": [
        "first_name",
        "order_number"
      ]
    }
  ]
}

To send one, give its id or slug as template to POST /mail/send, with a value for each variable in data. See Templates and variables.

GET /sequences#

Lists the automations (follow-up sequences) of the account that owns the site, so a tool can fill an automation drop-down.

curl https://securessmtp.com/api/v1/sequences \
  -H "x-securessmtp-api-key: $SECURESSMTP_API_KEY"

{
  "ok": true,
  "sequences": [
    {
      "id": "0b7e4c2a-9d1f-4e3b-8a6c-5f2d1e0c9b8a",
      "name": "Welcome series",
      "active": true
    }
  ]
}

POST /hooks#

Turns a trigger on. It creates a webhook for the site the key belongs to. From then on SecureSMTP posts every event of that kind to the address you gave. Switching the trigger off is DELETE /hooks/{id}.

Body

Request

curl -X POST https://securessmtp.com/api/v1/hooks \
  -H "x-securessmtp-api-key: $SECURESSMTP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://hooks.zapier.com/hooks/standard/123456/abcdef/",
  "event": "email.delivered",
  "source": "zapier"
}'

Response

{
  "ok": true,
  "id": "8e3c5a1f-72d4-4b6a-9f10-c4a2e7d9b563",
  "secret": "whsec_Zk3q9v1XbT7m2LwR8nYc5HaJdE4uPfGs"
}

{
  "ok": true,
  "id": "8e3c5a1f-72d4-4b6a-9f10-c4a2e7d9b563"
}

Errors

Notes

• Calling it again with the same url and event, for example after a timeout, does not make a second hook. You get 200 with the existing id and no secret. Only an active hook made through this endpoint is matched. A paused hook, or one made in the dashboard with the same address, is left alone and a new hook is made.
• Hooks made here show under Webhooks in the dashboard with “Added by Zapier” (or the tool’s name) beside them. They can be paused or deleted there.
• The address is checked again before every delivery, and the connection is made only to the addresses that passed the check. If its host now resolves to a private address, nothing is sent and the hook’s last error reads url_not_allowed. If the host cannot be looked up, the delivery is tried again like any other failed delivery, and the last error reads dns lookup failed.
• Deliveries to these hooks do not follow redirects. An answer with a 3xx status counts as a failed delivery.
• If the address answers 410 Gone, SecureSMTP turns the hook off. Zapier answers 410 when a Zap is deleted.
• Events arrive in the usual envelope with the X-QCS-Signature header. See Webhooks for how to check it.

DELETE /hooks/{id}#

Turns a trigger off by deleting the hook. Only hooks of the site the key belongs to can be deleted. This includes hooks made in the dashboard.

curl -X DELETE https://securessmtp.com/api/v1/hooks/HOOK_ID \
  -H "x-securessmtp-api-key: $SECURESSMTP_API_KEY"

{
  "ok": true
}

GET /hooks/sample#

Returns an example event in the same format a real one arrives in, so a person can map its fields while setting up a trigger. The values are made up. The same example comes back every time.

curl https://securessmtp.com/api/v1/hooks/sample?event=email.delivered \
  -H "x-securessmtp-api-key: $SECURESSMTP_API_KEY"

{
  "ok": true,
  "samples": [
    {
      "id": "00000000-0000-4000-8000-000000000002",
      "type": "email.delivered",
      "created_at": "2026-10-26T12:00:00.000Z",
      "site_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
      "data": {
        "message_id": "<[email protected]>",
        "to": "[email protected]",
        "subject": "Your order has shipped"
      }
    }
  ]
}

• form.submitted, email.delivered, email.bounced and email.unsubscribed come with example values in data. Any other valid event name returns the envelope with an empty dataobject.
• Every field in data can be missing in a real event. For example, a bounce that cannot be matched to a logged email has only to and detail.