Skip to main content

Email API enforces API key scopes

The Email API now checks the scopes of the key, as the dashboard has always described them:

  • Sending (POST /emails, POST /emails/batch, the SMTP relay) and changing a scheduled send (PATCH /emails/{id}, POST /emails/{id}/cancel) need email:send.
  • Reading emails (GET /emails, GET /emails/{id}, GET /emails/{id}/events) needs email:read; email:send and email:write include it.

Before, any valid key could call these endpoints. A key without the scope now gets 401 restricted_api_key (550 5.7.1 over SMTP). Keys with full access (*), email:* or email:send are not affected. If a key that sends email has only other scopes, such as email:write or chat:*, add email:send to it under API Keys in the dashboard.