The whole platform
Contacts, broadcasts, drips, triggers, transactional sends, IPs, Pools, Bridges, and reporting all have endpoints. Anything you do in the interface, you can drive from code — predictable JSON in, predictable JSON out.
Developer
Everything you can do in the UI, you can do in code.
A comprehensive JSON REST API spanning contacts, broadcasts, drips, triggers, transactional sends, and the infrastructure underneath — IPs, Pools, and Bridges. Reusable ACL roles mint scoped keys with per-key rate limits and IP restrictions.
api.mumara.com
POST /v1/send · Authorization: Bearer ****-1511
{
"from": "[email protected]",
"to": "[email protected]",
"subject": "Order confirmed"
}// response
202 Accepted · { "id": "msg_7a9f", "status": "queued" }
scoped key · rate-limitedJSON only
What you get
Full surface, scoped access, signed callbacks.
Scoped, governed keys
Generate any number of API keys, each bound to a reusable ACL role so a key only touches what it should. Set per-key rate limits to suit each integration, and lock keys to specific source IPs for another layer of control.
Signed webhook callbacks
Pair the API with HMAC-signed webhooks so your systems are notified of events in real time and can verify each payload genuinely came from Mumara — the push half of a full real-time integration.
The API surface
Endpoints across the whole platform.
From the audience layer to the sending infrastructure, every surface is addressable. The transactional-send endpoint is the workhorse for app-driven email; the rest let you automate everything around it.
- Contacts
- Broadcasts
- Drips
- Triggers
- Transactional send
- IPs
- Pools
- Bridges
- Reporting
What it enables
The integrations a thin API can't support.
-
Send from your own application
The transactional-send endpoint lets your app fire receipts, confirmations, and resets directly — the API is the workhorse behind app-driven email.
-
Govern access per integration
A single all-powerful key is a liability. Reusable ACL roles, per-key rate limits, and IP restrictions scope each integration to exactly what it needs.
-
Automate the infrastructure too
Most ESP APIs stop at contacts and sends. ONE exposes IPs, Pools, and Bridges as well, so provisioning and routing can be automated, not click-ops.
-
React to events in real time
Polling for changes is wasteful and slow. HMAC-signed webhooks push events to your systems the moment they happen, verified.
What developers build
From a one-line send to full automation.
-
App-driven email
- The need
- Your product needs to fire receipts, confirmations, and resets.
- What the API does
- The transactional-send endpoint sends each message directly from your app — JSON in, a queued message id back.
-
Sync contacts & events
- The need
- Your CRM or product is the source of truth for contacts.
- What the API does
- Push contact updates, segment membership, and custom events programmatically so Mumara always reflects your data.
-
Provision infrastructure
- The need
- You spin up sending lanes per customer or brand.
- What the API does
- Automate IPs, Pools, and Bridges through the API — provisioning becomes code, not a sequence of clicks.
-
React to events
- The need
- Your systems need to know the instant mail delivers or bounces.
- What the API does
- HMAC-signed webhooks push verified events as they happen, so you react in real time instead of polling.
“Most ESP APIs let you send and manage contacts and stop there. Being able to provision Pools and Bridges over the API is what let us automate a separate sending lane per client — it's all code now, no console clicking. And the scoped keys with per-key rate limits meant we could give each service exactly the access it needed.”
Verified review
Mumara ONE customer
G2
Common questions
What buyers usually ask.
What can the API control?
Contacts, broadcasts, drips, triggers, transactional sends, reporting, and the sending infrastructure itself — IPs, Pools, and Bridges. Anything you can do in the interface has a JSON endpoint, so whole workflows can be automated.
How is access scoped?
You generate API keys bound to reusable ACL roles, so each key only reaches what its role permits. Each key can have its own rate limit and be restricted to specific source IPs, keeping integrations least-privileged.
What format are responses?
JSON only — predictable request and response shapes across every endpoint, so client code stays simple and consistent.
How do I get notified of events?
Through HMAC-signed webhooks, the push counterpart to the API. Subscribe an endpoint to the events you care about, verify the signature on each payload, and react in real time without polling.
Is API activity auditable?
Yes. Actions taken through the API are recorded in Activity Logs with the API key as the actor, so programmatic changes are as traceable as ones made by a person in the interface.
Related
Pages that pair with this one.
-
Bridges
A Bridge exposes the per-app transactional send endpoint and SMTP credentials.
Read more -
Webhooks
The push counterpart — HMAC-signed events delivered to your endpoint in real time.
Read more -
Realtime Delivery Status
Delivery and engagement events are available to pull via API and push via webhook.
Read more -
Activity Logs
Every API action is logged with the key as the actor for a full audit trail.
Read more
Mumara ONE · REST API
Automate the whole platform.
A full JSON API across contacts, sends, and infrastructure — with scoped, rate-limited keys and HMAC-signed webhooks for real-time, governed integration.