Capability
Everything the interface can do, your engineers can do too.
A live machine-readable specification, interactive documentation inside the product, and responses redacted to exactly what a tenant administrator would see on screen — so the API and the interface can never disagree about what is visible. Validation lives in the service, not in either client.
What you can integrate with.
REST API
Profile create, fetch and upsert — including fetch by your own application username — plus branding, lookups, subject rights, address lookup, and campaign, asset and audience management.
API keys
Bearer keys generated by your admin, shown once and stored only as a SHA-256 hash. Permanently bound to one tenancy with no way to address another's data, and revocable from the console.
Inbound webhooks
Six verified signature schemes, all routed. HMAC-signed with a per-tenant secret, constant-time compared, timestamp inside the signed material, deduplicated on the vendor event id, rate-limited per tenant.
Engagement polling
For vendors that report by pull rather than push — Dotdigital, Mailchimp and Docmail — so engagement lands the same way regardless of vendor style.
SAML SSO
Platform identity-provider metadata available to any service provider, with your own assertion consumer service URLs registered and matched exactly — https only, no wildcards, unregistered destinations refused outright.
Portal handoff
A server-to-server launch that drops your already-authenticated user straight into their preference portal, plus a common-logon exchange issuing a 15-minute token verifiable through standard JWKS.
Address lookup
Typeahead suggest, full retrieve and provider config endpoints returning normalised fields whichever vendor sits behind them — so you can change provider without changing your integration.
Delegated keys
For platforms acting on behalf of several tenants. The key names which tenants it may act for; every call must state which tenant it is for and who is acting. Only a platform administrator can issue one.
Telemetry export
OpenTelemetry traces and metrics to your own OTLP consumer — Grafana, Datadog, Splunk, Elastic. Export destinations must be public HTTPS; private, loopback and metadata addresses are refused.
One interface, nine vendors, no behaviour change.
Every campaign vendor implements the same three operations: send a batch, verify a webhook, parse the events that come back. Switching or adding a vendor therefore does not change anything you see, and your integration does not need to know which one is behind a given send.
Endpoints are constrained by policy rather than by trust. Hosted vendors are validated against that vendor's own host pattern, so a tenant picks a region rather than an arbitrary destination. Self-hosted destinations are validated the way a telemetry endpoint is: public addresses only, no internal or metadata hosts.
- Vendor readiness is checked before a send starts, not discovered mid-dispatch
- Credentials live in Secret Manager, never reach a browser and cannot be read back — you can confirm a key exists, never see it
- Rate limits are typically 30 to 60 requests a minute per address, with tighter limits on credential, erasure, export and key-generation routes
- Eight failed sign-in attempts lock an account for fifteen minutes, independent of source address
Behaviours worth knowing before you build.
Questions about integration
Can an API key reach another tenant's data?
No. A key is permanently bound to one tenancy and cannot be redirected. The only exception is a delegated key, which names the tenants it may act for, must state which tenant each call is for, and is refused and audited if it names one outside its scope. An empty delegation list means no permission, never everybody.
Why is the API not versioned to v2 for the pagination change?
The change landed before any external consumer depended on the old shape, so a version boundary would have protected nobody. That reasoning stopped applying the moment the first integration went live against the current path, which is why a breaking change to a published path now gets a version rather than a quiet swap.
How do I know an endpoint's documentation is current?
A structural test guards it. If a method or a shape changes without the specification changing, the build fails. Documentation drift is treated as a defect rather than as a chore.
Can I use SAML today?
Yes, and it fails closed: a misconfiguration produces an error rather than an unsigned assertion, assertion consumer service URLs are registered and matched exactly, https only, and unregistered destinations are refused outright. Signature verification is exercised against your own identity provider as part of onboarding rather than assumed — it is the one part of the chain only your IdP can prove. Google OAuth with a Workspace domain restriction is available alongside it and carries your own multi-factor policy.
Related capabilities
We will tell you which parts are a single call, which need a webhook, and which need work at your end.