API overview

All endpoints are relative to:

https://app.mailyte.com

Running Mailyte yourself? Substitute your own host. Everything below is identical — the open-source core serves the same API.

Send an organization API key as a bearer token. The key knows which organization it belongs to, so there is no organization header to set.

curl 'https://app.mailyte.com/api/v1/domains' \
  -H 'Authorization: Bearer mk_live_YOUR_API_KEY'

const response = await fetch('https://app.mailyte.com/api/v1/domains', {
  headers: {
    'Authorization': 'Bearer mk_live_YOUR_API_KEY'
  }
});
const data = await response.json();

import requests

response = requests.get(
    'https://app.mailyte.com/api/v1/domains',
    headers={'Authorization': 'Bearer mk_live_YOUR_API_KEY'}
)
print(response.json())

Keys carry scopes, and a key can only do what its scopes allow. Full detail — creating keys, scopes, IP allowlisting, and the separate mailbox tokens the Mailbox API takes — is on Authentication.

Every response from the organization API has the same shape. The result is in data; success and code restate the HTTP status so a client that only reads the body can still tell what happened.

{
  "message": "Message submitted successfully",
  "data": {
    "message_id": "<01JBT8XQ2M@yourdomain.com>"
  },
  "success": true,
  "code": 200
}

Errors use the same envelope with success: false, and validation failures add an errors object keyed by field name.

The Mailbox API is the exception. Those endpoints are served by the mail server, and it wraps its replies differently: success is type: "success" rather than a success boolean, the human-readable line is msg rather than message, and there is no code — read the HTTP status for that. Some errors add a stable error_code.

{
  "type": "success",
  "msg": "Context retrieved successfully",
  "data": {
    "message_id": "INBOX:4821"
  }
}

Check type before you read data, and treat data as optional: the mail server omits the key entirely when a call has no result to return, so a client that assumes it is always present gets undefined rather than an empty object.

Each one, with what to do about it, is on the error reference.

Requests are limited per API key, and sending is separately limited per mailbox and per organization. A throttled request answers 429 with:

• Retry-After — seconds to wait. Honour it rather than guessing.
• X-RateLimit-Limit and X-RateLimit-Remaining — your budget for the current window.

Sending limits count recipients, not messages, so a batch of 200 uses 200 of your allowance rather than one.

List endpoints accept page and per_page, and return the pagination state alongside the rows in data. Endpoints that can return large result sets cap per_page; ask for more and you get the cap rather than an error.

Every timestamp is ISO 8601 in UTC, to microsecond precision — for example 2026-09-17T10:04:11.000000Z. Send dates in the same form.

The specification is generated from the running application on every release, so it cannot drift from what the API actually serves.

• Download the OpenAPI 3.1 document — generate a client in your own language.
• Download the Postman collection — import and start calling.