API overview

241 endpoints across 15 sections. Everything here is what you can do in the Mailyte dashboard and webmail, available to your own software.

Base URL

All endpoints are relative to:

Base URL
https://app.mailyte.com

Running Mailyte yourself? Substitute your own host. Everything below is identical — the open-source core serves the same API.

Authentication

Send an organization API key as a bearer token. The key knows which organization it belongs to, so there is no organization header to set.

curl
curl 'https://app.mailyte.com/api/v1/domains' \
  -H 'Authorization: Bearer mk_live_YOUR_API_KEY'

Keys carry scopes, and a key can only do what its scopes allow. Full detail — creating keys, scopes, IP allowlisting, and the separate mailbox tokens the Mailbox API takes — is on Authentication.

The response envelope

Every response from the organization API has the same shape. The result is in data; success and code restate the HTTP status so a client that only reads the body can still tell what happened.

Envelope
{
  "message": "Message submitted successfully",
  "data": {
    "message_id": "<01JBT8XQ2M@yourdomain.com>"
  },
  "success": true,
  "code": 200
}

Errors use the same envelope with success: false, and validation failures add an errors object keyed by field name.

Status codes

CodeMeaning
200Success. For a send, this means accepted for delivery — not yet delivered.
401The API key is missing, unknown, revoked or expired. All four answer identically.
403Valid key, not allowed: missing scope, IP not allowlisted, or an endpoint that does not accept keys.
404No such resource in this organization.
422Validation failed. Check the errors object.
429Rate limited or out of sending allowance. Read Retry-After.
500Our fault. Safe to retry with backoff.

Each one, with what to do about it, is on the error reference.

Rate limits

Requests are limited per API key, and sending is separately limited per mailbox and per organization. A throttled request answers 429 with:

  • Retry-After — seconds to wait. Honour it rather than guessing.
  • X-RateLimit-Limit and X-RateLimit-Remaining — your budget for the current window.

Sending limits count recipients, not messages, so a batch of 200 uses 200 of your allowance rather than one.

Pagination

List endpoints accept page and per_page, and return the pagination state alongside the rows in data. Endpoints that can return large result sets cap per_page; ask for more and you get the cap rather than an error.

Dates

Every timestamp is ISO 8601 in UTC, to microsecond precision — for example 2026-09-17T10:04:11.000000Z. Send dates in the same form.

OpenAPI and Postman

The specification is generated from the running application on every release, so it cannot drift from what the API actually serves.

Sections