Update a smtp credential

PATCH/api/v1/smtp-credentials/{credential}
Requires anorganization API keywith the scopesmtp:write

Change a credential's name, expiry, per-key limits, tracking or stream. Send only the fields you are changing.

Changing a key to stream: "marketing" needs Bounce protection on, for the same reason as creating one: a marketing key only sends to your checked contacts. Where Bounce protection is available and your account has it turned off, the change answers 422 with error_code: "bounce_protection_required" and data.setting_path, and the key is left as it was. A key that is already on the marketing stream is never refused for this.

While your marketing is paused, changing a marketing key to transactional can be refused. The change then answers 409 with error_code: "marketing_paused", and the key is left as it was. Try again when your marketing can send again.

Parameters

NameInTypeDescription
credentialrequiredpathstringThe credential identifier.

Request body

  • namestring

    Its name, shown in the dashboard.

  • expires_atstring

    Optional. When the key stops working, ISO 8601. Leave it out for a key that does not expire.

  • hourly_limitinteger

    Optional. The most emails this key may send in an hour.

  • daily_limitinteger

    Optional. The most emails this key may send in a day.

  • tracking_enabledboolean

    Track opens and clicks in mail sent with this key. Defaults to false for an app (transactional) key, so its links stay on your own domain, and true for a marketing key.

  • streamstringtransactional | marketing

    transactional for emails your app sends one at a time, like receipts and sign-in codes; marketing for newsletters and promotions. They go out from different addresses so one cannot harm the other.

Request

PATCH/api/v1/smtp-credentials/{credential}
curl -X PATCH 'https://app.mailyte.com/api/v1/smtp-credentials/01JBT8XQ2M9WYC3K4F6R7S8T9V' \
  -H 'Authorization: Bearer mk_live_YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Spring newsletter",
    "expires_at": "2027-01-01T00:00:00Z"
  }'
The key names its own organization, so no X-Organization-ID header is needed.

Response

Success.

  • dataobject
    • objectstringsmtp_credential
    • idstring

      Unique identifier for the credential.

    • namestring

      Your name for the key. It is not used to sign in.

    • usernamestring

      The SMTP username, to set in your mail library. Delivery events name it. Safe to log.

    • statestringactive | paused | revoked | inactive | expired | suspended | pending_review | provisioning | failed | deleting

      Whether the key can send. Only active can. - deleting, failed: being removed, or setup failed. - pending_review: a marketing key waiting for approval. - expired: past expires_at. - suspended: switched off by us or after delivery failures. - inactive: retired after a long time unused (the owner was warned three times). Turning it back on keeps the same username and secret. - paused: on hold because it suddenly sent far more than usual or from a new host. Its mail waits rather than bouncing. The hold lifts by itself (after six hours by default), or now with POST /smtp-credentials/{credential}/resume.

    • streamstringtransactional | marketing

      Which lane mail sent with this credential is treated as. The stream decides reputation handling and marketing gating; it is not a label.

    • domainobject

      The one domain this key may send as.

      • idstring

        The domain's ID. Always set.

      • namestring

        The domain's name. Some responses leave it null; use domain.id, or read the key from GET /smtp-credentials.

    • ip_allowlistobject

      Enforced by the mail server at AUTH time, not by this API. enabled: false with a populated list is a configured allowlist that is currently off, not a contradiction.

      • enabledboolean
      • addressesarray<string>

        IPv4/IPv6 addresses or CIDR ranges.

    • limitsobject

      Limits for this key alone, below your plan's limits.

      • hourlyinteger

        Recipients per hour for this key. Null means no key limit is set; your plan's limit still applies.

      • dailyinteger

        Recipients per day for this key. Null means no key limit is set; your plan's limit still applies.

    • tracking_enabledboolean

      Whether open and click tracking is injected into HTML sent with this credential.

    • last_used_atstring

      When this key last signed in to send. It can be up to an hour behind. Null means no use has been seen yet, which is not proof the key is idle. For a live figure, use GET /smtp-credentials/{credential}/usage.

    • expires_atstring

      When the key stops working, in ISO 8601 UTC. Null means it never expires (the default). Null does not mean expired.

    • created_atstring

      ISO 8601 UTC.

Returned inside the standard envelope.

Errors

StatusWhen
401The API key is missing, unknown, revoked or expired. All four answer identically, on purpose: distinguishing them would confirm which keys exist.
403The key is valid but may not do this: it lacks the required scope, its IP allowlist does not include you, or this endpoint does not accept API keys.
404No such resource in this organization.
422The request was understood but the values were not acceptable.
429Too many requests, or the organization has spent its sending allowance. `Retry-After` says how long to wait.

Every status, with what causes it and what to do, is on the error reference.