Your AWS SES. Your dedicated Mailat. See how it works
Documentation

Send Email

Request, response and authentication details for your Mailat instance.

← All API operations
POST/api/v1/emails

SendEmail sends a single transactional email POST /api/v1/emails Requires a verified owned sender and stable Idempotency-Key. Base64 attachments preserve name, type (MIME), disposition and cid. Same key+content retries return the original result; changed payload is 409. A batch holds one content-bound key for the whole ordered request plus per-item keys. Inspect each item's success/error; retry the identical batch for incomplete items. queued/pending is not provider acceptance. sent is SES acceptance; delivered is destination-server acceptance. unknown needs investigation and must not be blindly retried with a new key.

Authentication & compatibility

Use a scoped bearer API key with email:send. The key is bound to its user and organization.

SES email workflow and its stored mailbox/configuration data. Provider actions require configured AWS permissions and verified owned domains; receiving is opt-in.

Contract 2026-10-04. Your running instance's /api/v1/openapi.json is authoritative for its deployed release.

Request

Set MAILAT_BASE_URL to your instance origin (without /api/v1) and MAILAT_TOKEN to an appropriate credential. Replace path placeholders and example data before running. These examples do not execute in this page.

cURL request
curl --request POST "$MAILAT_BASE_URL/api/v1/emails" \
  --header "Authorization: Bearer $MAILAT_TOKEN" \
  --header "Idempotency-Key: replace-with-a-stable-job-key" \
  --header 'Content-Type: application/json' \
  --data '{
  "attachments": [
    {
      "content": "SGVsbG8=",
      "name": "hello.txt",
      "type": "text/plain"
    }
  ],
  "from": "[email protected]",
  "subject": "Welcome",
  "text": "Hello from Mailat",
  "to": [
    "[email protected]"
  ]
}'

Parameters

header
Idempotency-Keystring

Persist one key per logical submission. Reuse it with the identical request on retries; changed content returns 409. Single-email sends accept either this header or JSON idempotencyKey; both must agree when supplied together. Batch and compose require this header.

minLength: 8 · maxLength: 128

Request body (required)

application/json

bodyobjectrequired

At least one recipient across to/cc/bcc; SES accepts at most 50 combined. The rendered subject is limited to 1000 bytes and combined text/HTML body to 2 MiB. Limits are bytes, not Unicode character counts. Supply text, html, templateId or attachments. Single-send requests also require a header or body idempotency key.

Fields · model.SendEmailRequest
attachmentsarray

maxItems: 50

Each itemobject
Fields · model.AttachmentDTO
blobIdstring
cidstring
contentstring
dispositionstring
namestring
sizeinteger (int64)
typestring
bccarray
Each itemstring
ccarray
Each itemstring
fromstring (email)required
htmlstring
idempotencyKeystring

Alternative to the single-send Idempotency-Key header; both must agree when supplied. At least one form is mandatory.

minLength: 8 · maxLength: 128

metadataobject
Additional valuesstring
replyTostring
scheduledForall of · nullable

RFC3339 timestamp

Variant 1string
subjectstringrequired
tagsarray
Each itemstring
templateIdstring
textstring
toarray
Each itemstring
variablesobject
Additional valuesstring
Variant 1object
Fields
toarrayrequired

minItems: 1

Variant 2object
Fields
ccarrayrequired

minItems: 1

Variant 3object
Fields
bccarrayrequired

minItems: 1

Responses

HTTP statuses and body shapes below come from the pinned contract. Not every shared error applies to every request. Retain the original idempotency key when retrying a send.

200 · Success
Header: X-RateLimit-Remaininginteger

Remaining requests in this API key's current minute window (present for API-key authentication).

minimum: 0

application/json

responseobject
Fields
codeintegerrequired
dataall of · nullable
Variant 1object
Fields · model.SendEmailResponse
acceptedAtstring (date-time)
idstring
messageIdstring
statusstring
messagestringrequired
400 · Invalid input

application/json

responseobject
Fields
codeintegerrequired
messagestringrequired
401 · Missing, expired or revoked authentication

application/json

responseobject
Fields
codeintegerrequired
messagestringrequired
403 · Insufficient permission

application/json

responseobject
Fields
codeintegerrequired
messagestringrequired
404 · Resource not found

application/json

responseobject
Fields
codeintegerrequired
messagestringrequired
409 · Conflict or changed idempotency payload

application/json

responseobject
Fields
codeintegerrequired
messagestringrequired
410 · Recovery cursor expired; resynchronize

application/json

responseobject
Fields
codeintegerrequired
messagestringrequired
429 · Rate limit exceeded; respect Retry-After
Header: Retry-Afterinteger

Seconds until the next fixed-minute request window.

minimum: 1

application/json

responseobject
Fields
codeintegerrequired
messagestringrequired
500 · Internal failure; retain the idempotency key

application/json

responseobject
Fields
codeintegerrequired
messagestringrequired
Download the full OpenAPI contract