ActiveCampaign API + MCP (2026): v3 REST, official MCP, no SDK

ActiveCampaign’s public surface is one REST API — v3, JSON in and out, authenticated with an Api-Token header against an account-specific base URL — plus an eComm GraphQL endpoint sharing the same credential and quota. It is a marketing-automation and CRM API, not a sending API: there is no relay behind it. The 2026 headline is MCP. ActiveCampaign is one of the few ESPs to ship a first-party, hosted, account-scoped MCP server on every plan tier, while the SDK story went the other way — the only official platform SDK is a PHP wrapper frozen in 2017 against the legacy v1 API.

At a glance

MCP integration in 2026

Model Context Protocol is how an LLM client — Claude, ChatGPT, Cursor — gets structured, permissioned access to a product instead of a raw API key. Most email platforms leave it to community wrappers. ActiveCampaign does not.

Available MCP servers

Four endpoints matter. Two come from ActiveCampaign itself — the platform server and the Postmark server, on different accounts and different billing — one is Zapier’s wrapper, one a community Python server for teams needing stdio.

ActiveCampaign API essentials

Everything below is the v3 REST API, described in the docs as “structured around REST, HTTP, and JSON”. The two values you need before writing any code — base URL and API key — both live in Settings › Developer.

The resource model is flatter than it looks. Contacts, deals, lists, tags and campaigns are top-level collections, and relationships between them are their own collections rather than nested sub-resources: you do not tag a contact by PUTting the contact, you POST a contactTag referencing both IDs. Same for list membership (contactLists), enrolment (contactAutomations) and field data (fieldValues). Once that clicks the API is predictable — create the join record, delete the join record, and remember that removal is a DELETE on the join record’s own ID, so you often GET it just to delete it. The cost is call volume: one logical operation is often four requests against 5 per second for the whole account. Cache tag and list IDs at startup instead of resolving names on every write.

Authentication methods

API key in the Api-Token header

This is the only documented authentication method for v3. The docs are explicit: “The API key should be provided as an HTTP header named Api-Token.” No query-string fallback, no HTTP Basic variant, no bearer form. GET /api/3/users/me is the canonical smoke test — if it returns your user object, key and base URL are both correct.

Keys are per-user, not per-application. Every user has their own key on the Settings › Developer tab, which also shows the account’s base URL. There is no scoping mechanism: a key carries the permissions of its owner, so the only way to constrain an integration is a dedicated user with limited permissions. Rotating a key rotates it for that human too — create a service-account user before five integrations end up sharing one admin’s token.

eComm GraphQL

The GraphQL endpoint uses the same Api-Token header and the same key. No separate credential, no separate quota — it draws on the same 5 requests per second your REST sync is already spending.

MCP and app authorization

OAuth-style authorization exists, but not where API developers look for it. The Remote MCP Server uses an interactive browser login; CX Apps built with App Studio and the Postmark connector have their own authorize flows. None produces a credential usable against the v3 REST API. For server-to-server work there is one path: the Api-Token header.

Rate limits

ActiveCampaign publishes one API rate limit and no SMTP-shaped limits, because there is no SMTP surface. Sending volume is metered monthly against contact count rather than throttled per hour.

The workaround is architectural, not clever. Stop looping single writes: POST /api/3/import/bulk_import exists so a 40,000-contact sync is not 40,000 requests. Treat the budget as shared and put every integration behind one queue with a token bucket, because the nightly warehouse sync, the checkout webhook handler and an MCP client someone connected last week all draw from the same five. Honour Retry-After on a 429 — blind retries turn a burst into a lockout. If you need high-frequency writes, this is the wrong shape of product; that is event-pipeline territory, closer to Customer.io.

Official SDKs

This is the weakest part of the ActiveCampaign developer story. The GitHub organisation is busy in 2026, almost entirely with Postmark libraries. There is no maintained client for the platform API in any language.

Notable community SDKs

With no first-party v3 client, the community fills the gap and quality varies. Vet any wrapper on three checks: does it read the base URL from configuration rather than hardcoding api-us1.com, does it handle 429 with Retry-After, and does it expose meta.total so pagination is deterministic? The most visible community project in 2026 is the Python MCP server mcp-activecampaign (v0.2.0, MIT), a readable reference implementation of v3 calls even if you never run it as an MCP endpoint. On the Postmark side the picture inverts: postmark-python, postmark-php, postmark.js, postmark-dotnet and postmark-java all shipped releases in 2026.

Endpoints reference

The v3 API covers well over a hundred endpoints. These 15 carry almost every real integration. Full reference at developers.activecampaign.com.

Code examples

curl: smoke test, pagination and tagging

# Credential smoke test. Base URL comes from Settings > Developer.
curl -sS -H "Api-Token: $AC_API_TOKEN" "$AC_BASE_URL/api/3/users/me"

# Page 2 of contacts, newest first, 100 per page (the maximum).
curl -sS -H "Api-Token: $AC_API_TOKEN" "$AC_BASE_URL/api/3/contacts?limit=100&offset=100&orders[cdate]=DESC"

# Tagging is a join record, not a field on the contact object.
curl -sS -X POST -H "Api-Token: $AC_API_TOKEN" -H "Content-Type: application/json" -d '{"contactTag":{"contact":"12345","tag":"42"}}' "$AC_BASE_URL/api/3/contactTags"

Python: idempotent upsert and full pagination

The pattern that matters is /api/3/contact/sync rather than POST /api/3/contacts: sync is keyed on email and safe to replay, which is what you want behind a webhook that can fire twice.

import os, time, requests

# Both values come from Settings > Developer. Never hardcode api-us1.com.
BASE = os.environ["AC_BASE_URL"].rstrip("/")
S = requests.Session()
S.headers.update({"Api-Token": os.environ["AC_API_TOKEN"],
                  "Content-Type": "application/json"})

def call(method, path, **kw):
    while True:
        r = S.request(method, BASE + path, timeout=30, **kw)
        if r.status_code == 429:                 # 5 req/sec, per account
            time.sleep(int(r.headers.get("Retry-After", 1)))
            continue
        r.raise_for_status()
        return r.json()

def upsert(email, first=None):                   # idempotent, keyed on email
    body = {"contact": {"email": email, "firstName": first}}
    return call("POST", "/api/3/contact/sync", json=body)["contact"]

def all_contacts(page=100):
    offset, total = 0, None
    while total is None or offset < total:
        body = call("GET", "/api/3/contacts",
                    params={"limit": page, "offset": offset})
        total = int(body["meta"]["total"])        # authoritative count
        yield from body["contacts"]
        offset += page

Common gotchas

Deprecations and changelog

• August 18, 2026 — 2026 investment on the ActiveCampaign GitHub org is concentrated on the Postmark toolchain: postmark-skills updated August 18, postmark-python August 17, postmark-mcp August 12, postmark-php August 11. No platform v3 SDK is maintained there.
• June 12, 2026 — postmark-mcp v2.0.0 released under the ActiveCampaign org, expanding the official Postmark MCP server to 24 tools across sending, templates, message search, bounces, suppressions and stats.
• April 4, 2026 — Community server mcp-activecampaign v0.2.0 published to PyPI under MIT, with 33 tools against the v3 REST API.
• June 3, 2024 — New send-limit structure for plans purchased on or after this date: Starter 10x contacts, Plus 10x, Professional 12x, Enterprise 15x, with $0.005 per-send overage and sending disabled at 3x the limit.
• May 6, 2022 — ActiveCampaign announces the acquisition of Postmark and DMARC Digests from Wildbit, while committing to Postmark continuing as a standalone product rather than being absorbed.

ActiveCampaign publishes a developer changelog at developers.activecampaign.com/changelog; its entries carry no machine-readable dates, so pinning an integration against it is manual work. On deprecation risk, v1 is not deprecated — the v3 overview promises “no plans to sunset version 1 of our API at this time” plus advance notice — but it receives no new functionality, so treat it as frozen rather than safe.

Frequently asked questions