Amazon SES API + MCP (2026): SES v2 REST, SigV4, 10 SDKs

Amazon SES exposes a full REST/JSON control plane through the SES v2 API (API version 2019-09-27, service id sesv2) and ships first-party SDKs for 10 languages plus the AWS CLI v2. Every call is signed with SigV4 against a regional endpoint (https://email.{region}.amazonaws.com), so the same IAM policies, roles, and CloudTrail auditing that govern the rest of your AWS account also govern email sending. On the MCP front, however, AWS has not shipped a production-grade first-party MCP server dedicated to SES as of August 2026 — agents rely on the general-purpose AWS MCP Server (GA May 2026), the AWS-authored sample repo, or community wrappers.

At a glance

MCP integration in 2026

Model Context Protocol lets AI agents call SES actions (send email, add contacts, list identities) as typed tools instead of raw REST calls. AWS shipped a general-purpose MCP surface in 2026 but has still not published a production-ready MCP server dedicated to SES — a gap worth flagging before wiring agents to your sending account.

Available MCP servers

Five MCP entry points can address SES today. Only two carry an AWS label, and neither is a production-hardened SES-only server.

Amazon SES API essentials

Resources are grouped by function — email identities, templates, contact lists, configuration sets, event destinations, suppression, dedicated IP pools, and account-level settings — and most operations map cleanly to REST verbs. The v2 API is intentionally leaner than v1: several legacy actions were dropped or renamed, so migrating from ses to sesv2 usually means changing the client, not just the endpoint.

Authentication methods

AWS Signature Version 4 (SigV4)

Every SES v2 HTTPS call is signed with SigV4 using an AWS access key ID and secret access key. Long-lived IAM user keys are supported but not recommended for production — prefer roles. The SDKs handle SigV4 transparently once credentials are resolved via the default provider chain (environment, shared config file, EC2/ECS/EKS/Lambda role, IAM Identity Center).

IAM roles + STS temporary credentials

Production workloads should assume a role through an EC2 instance profile, ECS task role, EKS IRSA, or Lambda execution role. Short-lived credentials are issued by STS automatically and rotated by the AWS runtime, and every SES action is auditable in CloudTrail with the role’s ARN. IAM Identity Center (AWS SSO) is the recommended human path for CLI-driven operations.

IAM SMTP credentials (SMTP interface only)

The SMTP endpoint uses a separate credential pair: a 20-char IAM SMTP username and a 44-char IAM SMTP password derived from an IAM user secret via HMAC-SHA256. These are region-specific and generated in the SES console or with the smtp_credentials_generate.py helper. Authentication is AUTH LOGIN over TLS; SES rejects unencrypted SMTP connections.

Rate limits

SES throttles on the send rate (msg/sec) rather than a public RPM figure, and every administrative action has its own quota. For bursty workloads, batch through SendBulkEmail, use a configuration set with an SNS or CloudWatch event destination to observe rejections, and implement exponential backoff on Throttling and ThrottlingException errors — the AWS SDKs ship this retry policy by default but the intervals are worth tuning for spiky traffic.

Official SDKs

AWS ships and maintains SES v2 clients across every mainstream backend language plus the CLI. All track the current sesv2 Smithy model, receive monthly-cadence releases, and are covered by AWS support.

Notable community SDKs

Because SES is API-first and covered by every AWS SDK, dedicated third-party SES SDKs are uncommon. Framework-level helpers are more useful: Laravel’s ses-v2 mail transport, Django’s django-ses, Rails’ aws-sdk-rails, WordPress WP Mail SMTP and WP Offload SES, and NestJS mailer modules all wrap the official SDKs and are the pragmatic path for stack-native integration. For agent workloads see the MCP directory above.

Endpoints reference

The full SES v2 REST reference lives in the Amazon SES v2 API Reference. The 15 endpoints below cover the resources most senders touch: sending, identities, templates, configuration sets and event destinations, contact lists, suppression, dedicated IPs, and account-level settings.

Code examples

Python (boto3): ping, add contact, send transactional

import boto3
from botocore.exceptions import ClientError

# SES v2 client - region must match where your identity is verified
ses = boto3.client('sesv2', region_name='us-east-1')

# 1) Ping / sanity check: list verified identities
try:
    resp = ses.list_email_identities(PageSize=10)
    print('Verified identities:', [i['IdentityName'] for i in resp.get('EmailIdentities', [])])
except ClientError as e:
    print('Ping failed:', e.response['Error']['Message'])
    raise

# 2) Add a subscriber to a contact list
try:
    ses.create_contact(
        ContactListName='smtpedia-newsletter',
        EmailAddress='reader@example.com',
        UnsubscribeAll=False,
        AttributesData='{"first_name":"Alaa"}'
    )
    print('Subscriber added.')
except ses.exceptions.AlreadyExistsException:
    print('Contact already exists.')
except ClientError as e:
    print('Create failed:', e.response['Error']['Message'])
    raise

# 3) Send a transactional email
try:
    ses.send_email(
        FromEmailAddress='hello@yourdomain.com',
        Destination={'ToAddresses': ['reader@example.com']},
        Content={
            'Simple': {
                'Subject': {'Data': 'Welcome to SMTPedia'},
                'Body': {'Text': {'Data': 'Thanks for signing up.'}}
            }
        }
    )
    print('Email sent.')
except ClientError as e:
    print('Send failed:', e.response['Error']['Message'])

Node.js (@aws-sdk/client-sesv2): add contact, send email

import { SESv2Client, CreateContactCommand, SendEmailCommand } from '@aws-sdk/client-sesv2';

const ses = new SESv2Client({ region: 'us-east-1' });

async function main() {
  // 1) Add a subscriber to a contact list
  try {
    await ses.send(new CreateContactCommand({
      ContactListName: 'smtpedia-newsletter',
      EmailAddress: 'reader@example.com',
      UnsubscribeAll: false,
      AttributesData: JSON.stringify({ first_name: 'Alaa' })
    }));
    console.log('Subscriber added.');
  } catch (err) {
    if (err.name !== 'AlreadyExistsException') throw err;
    console.log('Contact already exists.');
  }

  // 2) Send a transactional email
  await ses.send(new SendEmailCommand({
    FromEmailAddress: 'hello@yourdomain.com',
    Destination: { ToAddresses: ['reader@example.com'] },
    Content: {
      Simple: {
        Subject: { Data: 'Welcome to SMTPedia' },
        Body: { Text: { Data: 'Thanks for signing up.' } }
      }
    }
  }));
  console.log('Email sent.');
}

main().catch(err => { console.error('SES error:', err); process.exit(1); });

Common gotchas

Deprecations and changelog

• August 7, 2026 — SES now emits an isBotEvent field in Open and Click event notifications, letting customers distinguish automated (MPP, security scanners) opens from real human engagement without extra configuration.
• May 29, 2026 — Virtual Deliverability Manager (VDM) launched Inbox Placement Metrics, industry blocklist monitoring, and pre-send inbox-placement testing across all commercial SES regions.
• May 15, 2026 — AWS MCP Server reached general availability, giving agents a first-party MCP entry point into AWS services — the closest AWS has come to an official MCP surface for SES.
• April 1, 2026 — SES Mail Manager added new features for enhanced inbound security and email processing (expanded rules, address list controls, larger archives).
• May 1, 2025 — SES enabled IPv6 support when calling SES outbound endpoints, allowing dual-stack SMTP and API connectivity.

Track future changes in the Amazon SES Developer Guide document history and the AWS Messaging & Targeting What’s New feed.

Frequently asked questions