Campaign Monitor API + MCP (2026): v3.3, 7 SDKs, no MCP server

Campaign Monitor exposes one public REST API — v3.3 at https://api.createsend.com/api/v3.3/ — covering campaigns, clients, lists, subscribers, segments, journeys, templates, webhooks and transactional email. Seven client libraries sit in the official GitHub organisation; only two saw a commit in 2026. On the agent axis the verdict is blunt: as of August 2026 there is no official Campaign Monitor or Marigold MCP server. Every agent pipeline in production runs on a community wrapper, a broker, or bespoke glue over v3.3.

At a glance

MCP integration in 2026

Model Context Protocol lets an LLM agent discover and call a vendor’s API without a hand-written integration layer — list campaigns, add a subscriber, fire a transactional send, all as typed tool calls. A first-party server means the vendor owns the tool surface, the auth model and the rate-limit behaviour. Campaign Monitor has shipped nothing, so all three belong to whoever wrote your wrapper.

Available MCP servers

Three routes exist, none run by Campaign Monitor. Weigh them on who holds your API key: the community server keeps it in your config, the brokers hold it on theirs.

Campaign Monitor API essentials

v3.3 is a conventional resource-oriented REST surface. Everything hangs off a client — the tenant owning lists, campaigns, journeys and transactional groups — so nearly every call needs a clientID or an ID derived from one. Responses are JSON, and errors carry a numeric Code plus a Message, not just an HTTP status.

Two pagination models coexist and confusing them is the most common integration bug. Standard collections are offset-paged: request a page and read NumberOfPages off the envelope. The transactional timeline is cursor-paged: pass the last ID you saw as sentBeforeID and walk backwards, because the collection mutates while you read it. One generic paginator will silently skip or duplicate records.

The split inside transactional shapes the whole integration. Classic means you supply the entire message — subject, From, recipients, HTML, text, attachments — and it can go over REST or the SMTP relay documented on the Campaign Monitor SMTP tab. Smart means the template lives inside Campaign Monitor and you POST only a Data object of merge variables. Smart emails are API-only.

Authentication methods

Three credential types exist and they are not interchangeable. Picking the wrong one is the largest single source of 401 responses here.

HTTP Basic with an API key

The default for server-side code you own. Take the key from Account Settings › API keys and send it as the Basic username, with any non-empty dummy string as the password — that field is ignored. The key authenticates the whole account, so one leak exposes every client, list and campaign.

OAuth 2.0

The right choice for any third-party application acting on someone else’s account. Both the Web Application and Non-Web Application flows are supported. Access tokens expire and renew via a refresh token, so you need durable token storage and a refresh path before you ship, not after the first expiry incident.

SMTP tokens

A transactional-only credential used only by the smtp.api.createsend.com relay, with the same token string in both the SMTP username and password fields. An SMTP token is not an API key and vice versa — neither authenticates against the other surface.

Rate limits

Campaign Monitor documents that rate limiting is enforced and how to detect it, but never publishes the ceiling. Treat the headers as the contract, not a constant in your client.

The workaround is a client that reads X-RateLimit-Remaining on every transactional response and pauses until X-RateLimit-Reset as it nears zero, rather than a fixed sleep. Because the ceiling is undocumented it can move without a changelog entry, so any value you measure locally is an observation, not a guarantee. Plan allowances bite earlier for most accounts: on the Basic monthly plan transactional counts against the tier’s combined send limit, while Unlimited and Premier allow 10x the tier’s subscriber limit. Overrunning it silently moves the account to a higher pricing tier — alert on that yourself first.

Official SDKs

Seven client libraries live in the official campaignmonitor GitHub organisation. They are thin wrappers over REST, not opinionated frameworks — good for stability, bad if you expected retries or typed models. Cadence varies sharply, so check the last-push column before standardising.

Notable community SDKs

No third-party client rivals the official set, because the API is simple enough that teams wrap the endpoints they need in-house. The most substantial community artefact is not an SDK but cmon-mcp, whose roughly 113 generated tools are a de facto JavaScript coverage map of v3.3. For JavaScript and Go, where nothing official exists, direct HTTP calls with Basic auth are a fifteen-line helper.

Endpoints reference

These cover the two jobs developers actually integrate: sending transactional mail, and keeping subscriber data in sync. Full method-by-method reference — campaign reporting, suppression lists, custom fields, journey breakdowns — is in the official v3.3 documentation.

Code examples

Verify an API key with cURL

The fastest credential smoke test. The key goes in the Basic username field and the password is ignored, so any placeholder works.

# API key as username, any dummy string as password
curl -s -u "$CM_API_KEY:x" https://api.createsend.com/api/v3.3/clients

# 200 + JSON -> valid; entries carry ClientID and Name
# 401        -> wrong key, revoked, or you pasted an SMTP token

Send a classic transactional email in Python

Classic means you supply the whole message. Note clientID as a query parameter, the 25-recipient ceiling, and ConsentToTrack, which is mandatory.

import os, requests

r = requests.post(
    "https://api.createsend.com/api/v3.3/transactional/classicEmail/send",
    params={"clientID": os.environ["CM_CLIENT_ID"]},
    auth=(os.environ["CM_API_KEY"], "x"),  # key as user, dummy password
    json={
        "Subject": "Your password reset link",
        "From": "Acme Support <support@mail.example.com>",  # authenticated
        "To": ["customer@example.com"],    # max 25 across To + CC + BCC
        "HTML": "<p>Reset your password.</p>",
        "Text": "Reset your password.",
        "Group": "Password resets",        # reporting bucket, not a list
        "TrackClicks": False,              # keeps raw URLs alive past 90 days
        "ConsentToTrack": "Unchanged",
    },
    timeout=30,
)
r.raise_for_status()

Trigger a smart transactional email in Node.js

Smart emails keep the template inside Campaign Monitor, so the payload is just merge variables. This path has no SMTP equivalent — build on it and a relay is off the table.

const key = process.env.CM_API_KEY;
const id  = process.env.CM_SMART_EMAIL_ID;

const res = await fetch(
  `https://api.createsend.com/api/v3.3/transactional/smartEmail/${id}/send`,
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: "Basic " + Buffer.from(`${key}:x`).toString("base64"),
    },
    body: JSON.stringify({
      To: ["customer@example.com"],
      Data: { firstName: "Alex", resetUrl: "https://example.com/reset?t=a" },
      ConsentToTrack: "Unchanged",
      AddRecipientsToList: false,   // needs true AND a list picked in-app
    }),
  }
);
if (!res.ok) throw new Error(await res.text());

Common gotchas

Deprecations and changelog

The public changelog is product-led, not API-led: the 2026 entries are in-app features, and the last documented change to the public REST surface predates them by two years. Read that as stability for existing integrations and stagnation for anyone waiting on new capability.

• July 1, 2026 — Drip Campaigns launched, alongside My Dashboard, a customisable performance view for administrators.
• March 1, 2026 — Website Builder AI-Generated Templates released, a month after the Website Builder launched as a $10/month add-on.
• January 1, 2026 — AI Email Booster and Segment Mapper launched. Both are in-app AI; neither is agent-facing.
• May 1, 2024 — “New APIs now available”, an expansion of the public v3.x REST surface. Still the most recent documented API-level change.
• March 1, 2024 — Default sending domain activated across accounts for Google and Yahoo bulk sender compliance, with v=DMARC1; p=none; as the minimal compliant record.

No endpoint deprecations have been announced for v3.3. The v3.1 paths in older help-centre samples still resolve, but new integrations should target v3.3. Track changes on the official What’s New page.

Frequently asked questions