Postmark’s Email API v1 has been stable for over a decade, ships 13 official client libraries (more than any competitor in this review), and is the reference implementation for teams that want SMTP relay + rich webhooks + clean logs in a single tightly-scoped surface. Where it differentiates in 2026: Postmark is the first mainstream transactional email provider to ship an official Model Context Protocol server, letting Claude Desktop and Cursor send emails, list templates, and pull delivery stats directly through natural language. This tab inventories the API surface, the MCP capabilities, and the gotchas a buyer needs to evaluate before committing.
Model Context Protocol is the emerging standard for connecting LLM agents to external tools. If you want an AI agent (Claude Desktop, ChatGPT, Cursor, custom OpenAI Agents SDK deployment) to send emails through Postmark, MCP is now the connection layer of choice. Here is where Postmark stands.
The Postmark MCP Server is maintained by ActiveCampaign (Postmark’s parent) as part of Postmark Labs. Repository: github.com/ActiveCampaign/postmark-mcp. Four core tools cover the most common AI-agent asks: send a transactional email, send with a pre-defined template, list available templates, retrieve email delivery statistics. Stdio transport, Node.js runtime, works with Claude Desktop and Cursor out of the box. First-class support means faster bug fixes than community wrappers and guaranteed alignment with API changes.
Three ways to reach Postmark from an AI agent as of August 2026, ordered by maturity. The first is official Postmark. The others are bridges through general-purpose MCP layers.
Maintained by ActiveCampaign. 4 tools: send email, send with template, list templates, get stats. Stdio transport. Configure via .env with Server Token + default sender + default stream. Compatible with Claude Desktop, Cursor, any MCP-aware client.
Bridge access via Zapier’s MCP layer (9,000+ integrations available through one endpoint). Scoped action selection. Useful if you already run Zapier for other apps and want unified MCP surface. Each MCP tool call consumes Zapier task credits.
Directory listing for Postmark-related community MCP projects. Most extend the official server with additional tools (server management, message search, bulk send). Check maintenance status before adopting — the official server covers most use cases.
The Postmark Email API follows REST conventions with minimal quirks. Its scope is intentionally narrow: transactional email send and receive, plus supporting resources (templates, sender signatures, webhooks, bounces).
| Base URL | https://api.postmarkapp.com |
|---|---|
| Response format | JSON only |
| Request timeout | Not documented (assume standard 30-60s HTTP timeout) |
| Auth header (server-level) | X-Postmark-Server-Token |
| Auth header (account-level) | X-Postmark-Account-Token |
| Standard email max size | 10 MB (including attachments) |
| Batch email endpoint | POST /email/batch (up to 500 messages, 50 MB total) |
| Bulk email endpoint | POST /email/batchWithTemplates for template-based bulk |
| Message stream selector | MessageStream field in JSON body (SMTP header equivalent) |
| Rate limit response | HTTP 429 (informal enforcement per Postmark docs) |
Endpoints are grouped by concern (email, bounces, templates, servers, message streams, domains, sender signatures, statistics, webhooks, suppressions, data removal, inbound rules triggers) with no deep resource nesting. All requests are stateless: authenticate every call with the appropriate token header. No cursor pagination beyond simple count + offset query parameters where lists are returned.
Two token types, both operating through custom HTTP headers.
Used for the majority of API calls: sending email, managing templates, reading messages, bounces, and stats for a single Server. Scoped to one Postmark Server (a Server in Postmark parlance is a container for domains, message streams, and tokens). Accessible to Account Owners, Admins, and Server Admins in the Postmark UI. Copy from Server › API Tokens.
Used for account-level operations: creating new Servers, managing sender signatures, listing domains across all Servers, initiating data removal requests, managing account-wide DMARC monitoring. Restricted to Account Owners and Admins. Copy from Account › API Tokens. Never expose an Account Token to browser code or client-side JavaScript.
Postmark’s rate-limiting posture is unusually permissive for a modern API: no daily quota, no per-endpoint budget, one loosely-enforced concurrency ceiling.
| Limit | Value | Notes |
|---|---|---|
| Concurrent SMTP connections | 10 per IP | Self-policed. Postmark support docs describe this as “informal” and confirm it is not currently enforced at the load balancer. |
| HTTP API rate limit | Not disclosed | HTTP 429 is returned when Postmark deems the request rate excessive. No published per-second, per-minute, or per-hour ceiling. |
| Batch email size | 500 messages or 50 MB | Whichever hits first. Larger batches must be split client-side. |
| Standard email size | 10 MB | Body + attachments combined. Batch endpoint has the larger 50 MB payload budget. |
| Response on exceed | HTTP 429 | Too Many Requests. No Retry-After header documented. Implement exponential backoff. |
Postmark ships one of the deepest official SDK catalogs in transactional email. Thirteen libraries maintained by ActiveCampaign, covering every mainstream language plus specialized adapters for Rails, WordPress, Craft CMS, and Grunt build pipelines.
| Language / Runtime | Package | Install | Repo |
|---|---|---|---|
| Node.js / TypeScript | postmark | npm install postmark | GitHub |
| Python | postmark-python | pip install postmark-python | GitHub |
| Ruby | postmark | gem 'postmark' | GitHub |
| Ruby on Rails | postmark-rails | gem 'postmark-rails' | GitHub |
| PHP | wildbit/postmark-php | composer require wildbit/postmark-php | GitHub |
| .NET | Postmark | Install-Package Postmark | GitHub |
| Java | postmark | Maven dependency | GitHub |
| Craft CMS | craftcms/postmark | composer require craftcms/postmark | Craft plugin store |
| CLI | postmark-cli | npm i postmark-cli -g | GitHub |
| WordPress plugin | postmark-approved-wordpress-plugin | WP plugin repo | WordPress.org |
| Grunt | grunt-postmark | npm install grunt-postmark --save | GitHub |
The endpoint groups you will actually use in production. Full reference at postmarkapp.com/developer/api covers roughly 100 individual operations across all groups.
| Resource | HTTP methods | Description |
|---|---|---|
| Email (single) POST /email | POST | Send a single transactional or broadcast email with optional MessageStream selector. |
| Email (batch) POST /email/batch | POST | Send up to 500 emails in one HTTP call. 50 MB payload limit. |
| Email with template POST /email/withTemplate | POST | Send using a pre-defined template with dynamic merge variables. Server-side rendering. |
| Templates /templates | GET, POST, PUT, DELETE | Full CRUD on email templates. Includes HTML + text bodies, subject line templating. |
| Servers /servers | GET, POST, PUT, DELETE | Account-level. Manage Servers (containers for domains + streams + tokens). Requires Account Token. |
| Message Streams /message-streams | GET, POST, PATCH, DELETE | Manage transactional and broadcast streams. Configure per-stream sending caps and subscription management. |
| Messages (outbound) /messages/outbound | GET | Search and retrieve sent messages by recipient, date range, tag, status, message ID. |
| Messages (inbound) /messages/inbound | GET | Retrieve inbound emails routed through Postmark’s inbound processing (Pro and Platform plans). |
| Bounces /bounces | GET, PUT, DELETE | List, retrieve, and reactivate bounced addresses. Bounce type classification. |
| Statistics /stats/outbound | GET | Aggregate outbound stats: sends, opens, clicks, bounces, spam complaints. Grouped by date, tag, platform. |
| Domains /domains | GET, POST, PUT | Account-level. Manage sending domains, verify DKIM, verify Return-Path, request DMARC monitoring. |
| Sender signatures /senders | GET, POST, PUT, DELETE | Individual From address verification. Alternative to full domain verification for small setups. |
| Webhooks /webhooks | GET, POST, PUT, DELETE | Configure webhooks for 15+ event types: delivery, bounce, spam complaint, open, click, subscription changes. |
| Suppressions /message-streams/{id}/suppressions | GET, POST, DELETE | Per-stream suppression list management. Add, remove, list suppressed recipients. |
| Data removal /data-removals | POST, GET | GDPR-style right-to-erasure requests for specific recipients across message history. |
Two representative snippets covering the most common first-day tasks: send a single email, then send a batch with a template.
const postmark = require('postmark');
const client = new postmark.ServerClient('YOUR_SERVER_API_TOKEN');
client.sendEmail({
From: 'sender@yourdomain.com',
To: 'recipient@example.com',
Subject: 'Test from Postmark API',
HtmlBody: '<h1>Hello</h1><p>This is a test.</p>',
TextBody: 'Hello. This is a test.',
MessageStream: 'outbound'
}).then(response => {
console.log(`Sent: ${response.MessageID}`);
}).catch(err => {
console.error(`Error: ${err.message}`);
});from postmark import PMBatchMail
messages = [
{
'From': 'sender@yourdomain.com',
'To': recipient,
'TemplateAlias': 'welcome-email',
'TemplateModel': {
'name': name,
'product_url': 'https://yourdomain.com/dashboard'
},
'MessageStream': 'outbound'
}
for (recipient, name) in [
('alice@example.com', 'Alice'),
('bob@example.com', 'Bob'),
# ... up to 500 messages per batch
]
]
batch = PMBatchMail(api_key='YOUR_SERVER_API_TOKEN', messages=messages)
result = batch.send()
print(f'Batch sent: {len(result)} messages processed')The X-Postmark-Server-Token header handles 90% of API calls (send, templates, messages, bounces, stats). The X-Postmark-Account-Token header is for account-level operations only (create Servers, manage domains across Servers). Using the wrong token type returns 401 Unauthorized with a confusing “invalid token” message. Match the token type to the endpoint.
If you do not include a MessageStream field in your JSON body, Postmark routes through the default outbound transactional stream. This is usually what you want for password resets and receipts, but it silently pollutes reputation if you meant to send a broadcast. Always set MessageStream explicitly for anything that goes to a list.
POST /email/batch returns HTTP 200 even if all 500 messages inside failed to queue. Individual message status is in each entry of the response array. Check ErrorCode per message — not the top-level HTTP status — to detect failures. First-time batch users often assume 200 means everything sent.
A Server Token can do everything the Server allows: send, read logs, manage templates, delete stored activity. There is no “send-only” scope. If you need finer control (e.g. a token for a third-party integration that should not read your customer emails), the workaround is to isolate that integration into its own Server with its own token.
Postmark does not publish concrete per-second or per-hour ceilings, and does not enforce them at the load balancer. What they DO enforce is aggregate abuse patterns (elevated spam complaints, sudden volume spikes on unwarmed IPs, high bounce rate). Persistent bad behavior triggers manual account review — sometimes hours-long pauses. If you are planning a 10x volume spike, email Postmark support first.
Postmark maintains a public changelog and release notes on the Updates page. Key items to know:
Yes. The Postmark MCP Server, maintained by ActiveCampaign as part of Postmark Labs, is available at github.com/ActiveCampaign/postmark-mcp. Four tools: send transactional email, send with template, list templates, retrieve delivery stats. Released June 2025. Stdio transport, Node.js runtime, compatible with Claude Desktop, Cursor, and any MCP-aware client. Postmark is the first mainstream transactional email provider to ship an official MCP.
Eleven official language/runtime SDKs: Node.js/TypeScript, Python, Ruby, Rails, PHP, .NET, Java, plus specialized integrations for Craft CMS, WordPress plugin, CLI, and Grunt. All maintained by ActiveCampaign. No official SDK for Go, Rust, Kotlin, or Swift — recommendation for those is to call the API directly with your language’s HTTP client. Postmark’s SDKs are actively maintained (unlike Mailchimp’s official Marketing SDKs, frozen since November 2022).
Officially: 10 concurrent SMTP connections per IP, self-policed. HTTP API returns 429 Too Many Requests when Postmark deems request rate excessive, but no per-second or per-hour ceiling is published. Postmark’s stance is “we trust customers to self-police, we watch aggregate abuse patterns.” For sustained high-volume sending (100k+/month), contact support to coordinate a dedicated IP ($50/mo) and warmup plan.
Two HTTP header tokens. X-Postmark-Server-Token for server-level operations (send, templates, messages, bounces, stats) — scoped to one Postmark Server. X-Postmark-Account-Token for account-level operations (create Servers, manage domains across Servers, data removal requests). Tokens do not have granular scopes; isolate access by splitting into separate Servers if you need finer control.
A Server Token grants access to one specific Postmark Server (a Server is a container for domains, message streams, tokens, and templates). Use it for 90% of API calls including all send operations. An Account Token grants access to account-level operations across all your Servers: creating new Servers, managing domains globally, initiating GDPR data removal requests, managing DMARC monitoring. Only Account Owners and Admins can create Account Tokens. Never expose an Account Token in client-side code.
Yes. Install the official Postmark MCP Server and add it to your Claude Desktop or Cursor config. Configure with a Postmark Server Token, default sender email, and default message stream. Once loaded, you can prompt “Send a test email to team@example.com about tomorrow’s deployment” and the agent dispatches through your Postmark infrastructure. Four tools available: send, send with template, list templates, get stats.
The published 10-concurrent-connection ceiling is not currently enforced at the load balancer per Postmark’s own support documentation. What IS enforced is aggregate abuse pattern detection: elevated spam complaints, sudden volume spikes on unwarmed IPs, high bounce rate. Persistent bad behavior triggers manual account review, sometimes with account pauses lasting hours. Clean senders effectively see no rate limits — Postmark’s stance is “self-policing plus aggregate watching.”
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.