SendPost API + MCP (2026): REST v1, six SDKs, no MCP server

SendPost exposes a single versioned REST API at https://api.sendpost.io/api/v1, authenticated by scoped header keys rather than OAuth, and backed by 6 officially maintained SDKs. The surface is deliberately narrow, send, templates, domains, stats, suppressions, messages, webhooks, IPs, IP pools and sub-accounts, the primitives an ESP or a high-volume sender wires into a product. On the agent side the verdict is blunt: as of August 2026 there is no official SendPost MCP server and no community wrapper, so any AI-agent integration today is a generic HTTP bridge you build and maintain yourself.

At a glance

MCP integration in 2026

Model Context Protocol is now the default way AI agents call SaaS APIs: the vendor ships a server, the agent discovers typed tools, and the integration stops being bespoke glue. Buyers scoping an agent workflow need to know whether that path exists. For SendPost it does not.

Available MCP servers

SendPost API essentials

Conventional JSON over HTTPS, with one structural idea to grasp first: everything is scoped to either an account or a sub-account, and the path segment tells you which. /subaccount/ is the sending plane, email, domains, stats, suppressions, webhooks. /account/ is the control plane, provisioning, dedicated IPs, IP pools. The split exists because SendPost is built for ESPs reselling capacity, where one account fans out into many tenant sub-accounts.

Two things are absent on purpose. SendPost documents no HTTP client timeout, so set your own. And there is no house pagination style: list endpoints take query parameters, but no cursor or link-header contract is published, so page a large suppression list against the OpenAPI specification rather than an assumption. The endpoints that exist are documented well; the cross-cutting conventions are not.

Authentication methods

No OAuth flow, no bearer-token convention. Authentication is a raw API key in a custom header, and there are three distinct credential types plus SMTP AUTH. The wrong one returns a bare 401 Unauthorized with no indication of which scope was expected, the most common first-day failure.

X-SubAccount-ApiKey, the sending plane

The key an application uses at runtime: sending email or a stored template, verifying domains, reading stats, managing suppressions, retrieving a message with its event history, registering webhooks. Scoped to one sub-account, so it is the right credential to hand to a tenant or a single service.

X-SubAccount-ApiKey: your_subaccount_api_key
Content-Type: application/json

X-Account-ApiKey, the control plane

Account-scoped operations need a different key: creating and listing sub-accounts, allocating and releasing dedicated IPs, creating IP pools, and account-level stats and billing. A privileged credential, keep it in provisioning or admin tooling, never in the runtime send path and never in a client bundle.

SMTP AUTH on the relay

The relay at smtp.sendpost.io does not accept an API key by convention. It uses SMTP AUTH over STARTTLS with a username and password issued in the dashboard. The docs say only to get those from your account and use placeholders throughout; they never state whether the username is a fixed literal, the sub-account key, or a generated pair. Read it from the dashboard rather than inferring another vendor’s pattern.

Event Ingestion API Key, the agent credential

On the custom-SMTP path, where SendPost relays outbound through your own Postfix or MTA, the event reporting agent uses an Event Ingestion API Key that the docs explicitly describe as separate from the SendPost API key. Rotating one does not rotate the other, and a broken agent credential produces missing events rather than failed sends, easy to miss for weeks.

Rate limits

SendPost publishes no numeric rate limits: no rate-limit page, no header contract, no plan table, because pricing itself is quote-based. The table states what is documented and what is not; nothing is borrowed from comparable vendors to fill the gaps.

The workaround is client-side throttling with server-side observation. With no published ceiling, treat 429 and 5xx as expected states: exponential backoff with jitter, concurrency capped at a value you chose rather than one you discovered, and a queue rather than a fan-out. If you route through a third-party sending provider, the TPSP model, where SendPost relays via your own SendGrid, Amazon SES, Mailgun, Postmark or SparkPost account, the binding limit is the upstream plan. Caps are contractual: if throughput matters, the number belongs in the order form.

Official SDKs

Six official SDKs live in the github.com/sendpost organisation. Five were refreshed on the same day, December 26, 2025-a coordinated regeneration from the OpenAPI spec, not six release cycles. PHP followed three days later.

Notable community SDKs

There are none worth naming, no third-party SendPost client library surfaced in package registries or public code search. The organisation ships official reference implementations instead: framework examples for Django, NestJS, Laravel, Rails and Spring Boot, and serverless examples for AWS Lambda, Vercel, Netlify, Cloudflare Workers and Supabase Edge Functions.

Endpoints reference

The 15 endpoints that matter in practice. Full schemas are in the official API reference; every path below is relative to https://api.sendpost.io/api/v1.

Notice what is not there: no contact or list resource, no campaign object, no automation trigger, that is the sibling product SendX’s territory. SendPost’s object model is transactional: messages, domains, IPs, pools, tenants. Teams wanting that shape with a self-serve front door usually compare it against Resend, Postmark and MailerSend.

Code examples

Node.js with fetch, no SDK

Because authentication is a plain header, the official JavaScript SDK is optional, a dependency-free client is a few lines, which is often the right call in a serverless function.

const res = await fetch('https://api.sendpost.io/api/v1/subaccount/email/', {
  method: 'POST',
  headers: {
    'X-SubAccount-ApiKey': process.env.SENDPOST_SUBACCOUNT_API_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    from: { email: 'richard@piedpiper.com', name: 'Richard' },
    to: [{ email: 'gavin@hooli.com', name: 'Gavin' }],
    subject: 'Hello World',
    htmlBody: '<strong>it works!</strong>',
    textBody: 'it works!',
    trackOpens: true,
    trackClicks: true,
  }),
});

console.log(res.status, await res.json());

Python with the official SDK

A generated OpenAPI client, so header parameters are passed per call rather than configured once. Note the import name, sendpost_python_sdk-underscores, while the repository uses hyphens.

import sendpost_python_sdk
from sendpost_python_sdk.apis.tags import email_api

with sendpost_python_sdk.ApiClient() as api_client:
    api_instance = email_api.EmailApi(api_client)
    email = {
        "from": {"email": "richard@piedpiper.com"},
        "to": [{"email": "gavin@hooli.com"}],
        "subject": "Hello World",
        "htmlBody": "<strong>it works!</strong>",
        "ippool": "PiedPiper",
    }
    api_response = api_instance.send_email(
        header_params={'X-SubAccount-ApiKey': 'your_api_key'},
        body=email
    )
    print(api_response)

Common gotchas

Deprecations and changelog

SendPost publishes no release-notes page, no changelog and no status page. The events below are verifiable observations, repository push dates and the state of the public product pages, not vendor announcements. Treat them as low-authority and confirm anything load-bearing with your account contact.

• August 19, 2026-Verified as-of state. Product pages consolidated behind a “Switch Products” menu shared with SendX, positioned as an AI-powered deliverability platform for ESPs citing 300M+ emails monthly. No MCP server, no free tier, no published rate limits.
• January 1, 2026-Site copyright rolls to 2026 with the footer attribution “A Product of SendWorks”, reflecting the corporate structure covering both SendX and SendPost.
• December 29, 2025-PHP SDK sendpost-php-sdk updated, the most recently touched of the 6 official SDK repositories.
• December 26, 2025-Coordinated refresh of 5 official SDKs: JavaScript, Python, Go, Ruby and Java updated the same day, consistent with a bulk regeneration from the OpenAPI spec.

The closest thing to a canonical record of change is the OpenAPI specification. Diffing it on a schedule is a reasonable substitute for release notes.

Frequently asked questions