Authentication

Every request to https://api.f5send.com/api/v1/* carries an API key as a bearer token:

Authorization: Bearer f5_live_…

Keys have two modes. f5_live_ keys send mail. f5_test_ keys accept the same requests. The worker simulates each message: it delivers nothing, it counts nothing toward metrics, warm-up, caps or the suppression list, and it fires webhooks as normal. See Test mode.

You mint API keys in the console (API keys → New key). The console shows an API key once. The platform stores only a 12-character prefix and a SHA-256 hash. It cannot recover a lost API key. Mint a new one and revoke the old one (see API keys).

Your own key

GET /keys/me returns the identity of the bearer key: id, name, mode, permission and domains. domains is the allowed set: the restriction when the key has one, else every verified domain of the organization. The response carries no secret. The SMTP relay uses this route to verify AUTH (username = key id, password = the key).

SMTP

The SMTP relay uses the same API keys. The username is the id of the key and the password is the token. The relay accepts SEND, FULL, ADMIN and Test keys, and every key rule on this page applies to it.

Permissions

Permission	Who can mint it	What it can do
SEND	Members and admins	Everything except deletes: send, list, read and cancel messages, upsert and read contacts, set subscriptions, create/list/send/cancel broadcasts, post events, list and add suppressions.
FULL	Admins only	All of the above plus DELETE /contacts/:id and DELETE /suppressions/:id. DELETE /contacts/:id also needs a live key with no domain restriction. DELETE /suppressions/:id needs a live key; a domain-restricted key can still delete rows for its own domains.
ADMIN	Admins only, in the console	All of the above plus the management endpoints: domains, keys, webhooks, topics, segments and organization settings. Live keys only. POST /keys refuses to mint an ADMIN key and POST /keys/{id}/rotate refuses to rotate one, so a key can never raise its own tier.

The tiers are a ladder: FULL does everything SEND does, and ADMIN does everything FULL does.

Domain restriction

You can limit an API key to one or more domains of the organization. Such an API key:

• gets 403 forbidden_domain when the from address of a message or broadcast is on another domain;
• only sees messages, broadcasts and suppressions of its domains (others answer 404 not_found);
• must pass domain when it adds a suppression; its suppression list also shows the organization-wide entries that block its sends;
• can call POST /contacts (list signup); that upsert does not start automations;
• cannot call POST /contacts/{id}/subscriptions, POST /events or DELETE /contacts/{id} (403 forbidden_domain).

An API key with no restriction may send from any verified domain of the organization.

Failures

Status	Code	When
401	unauthorized	Header missing or malformed, token unknown, revoked or expired.
403	forbidden_domain	Domain-restricted key used with another domain.
403	forbidden	The key sits below the tier the endpoint needs, for example a SEND key on a FULL endpoint or a FULL key on a management endpoint. The message names the tier required.
403	sending_paused	An admin or an alert rule paused sending for the organization.
429	rate_limited	Over the per-key requests-per-second cap. Wait for Retry-After seconds.

Errors always have the shape { "error": { "code", "message" } }. See Errors.