Email Tools and APIs for Agentic Apps and AI Agents

Keys and scope. Every send is a POST /email with an X-Postmark-Server-Token header, and the Email API reference describes that token as carrying server-level privileges, found on the API Tokens tab of a single server. No narrower send-only credential appears on that page, so the practical boundary is the server itself: give each agent or environment its own server and token. The API overview returns error code 10 when the wrong token type is used for an endpoint.

Retries and duplicates. The send endpoint's field list (From, To, Subject, the two bodies, Tag, Metadata, MessageStream and a few more) has no idempotency key, so duplicate protection is yours to build. The response includes a MessageID that the single-send guide says to log and later match against bounces from the webhook or the API. Your own event id in Metadata gives a second handle to check against.

Limits. The documented ceilings are sizes: 50 recipients across To, Cc and Bcc per message, and 500 messages or 50 MB per batch call. Those pages state no requests-per-second figure, so confirm with support before an agent fans out thousands of calls.

Webhooks and stop signals. Postmark posts delivery, bounce, spam complaint, open, click and subscription-change events to your URL. It does not sign them. The webhooks guide tells you to protect the endpoint with basic HTTP authentication placed in the URL plus an allowlist of Postmark's IP ranges, and its sample handler validates the payload shape before acting. Postmark also tests the endpoint when you save a webhook and pauses an event type that keeps failing, which means a dead bounce handler surfaces as a status. For an agent, a paused bounce stream is the condition worth alerting on.

Test path. Sandbox mode exists so that CI runs and experiments never reach real recipients. For bounce handling, mail to the bounce-testing.postmarkapp.com domain produces a genuine bounce record. A hard-bounce address also lands on the stream's suppression list, and these test messages still count toward monthly volume. The guardrails section shows the documented request body for a soft bounce.

Templates. POST /email/withTemplate takes a TemplateId or a TemplateAlias plus a TemplateModel object, and a batch variant exists (Templates API). Aliases let a prompt say "send the refund-confirmation template" without the model ever seeing a numeric id.

Suppression. Suppressions live per message stream. The Suppressions API can dump, create (50 per call) and delete them, with the reasons HardBounce, SpamComplaint and ManualSuppression, and deleting a HardBounce suppression is the same as reactivating that bounce. A send to an inactive recipient fails with error code 406. Treat the delete call as a human decision rather than an agent tool.

Sequences. There is no sequence builder behind the API. Message streams separate transactional from broadcast traffic, and broadcast streams require unsubscribe handling while transactional and inbound ones default to none (Message Streams API). If an agent needs a drip, your scheduler decides when to call the send endpoint.

Price. From Postmark's pricing page: Basic, Pro and Platform start at $15, $16.50 and $18 for 10,000 emails a month. The slider reads $55, $60.50 and $66 at 50,000, and $115, $126.50 and $138 at 125,000, with no 100,000 stop. The free plan allows 100 emails a month and no overages.

Keys and scope. SendGrid's API key guide lists four permission types: Full Access, Custom Access (you pick endpoints and access levels), Billing Access and Email Address Validation Access. Custom Access limited to Mail Send is the one an agent should hold. A key cannot receive more permission than its creator has, the console shows the secret only once, and an account may hold 100 keys, which is enough for one per agent.

Limits. The v3 API sets limits per endpoint and reports them in X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers; exceeding one returns 429 (rate limit docs). An agent should read those headers instead of hard-coding a number.

Retries, scheduling and undo. The Mail Send reference has no idempotency field. It does have send_at, which schedules a send up to 72 hours ahead, and batch_id, which lets a batch be paused or cancelled through the Scheduled Sends API. That pair is the nearest thing to an undo button among the senders here.

Webhooks and stop signals. The Event Webhook reports processed, delivered, deferred, bounce and dropped delivery events, plus open, click, spam report and unsubscribe engagement events (event reference). Agents tend to miss the dropped event: SendGrid drops mail to an unsubscribed, previously bounced or spam-reporting address, so a send can be accepted and still never leave. Protect the endpoint with the signed webhook (an X-Twilio-Email-Event-Webhook-Signature header checked against a public key), OAuth 2.0, or both.

Test path. Sandbox mode validates a Mail Send request without delivering it, answering 200 instead of the usual 202. It creates no events and uses no credits, and a template id is assumed to hold content rather than checked. It proves the payload is well formed. It cannot rehearse your bounce handler.

Templates. Dynamic template ids begin with d- and take their data through dynamic_template_data, rendered with Handlebars (dynamic templates guide).

Sequences. The API reference menu lists Single Sends and automation statistics. Creating an automation is not among the listed endpoints, so sequence design stays in the dashboard while an agent can create one-off sends and read results.

Price. The Email API pricing page offers 100 emails a day free for 60 days, then Essentials from $19.95 a month, whose selector reads $19.95 at 50,000 emails and $34.95 at 100,000. Pro reads $89.95 at 100,000. Marketing Campaigns has its own free plan of 2,000 contacts and 6,000 emails a month.

Keys and scope. The Messages endpoint authenticates with HTTP basic auth. Webhook calls are signed with an account-wide webhook signing key that is separate from your API key. The send reference describes no narrower send-only credential, so look in the control panel for one before handing an agent the primary key.

Retries and duplicates. That same reference has no idempotency key for sends. The only one on the page belongs to Inbox Placement tests, so deduplication stays with you.

Webhooks and stop signals. Webhooks can be configured at account or domain level for accepted, delivered, temporary_fail, permanent_fail, opened, clicked, unsubscribed and complained events (webhooks guide). Each post carries a token, a timestamp and a signature, and the signature is a hex HMAC-SHA256 of timestamp plus token keyed with the signing key (securing webhooks). A handler can therefore reject a forged bounce before an agent acts on it.

Test path. Setting o:testmode=yes makes Mailgun accept a message without sending it, and the test mode guide warns that you are charged for those messages. An agent test suite that loops over thousands of fixtures in test mode therefore shows up on the invoice.

Templates and correlation. Stored templates are referenced by name, with an optional version and variables passed as JSON. recipient-variables merges per-recipient values into a single batch call, and custom v: variables are echoed in events, which makes them a convenient carrier for your own job id.

Price. Mailgun's pricing page lists Free at 100 emails a day, Basic at $15 for 10,000 a month, Foundation at $35 for 50,000 and Scale at $90 for 100,000. Log retention grows from 1 day on Free and Basic to 5 days on Foundation and 30 on Scale. Retention matters for agents because the log is how you reconstruct what a misbehaving run actually sent.

Keys and scope. Access runs through IAM. A policy grants actions such as ses:SendEmail, and condition keys can restrict ses:Recipients (To, CC and BCC), ses:FromAddress and ses:FeedbackAddress (IAM guide). That is a recipient allow-list enforced by the platform's permission system, which none of the other providers' pages checked here describe.

Sandbox and quotas. New accounts start in a per-region sandbox: mail goes only to verified addresses or the mailbox simulator, at most 200 messages per 24 hours and one per second (production access guide). Beyond the sandbox, sending quotas still limit daily volume and send rate, count per recipient rather than per message, and reject a call that would exceed the daily maximum. AWS recommends one SendEmail call per recipient, since a failed call rejects the whole message.

Retries and duplicates. The SendEmail reference lists no client token, so the check for an earlier send runs in your code before the call.

Webhooks and stop signals. SES has no webhook of its own. Bounce and complaint events arrive by email, through an SNS topic, or as event publishing via configuration sets, and if you set up none of them SES forwards bounces and complaints to the Return-Path address (notifications guide). The SNS route, ending at a queue or function, is the one most agent stacks will build.

Test path. The mailbox simulator accepts success@, bounce@, ooto@, complaint@ and suppressionlist@simulator.amazonses.com, each producing the matching outcome.

Suppression. Accounts created after 25 November 2019 use the account-level suppression list for bounces and complaints by default. SES accepts a message to a suppressed address without sending it, and the message still counts toward the daily quota (suppression list guide).

Price. AWS's pricing page shows new accounts starting on the Essentials plan at $0.16 per 1,000 emails for 0 to 10 million a month. Pro and Enterprise charge $0.22 and $0.23 per 1,000, plus fixed fees of $105 and $500 per account per region per month.

Mailtrap. Its Email Sandbox is a fake SMTP server that captures test mail so it never reaches real recipients, and it needs no domain verification. In the official SDKs the switch to live sending is a sandbox flag plus an inbox id in the client constructor: set the flag to false and drop the id. That makes an agent's staging and production runs differ by one configuration value. The billing plans page lists sending at $15 for 10,000 emails a month, $20 for 50,000 and $30 for 100,000 on Basic, and $85 at 100,000 on Business.

MailerSend. API tokens are generated for a sending domain and carry scopes, so a token can be limited to one domain and the areas it needs. The webhook list covers activity.sent, delivered, soft_bounced, hard_bounced, opened, clicked, unsubscribed and spam_complaint, with deferred and suppressed on paid plans only. Its pricing page gives the free plan 500 emails a month and 100 daily API requests, which an agent in a loop can exhaust quickly, and lists Starter at $31.50 a month for 50,000 emails (billed yearly at $378).

Keys and scope. Resend's API key page and the create-key reference describe two permissions, full_access and sending_access, and a sending key can be locked to one verified domain. Permission and domain can be changed only in the dashboard, since the update endpoint renames a key and nothing else, so an agent holding a sending key has no route to widen it. The dashboard shows each key's last use and request logs, and the page suggests deleting keys unused for 30 days.

Limits. The usage limits page sets a default of 10 requests per second per team across all keys, answered by ratelimit-limit, ratelimit-remaining, ratelimit-reset and retry-after headers and a 429. Quotas are a separate meter. The free plan has a daily cap that resets at midnight UTC, every plan has a monthly one, and exceeding either returns 429 with daily_quota_exceeded or monthly_quota_exceeded.

Retries and duplicates. Send Email and Send Batch accept an Idempotency-Key header, exposed as idempotencyKey in the SDKs, up to 256 characters and remembered for 24 hours (idempotency docs). Reusing a key with a different payload returns 409 invalid_idempotent_request, and a request still in flight returns 409 concurrent_idempotent_requests, which is safe to retry later. The code sample in the guardrails section is taken from those docs.

Webhooks and stop signals. Event types include email.sent, email.delivered, email.delivery_delayed, email.bounced, email.complained, email.failed and email.suppressed, along with contact and domain events (event types). Requests carry Svix headers, and the SDK's verify call needs the raw request body because re-serialised JSON breaks the signature (verification guide). A missed event can be replayed.

Test path. Addresses at resend.dev simulate outcomes: delivered@, bounced@, complained@ and suppressed@resend.dev. A label after a plus sign, such as delivered+signup@resend.dev, separates scenarios in your logs (test emails). The page asks you not to send to invented addresses during testing, because the resulting bounces count against your own domain.

Templates. A published template is sent by id or alias with a variables object. It cannot be combined with html, text or react in the same call, and a call that leaves a variable unfilled fails validation (Send Email reference). FIRST_NAME, LAST_NAME, EMAIL and UNSUBSCRIBE_URL are reserved variable names.

Suppression. An address is suppressed after a hard bounce, a complaint or a manual entry, for the whole team and every domain, for transactional and broadcast mail alike. The list is readable and writable through the API (bulk calls take 100 addresses), and suppression.added and suppression.removed webhooks announce changes. An address removed before its cause is fixed gets suppressed again (suppressions).

Scheduling and cancel. scheduled_at accepts times up to 30 days ahead (schedule docs), and a scheduled email can be removed with the cancel endpoint. Together they give you an approval window.

Sequences and agent tooling. On the Marketing tab, Automations start from custom events your app sends and chain steps that send an email or manage a contact, delay, wait for an event, or branch on a condition. They can be created and inspected through the API, the CLI and MCP, and every trigger produces a run you can debug. The hosted MCP server at mcp.resend.com signs in with OAuth and exposes emails (send, cancel, update, batch), templates, contacts, broadcasts, automations, events, API keys, webhooks and logs. An agent connected that way holds far more than send access, so choose deliberately which tools it may call.

Price. Resend's pricing page lists Free at 3,000 emails a month and 100 a day. Pro is $20 for 50,000 emails and reads $35 at 100,000, and Scale is $90 for 100,000 and $160 at 200,000. The Marketing tab is free up to 1,000 contacts with 10,000 automation runs and 3 segments, then reads $40 at 5,000 contacts, $80 at 10,000, $250 at 50,000 and $450 at 100,000.

Keys and scope. Requests carry a Bearer API key generated under Settings, and the API introduction suggests a separate key for each purpose, lets you revoke any key, and warns against exposing it client-side. No per-key permission levels are listed, so the real boundary is which code path holds the key.

Limits. The baseline is 10 requests per second per team, with a stricter 60 requests per 60 seconds per team for the content API (campaigns, email messages, transactional emails, workflows and similar endpoints). Responses carry x-ratelimit-limit and x-ratelimit-remaining, and exceeding the limit returns 429; Loops recommends retries with exponential backoff and offers higher limits on request. An agent that edits workflows through the API reaches the 60-per-minute ceiling long before the 10-per-second one.

Retries and duplicates. Send event and send transactional email both take an Idempotency-Key header of up to 100 characters. Reusing a key within 24 hours returns 409 Conflict.

Webhooks and stop signals. An account has one webhook endpoint, signed with webhook-id, webhook-timestamp and webhook-signature headers and delivered at up to 10 events per second (webhooks). Email events are delivered, softBounced, hardBounced, unsubscribed and spamReported. A hard bounce unsubscribes the contact, so a contact.unsubscribed event follows it. The API can also check a contact's suppression status and remove the suppression, which is another call to keep out of an agent's toolbox.

Sequences and agent tooling. A POST to the events endpoint names a contact and an event, and any published workflow listening for it takes over the waiting and sending. The API also lists, creates and updates workflows, campaigns and email content, and Loops offers an MCP server plus a CLI with agent skills for coding agents. Transactional email has a preview endpoint for test sends.

Price. Loops' pricing page shows a free plan with unlimited contacts but sends capped at 4,000 in any rolling 30 days to the 1,000 newest contacts, plus a Powered by Loops footer. Paid plans scale with subscribers, reading $99 a month at 9,998 and $249 at 49,989 on the dated slider, and transactional sending is included.

Keys and scope. Customer.io splits access by API. Track and Pipelines use basic authorization, the App API uses bearer authorization, and an App API key covers one workspace (API overview, transactional guide). The cio CLI is built for coding agents and signs in with service-account tokens, which the docs say are for setting up and testing transactional messages and never for production code.

Limits. Track and Pipelines allow 3,000 requests per 3 seconds as a soft limit that is not enforced with 429s. The App API allows 10 requests per second and answers excess with 429 and a Retry-After header, and transactional sends share the 3,000-per-3-seconds figure. Message frequency limits are a different feature that caps how many messages one person receives in a time frame, and an agent-driven journey is where to switch them on.

Transactional sends. Each send should reference a transactional_message_id. Without it the message is tracked as uncategorized, which mixes the metrics of every send type, and through the CLI an agent can pass auto_create to have the record made on first use. If the recipient does not exist yet Customer.io creates the person, so validate addresses before the call or a typo becomes a profile.

Webhooks and stop signals. Reporting webhooks post events such as email_sent, email_delivered, email_bounced, email_dropped, email_spammed, email_failed, email_undeliverable and email_unsubscribed. Failed calls are retried in a batch after an hour, a disabled webhook does not backfill what it missed, and payloads can gain fields without notice, so a handler should ignore keys it does not know (reporting webhooks).

Sequences and agent tooling. Event-triggered automations are the core product: code or an agent records an event and a journey handles delays and eligibility. The App API triggers broadcasts and transactional messages and fetches data. The CLI wraps the Journeys and Data Pipelines APIs behind one cio api command, publishes cio schema for each endpoint, and installs skills for assistants such as Claude Code.

Price. Customer.io's pricing page shows Essentials at $100 a month at 5,000 profiles, $145 at 10,000 and $505+ at 50,000, with 1M email sends included. It meters profiles, not sends. Premium starts at $1,000 a month billed yearly, and companies that have raised under $10M can apply for 12 months free through the Startup Program.