SchemaVaults Mail Server API

v0.0.109OpenAPI 3.1

API for managing mailing lists and sending transactional email. Admin routes require an admin JWT bearer token; /api/send and /api/templates also accept a mail-server API key. Interactive documentation lives at /docs.

Base URLhttps://mail.schemavaults.comRaw OpenAPI document

Authentication

Admin JWTAdmin JWT access token issued by the auth server. The authenticated user must have the admin role.
API keyMail-server API key (`svlts_mail_pk_...`) created by an admin at /admin/keys. Subject to the key's audience, sender, and transport scopes.

Send

Send transactional or mailing-list email through a configured transport.

POST/api/send

Send an email

Sends a transactional email or a mailing-list send (when `to` is a mailing-list UUID). Accepts either an admin JWT or a mail-server API key; API-key callers are checked against the key's audience, sender, and transport scopes — admins bypass all scopes.

Admin JWTAPI key(either accepted)

Request body

application/json

messageone of 2required
Either a template reference (rendered server-side via react-email) or a raw text+html body.
toone of 3required
Recipient email address, array of addresses (max 50), or a mailing-list UUID — the send then goes to every active (non-unsubscribed) subscriber of that list.
fromstring
Sender, as a bare address or `Display Name <address>` form. Defaults to the server's configured MAIL_FROM sender.
Example: Example <noreply@example.com>
subjectstringrequired
Example: Welcome!
replyTostring
ccone of 2
bccone of 2
dryRunboolean
When true, validates the request (and renders the template, if any) without dispatching mail.
transportMailTransportKind · string
Which configured transport should deliver this message. Defaults to the deployment's MAIL_TRANSPORT.
one of:resendsmtptest-database-transport

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/send' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "message": {
    "template_id": "mailing-list-confirmation"
  },
  "to": "user@example.com",
  "from": "Example <noreply@example.com>",
  "subject": "Welcome!",
  "replyTo": "string",
  "cc": "user@example.com",
  "bcc": "user@example.com",
  "dryRun": true,
  "transport": "resend"
}'

Responses

200The email was sent (or validated, for dry runs).
400Invalid request body, unknown/unconfigured/admin-disabled transport, invalid template, or empty/oversized mailing list.
401Missing or invalid credentials.
403The API key's audience, sender, or transport scope forbids this send.
500Failed to prepare or dispatch the email.

Mailing Lists

Mailing lists, double-opt-in subscriptions, and unsubscribes.

GET/api/mailing-lists

List mailing lists

Public directory of mailing lists. Anonymous callers only see public lists; an optional admin bearer token widens the listing to private ones.

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/mailing-lists'

Responses

200The mailing lists visible to the caller.
500Failed to list mailing lists.

POST/api/mailing-lists

Create a mailing list

Admin JWT

Request body

application/json

namestringrequiredmin length 3max length 64
Example: Product updates
descriptionstringrequiredmin length 3max length 256
Example: Occasional announcements about new features.
publicbooleanrequired
Whether the list is shown in the public mailing list directory.

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/mailing-lists' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "Product updates",
  "description": "Occasional announcements about new features.",
  "public": true
}'

Responses

200The mailing list was created.
400Invalid request body.
401Missing or invalid admin credentials.
500Failed to create the mailing list.

POST/api/mailing-lists/join

Start a mailing list subscription (double opt-in)

Sends a confirmation email to the address; the subscription only becomes active once the emailed link is confirmed via POST /api/mailing-lists/confirm. The response does not reveal whether the address was already subscribed. Subject to the CORS origin allowlist for cross-origin browser calls.

Request body

application/json

Starts a double-opt-in subscription: a confirmation email is sent to the address before it is added to the list.

emailstringrequiredemail
Email address to subscribe.
Example: subscriber@example.com
mailing_list_idstringrequireduuid
ID of the mailing list to join.
Example: b7d1f9c2-4a3e-4d24-9f6b-2f42f8f0a111

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/mailing-lists/join' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "subscriber@example.com",
  "mailing_list_id": "b7d1f9c2-4a3e-4d24-9f6b-2f42f8f0a111"
}'

Responses

200A confirmation email has been sent (or the address was already subscribed).
400Invalid request body.
500Failed to start the subscription.

POST/api/mailing-lists/confirm

Confirm a pending mailing list subscription

Completes the double opt-in started by POST /api/mailing-lists/join, using the token from the confirmation email. Confirming an already-confirmed subscription succeeds idempotently.

Request body

application/json

tokenstringrequiredmin length 43max length 43
43-character URL-safe base64 confirmation token from the confirmation email link.
emailstringrequiredemail
Email address the confirmation was sent to.
Example: subscriber@example.com

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/mailing-lists/confirm' \
  -H 'Content-Type: application/json' \
  -d '{
  "token": "string",
  "email": "subscriber@example.com"
}'

Responses

200The subscription is confirmed.
400The confirmation link is invalid.
410The confirmation link has expired.
500Failed to confirm the subscription.

POST/api/mailing-lists/unsubscribe

Unsubscribe from a mailing list

Records an unsubscribe for the address on the given mailing list; future sends to that list skip the address.

Request body

application/json

emailstringrequiredemail
Email address to unsubscribe.
Example: subscriber@example.com
mailing_list_idstringrequireduuid
ID of the mailing list to leave.
Example: b7d1f9c2-4a3e-4d24-9f6b-2f42f8f0a111

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/mailing-lists/unsubscribe' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "subscriber@example.com",
  "mailing_list_id": "b7d1f9c2-4a3e-4d24-9f6b-2f42f8f0a111"
}'

Responses

200The address was unsubscribed.
400Invalid request body.
500Failed to unsubscribe the address.

GET/api/mailing-lists/subscribers

List a mailing list's subscribers

Admin JWT

Parameters

mailing_list_idquerystringrequired
ID of the mailing list whose subscribers to list.

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/mailing-lists/subscribers?mailing_list_id=<mailing_list_id>' \
  -H 'Authorization: Bearer <token>'

Responses

200The mailing list's subscribers.
400Invalid or missing mailing_list_id query parameter.
401Missing or invalid admin credentials.
500Failed to list subscribers.

Templates

The react-email template catalog.

GET/api/templates

List available email templates

Lists the react-email templates in this server's catalog. Accepts either a mail-server API key or an admin JWT.

Admin JWTAPI key(either accepted)

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/templates' \
  -H 'Authorization: Bearer <token>'

Responses

200The template catalog.
401Missing or invalid credentials.
500Failed to list email templates.

Branding

Public white-label branding assets (logo, favicon).

GET/api/branding/{asset_kind}

Serve a branding asset (logo or favicon)

Public, unauthenticated. Serves the admin-uploaded asset for the kind; kinds without an upload (or with the database unreachable) redirect to the bundled default asset.

Parameters

asset_kindpathBrandingAssetKindrequired
Kind of white-label branding asset.
one of:logofavicon

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/branding/<asset_kind>'

Responses

200The uploaded asset's image bytes.
307Redirect to the bundled default asset for this kind (no custom upload).
404Unknown branding asset kind.

Test Emails

Read emails captured by the fake-send test-database transport, for E2E-testing the /api/send flow.

GET/api/test-emails

List emails captured by the test-database transport

Lists emails 'sent' through the fake test-database-transport, newest first. Accepts an admin JWT, or a mail-server API key whose transport scope permits the test-database transport. Intended for E2E tests verifying the full /api/send flow without real delivery.

Admin JWTAPI key(either accepted)

Parameters

limitqueryinteger
Page size (default 50, max 200).
offsetqueryinteger
Rows to skip, for paging (default 0).

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/test-emails' \
  -H 'Authorization: Bearer <token>'

Responses

200The captured test emails, newest first.
400Invalid limit/offset query parameters.
401Missing or invalid credentials.
403The API key's transport scope does not permit the test-database transport.
500Failed to list test emails.

GET/api/test-emails/{test_email_id}

Read one email captured by the test-database transport

Reads a single fake-sent email by ID (the ID is also returned as the transport's message ID). Same authorization as the list endpoint.

Admin JWTAPI key(either accepted)

Parameters

test_email_idpathstringrequired
ID of the captured test email.

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/test-emails/<test_email_id>' \
  -H 'Authorization: Bearer <token>'

Responses

200The captured test email.
400Invalid test_email_id; must be a valid UUID.
401Missing or invalid credentials.
403The API key's transport scope does not permit the test-database transport.
404No test email exists with this ID.
500Failed to read the test email.

Admin: API Keys

Manage API keys and their audience, sender, and transport scopes (admin only).

GET/api/admin/api-keys

List active API keys

Admin JWT

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/admin/api-keys' \
  -H 'Authorization: Bearer <token>'

Responses

200The active (non-revoked) API keys.
401Missing or invalid admin credentials.
500Failed to list API keys.

POST/api/admin/api-keys

Create an API key

Creates a key with allow_any_audience=false and no scope entries, so it can send to nobody until its audience is configured. The plaintext token is returned exactly once.

Admin JWT

Request body

application/json

namestringrequiredmin length 1max length 64
Human-facing API key label (1-64 characters).
Example: marketing-site

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/admin/api-keys' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "marketing-site"
}'

Responses

200The created key, including its plaintext token (shown only this once).
400Invalid request body.
401Missing or invalid admin credentials.
500Failed to create the API key.

PATCH/api/admin/api-keys/{api_key_id}

Update an API key

`name` renames the key's label; `allow_any_audience` toggles the key's permission to send to any recipient. The key's ID, secret and scope entries are unchanged either way.

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Request body

application/json

namestringmin length 1max length 64
Human-facing API key label (1-64 characters).
Example: marketing-site
allow_any_audienceboolean
When true, the key may send to ANY recipient and its audience allowlists are ignored.

Example request

bash

curl -X PATCH 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "marketing-site",
  "allow_any_audience": true
}'

Responses

200The updated key.
400Invalid api_key_id or request body.
401Missing or invalid admin credentials.
404No active API key with this ID.
500Failed to update the API key.

DELETE/api/admin/api-keys/{api_key_id}

Revoke an API key

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Example request

bash

curl -X DELETE 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>' \
  -H 'Authorization: Bearer <token>'

Responses

200The key was revoked.
400Invalid api_key_id.
401Missing or invalid admin credentials.
500Failed to revoke the API key.

GET/api/admin/api-keys/{api_key_id}/allowlist

List an API key's audience mailing-list allowlist entries

Mailing-list entries and individual-recipient entries form ONE combined audience allowlist for the key (unless the key's allow_any_audience flag is set).

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/allowlist' \
  -H 'Authorization: Bearer <token>'

Responses

200The key's audience mailing-list allowlist entries.
400Invalid api_key_id.
401Missing or invalid admin credentials.
500Failed to list the key's audience mailing-list allowlist entries.

POST/api/admin/api-keys/{api_key_id}/allowlist

Add a mailing list to an API key's audience mailing-list allowlist

Mailing-list entries and individual-recipient entries form ONE combined audience allowlist for the key (unless the key's allow_any_audience flag is set).

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Request body

application/json

mailing_list_idstringrequireduuid
Mailing list to add to / remove from the key's audience.

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/allowlist' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "mailing_list_id": "00000000-0000-0000-0000-000000000000"
}'

Responses

200The mailing list was added.
400Invalid api_key_id, invalid body, or unknown referenced resource.
401Missing or invalid admin credentials.
500Failed to add the mailing list.

DELETE/api/admin/api-keys/{api_key_id}/allowlist

Remove a mailing list from an API key's audience mailing-list allowlist

Mailing-list entries and individual-recipient entries form ONE combined audience allowlist for the key (unless the key's allow_any_audience flag is set).

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Request body

application/json

mailing_list_idstringrequireduuid
Mailing list to add to / remove from the key's audience.

Example request

bash

curl -X DELETE 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/allowlist' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "mailing_list_id": "00000000-0000-0000-0000-000000000000"
}'

Responses

200The mailing list was removed.
400Invalid api_key_id or invalid body.
401Missing or invalid admin credentials.
500Failed to remove the mailing list.

GET/api/admin/api-keys/{api_key_id}/recipients

List an API key's audience recipient allowlist entries

Individual-recipient entries and mailing-list entries form ONE combined audience allowlist for the key (unless the key's allow_any_audience flag is set).

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/recipients' \
  -H 'Authorization: Bearer <token>'

Responses

200The key's audience recipient allowlist entries.
400Invalid api_key_id.
401Missing or invalid admin credentials.
500Failed to list the key's audience recipient allowlist entries.

POST/api/admin/api-keys/{api_key_id}/recipients

Add a recipient to an API key's audience recipient allowlist

Individual-recipient entries and mailing-list entries form ONE combined audience allowlist for the key (unless the key's allow_any_audience flag is set).

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Request body

application/json

emailstringrequiredemail
Individual recipient address to add to / remove from the key's audience.
Example: customer@example.com

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/recipients' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "customer@example.com"
}'

Responses

200The recipient was added.
400Invalid api_key_id, invalid body, or unknown referenced resource.
401Missing or invalid admin credentials.
500Failed to add the recipient.

DELETE/api/admin/api-keys/{api_key_id}/recipients

Remove a recipient from an API key's audience recipient allowlist

Individual-recipient entries and mailing-list entries form ONE combined audience allowlist for the key (unless the key's allow_any_audience flag is set).

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Request body

application/json

emailstringrequiredemail
Individual recipient address to add to / remove from the key's audience.
Example: customer@example.com

Example request

bash

curl -X DELETE 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/recipients' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "customer@example.com"
}'

Responses

200The recipient was removed.
400Invalid api_key_id or invalid body.
401Missing or invalid admin credentials.
500Failed to remove the recipient.

GET/api/admin/api-keys/{api_key_id}/senders

List an API key's allowed-senders scope entries

With zero entries the sender dimension is unrestricted; otherwise the send's `from` (after default fallback) and `replyTo` must each match an entry (exact address or `*@domain` wildcard).

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/senders' \
  -H 'Authorization: Bearer <token>'

Responses

200The key's allowed-senders scope entries.
400Invalid api_key_id.
401Missing or invalid admin credentials.
500Failed to list the key's allowed-senders scope entries.

POST/api/admin/api-keys/{api_key_id}/senders

Add a sender to an API key's allowed-senders scope

With zero entries the sender dimension is unrestricted; otherwise the send's `from` (after default fallback) and `replyTo` must each match an entry (exact address or `*@domain` wildcard).

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Request body

application/json

senderstringrequired
A lowercase email address, or a `*@domain` wildcard permitting any local part at that domain.
Example: *@example.com

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/senders' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "sender": "*@example.com"
}'

Responses

200The sender was added.
400Invalid api_key_id, invalid body, or unknown referenced resource.
401Missing or invalid admin credentials.
500Failed to add the sender.

DELETE/api/admin/api-keys/{api_key_id}/senders

Remove a sender from an API key's allowed-senders scope

With zero entries the sender dimension is unrestricted; otherwise the send's `from` (after default fallback) and `replyTo` must each match an entry (exact address or `*@domain` wildcard).

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Request body

application/json

senderstringrequired
A lowercase email address, or a `*@domain` wildcard permitting any local part at that domain.
Example: *@example.com

Example request

bash

curl -X DELETE 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/senders' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "sender": "*@example.com"
}'

Responses

200The sender was removed.
400Invalid api_key_id or invalid body.
401Missing or invalid admin credentials.
500Failed to remove the sender.

GET/api/admin/api-keys/{api_key_id}/transports

List an API key's allowed-transports scope entries

With zero entries the transport dimension is unrestricted; otherwise the send's resolved transport (explicit or deployment default) must be an entry.

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/transports' \
  -H 'Authorization: Bearer <token>'

Responses

200The key's allowed-transports scope entries.
400Invalid api_key_id.
401Missing or invalid admin credentials.
500Failed to list the key's allowed-transports scope entries.

POST/api/admin/api-keys/{api_key_id}/transports

Add a transport to an API key's allowed-transports scope

With zero entries the transport dimension is unrestricted; otherwise the send's resolved transport (explicit or deployment default) must be an entry.

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Request body

application/json

transport_idMailTransportKind · stringrequired
A mail transport this server knows about.
one of:resendsmtptest-database-transport

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/transports' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "transport_id": "resend"
}'

Responses

200The transport was added.
400Invalid api_key_id, invalid body, or unknown referenced resource.
401Missing or invalid admin credentials.
500Failed to add the transport.

DELETE/api/admin/api-keys/{api_key_id}/transports

Remove a transport from an API key's allowed-transports scope

With zero entries the transport dimension is unrestricted; otherwise the send's resolved transport (explicit or deployment default) must be an entry.

Admin JWT

Parameters

api_key_idpathstringrequired
ID of the API key.

Request body

application/json

transport_idMailTransportKind · stringrequired
A mail transport this server knows about.
one of:resendsmtptest-database-transport

Example request

bash

curl -X DELETE 'https://mail.schemavaults.com/api/admin/api-keys/<api_key_id>/transports' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "transport_id": "resend"
}'

Responses

200The transport was removed.
400Invalid api_key_id or invalid body.
401Missing or invalid admin credentials.
500Failed to remove the transport.

Admin: Branding

Upload or remove white-label branding assets (admin only).

PUT/api/admin/branding/{asset_kind}

Upload a custom branding asset

Multipart form upload with the image under the `file` field (max 1MB). Replaces any previously uploaded asset of the same kind.

Admin JWT

Parameters

asset_kindpathBrandingAssetKindrequired
Kind of white-label branding asset.
one of:logofavicon

Request body

multipart/form-data

filestringrequiredbinary
The image file (png, jpeg, webp, svg, or ico).

Example request

bash

curl -X PUT 'https://mail.schemavaults.com/api/admin/branding/<asset_kind>' \
  -H 'Authorization: Bearer <token>' \
  -F 'file=@./<file>'

Responses

200The asset was uploaded.
400Missing file field, unsupported image type, or oversized image.
401Missing or invalid admin credentials.
404Unknown branding asset kind.
500Failed to store the asset.

DELETE/api/admin/branding/{asset_kind}

Remove a custom branding asset

Reverts the app to the bundled default asset for the kind.

Admin JWT

Parameters

asset_kindpathBrandingAssetKindrequired
Kind of white-label branding asset.
one of:logofavicon

Example request

bash

curl -X DELETE 'https://mail.schemavaults.com/api/admin/branding/<asset_kind>' \
  -H 'Authorization: Bearer <token>'

Responses

200The custom asset was removed.
401Missing or invalid admin credentials.
404Unknown branding asset kind.
500Failed to remove the asset.

Admin: CORS

Manage the CORS origin allowlist for public API routes (admin only).

GET/api/admin/cors-origins

List allowed CORS origins

Admin JWT

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/admin/cors-origins' \
  -H 'Authorization: Bearer <token>'

Responses

200The allowed CORS origins.
401Missing or invalid admin credentials.
500Failed to list allowed CORS origins.

POST/api/admin/cors-origins

Allow a CORS origin

Admin JWT

Request body

application/json

originstringrequiredmin length 1max length 255
A web origin of the form scheme://host[:port] with no path or trailing slash.
Example: https://app.example.com
descriptionstringmax length 255
Optional human-readable note about the origin.

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/admin/cors-origins' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "origin": "https://app.example.com",
  "description": "string"
}'

Responses

200The origin was allowed.
400Invalid request body.
401Missing or invalid admin credentials.
409The origin is already allowed.
500Failed to allow the CORS origin.

DELETE/api/admin/cors-origins/{cors_origin_id}

Remove an allowed CORS origin

Admin JWT

Parameters

cors_origin_idpathstringrequired
ID of the allowed-origin entry.

Example request

bash

curl -X DELETE 'https://mail.schemavaults.com/api/admin/cors-origins/<cors_origin_id>' \
  -H 'Authorization: Bearer <token>'

Responses

200The origin was removed.
400Invalid cors_origin_id.
401Missing or invalid admin credentials.
500Failed to remove the CORS origin.

Admin: Templates

Inspect and preview email templates (admin only).

GET/api/admin/templates

List email template IDs

Admin JWT

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/admin/templates' \
  -H 'Authorization: Bearer <token>'

Responses

200The template IDs in this server's catalog.
401Missing or invalid admin credentials.

GET/api/admin/templates/preview

Preview a template with sample props

Admin JWT

Parameters

template_idquerystringrequired
Template to render with its bundled sample props.

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/admin/templates/preview?template_id=<template_id>' \
  -H 'Authorization: Bearer <token>'

Responses

200The rendered template HTML.
400Unknown template, invalid props, or invalid request.

POST/api/admin/templates/preview

Preview a template with custom props

Admin JWT

Request body

application/json

template_idstringrequired
Template to render.
Example: mailing-list-confirmation
propsobject
Props passed to the template component. Non-object values are treated as {}.

Example request

bash

curl -X POST 'https://mail.schemavaults.com/api/admin/templates/preview' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "template_id": "mailing-list-confirmation",
  "props": {}
}'

Responses

200The rendered template HTML.
400Unknown template, invalid props, or invalid request.

Admin: Transports

Inspect configured mail transports (admin only).

GET/api/admin/transports

List mail transports with configured/default status

Admin JWT

Example request

bash

curl -X GET 'https://mail.schemavaults.com/api/admin/transports' \
  -H 'Authorization: Bearer <token>'

Responses

200The transports this server knows about.
401Missing or invalid admin credentials.
500Failed to resolve mail transport availability.

PATCH/api/admin/transports/{transport_id}

Enable or disable the test-database transport

Toggles a transport's runtime kill switch. Only the fake-send `test-database-transport` supports this — it lets an admin stop fake sending in production without a redeploy. The real delivery transports (`resend`, `smtp`) are controlled by environment variables and reject this call.

Admin JWT

Parameters

transport_idpathMailTransportKindrequired
The transport to update.
one of:resendsmtptest-database-transport

Request body

application/json

enabledbooleanrequired
Whether the transport may be used for sends. Only supported for the test-database-transport.

Example request

bash

curl -X PATCH 'https://mail.schemavaults.com/api/admin/transports/<transport_id>' \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "enabled": true
}'

Responses

200The transport's updated status.
400Unknown transport, a transport that cannot be toggled, or an invalid request body.
401Missing or invalid admin credentials.
500Failed to update the transport setting.