Integration hub
Copy the contract. Ship the send.
One envelope everywhere: success is { data, error, meta } with X-Request-ID. Device gateways keep the legacy { success, data } envelope for compatibility.
Email API
- POST /api/v1/emails → 202 + Location
- POST /api/v1/emails/batch → per-item results
- POST /api/v1/emails/cancel by id or Idempotency-Key
- GET /api/v1/emails · GET /api/v1/emails/:id
Auth: Bearer re_live_… · domain verified before send · suppression gate.
SMS API
- POST /api/v1/sms/messages (clientReference idempotent)
- POST /api/v1/sms/messages/cancel
- HMAC: x-api-key · x-timestamp · x-signature (5 min past / 30 s future)
Secrets write-only, shown once. 5 failures / 30 min triggers block.
Android gateways
- GET /api/device/messages/pending (claim one)
- POST /api/device/messages/:id/status (sent|failed|expired)
Pull model · 3-min backoff ×3 · 1 msg/min/device · 15-min lease sweeper.
DMARC analytics
- IMAP aggregate inbox → parse → validate
- DNS status · blacklists · provider breakdown
- PDF report generation + 60-day retention
Source files: docs/email-api.md, docs/sms-api.md, docs/device-api.md.