API and permissions

The SendBop HTTP API offers every operation the workspace uses. The OpenAPI description at /api/openapi.json lists them all.

Authenticate

Send the token as a bearer token: Authorization: Bearer <token>. Agent tokens come from Agents; personal tokens for your own scripts come from Settings.

Start with discovery

/api/v1/msps/<organization-id>/discovery returns what this token may do: its permissions, limits and the released operations. /api/v1/capabilities lists released capabilities for everyone.

Permissions

A token can do exactly what its owner granted, on the domains or clients granted. Preparing, approving and applying a change are separate permissions. An agent approves a change only under a standing policy that a person created for that client and kind of change; a change that raises DMARC enforcement always needs a person. Read the daily limits at /api/v1/msps/{id}/limits.

Safe writes

Writes accept an Idempotency-Key header, so a retry never repeats a change. Lists return one page with completeness headers. Errors carry a category, a retry hint and a next step.