Email API Guide 2026: Transactional, Mailbox and Cold Email

An email API lets your code send, receive or manage email over HTTP instead of talking SMTP or IMAP directly. The term covers three different products. Transactional email APIs such as Amazon SES, Mailgun, Postmark, Resend and SendGrid send your application's own messages, receipts, password resets and notifications, to people who expect them. Mailbox APIs such as the Gmail API, Microsoft Graph, Nylas, Unipile and EmailEngine connect your users' own inboxes so your product can read and send from them. Cold email APIs run outreach campaigns from pools of mailboxes, with sequences, caps and reply detection.

The families differ in their rules as much as in their features. At 100,000 emails a month, the five transactional APIs below cost between $10 and $115, and all five forbid cold outreach in their policies. Amazon puts an SES account under review once one email in a thousand draws a complaint. We read every price, limit and policy on the providers' own pages on 8 October 2026.

What are the three kinds of email API?

The useful question is whose mailbox the email comes from and who receives it:

All three return JSON and push events, such as a delivery, a bounce or a reply, to your application through webhooks. What changes is the infrastructure behind the call and the rules attached to it.

How much does a transactional email API cost?

Prices start in single digits and spread out fast as features come in. For 100,000 emails a month on monthly billing, the cheapest plan that covers the volume, read with each page's own volume slider:

The spread pays for different things: support, analytics, dedicated IP addresses, separate streams for different kinds of mail. One line on the SES page changes its row for anyone signing up now. Amazon SES now sells Essentials, Pro and Enterprise plans alongside its classic à la carte rate, as its pricing page shows, and new accounts start on Essentials from 21 July 2026 unless they switch. That moves the default price of 100,000 emails from $10 to $16. Pro and Enterprise add monthly fees of $105 and $500 per account per region on top of their per-email rates.

The API call itself is the easy part. This is Postmark's documented example for sending one email, with the HTML body removed:

curl "https://api.postmarkapp.com/email" \
  -X POST \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "X-Postmark-Server-Token: server token" \
  -d '{
  "From": "sender@example.com",
  "To": "receiver@example.com",
  "Subject": "Password Reset",
  "TextBody": "Click here to reset your password.",
  "MessageStream": "outbound"
}'

The MessageStream field is the part that matters. Postmark separates transactional streams, for one-to-one mail triggered by a user action, from broadcast streams for one-to-many sends. A send that names no stream goes to the default transactional stream, "outbound", and Postmark only accepts bulk mail through a broadcast stream, where every message must carry an unsubscribe link and Postmark adds one if you leave it out.

What breaks when you run a transactional email API?

Mostly the account, not the code. New Amazon SES accounts start in a sandbox, separately in each AWS region, where they can send only to verified addresses, at most 200 messages in 24 hours and one message a second, until AWS grants production access. After that, the numbers that decide whether the account keeps sending are its bounce and complaint rates. AWS's enforcement FAQ puts an account under review at a 5 percent bounce rate and may pause it at 10 percent, and does the same at 0.1 percent and 0.5 percent for complaints. A 0.1 percent complaint rate is one complaint per 1,000 emails.

Bounces come back as notifications your code must act on. A trimmed version of the bounce example in AWS's documentation:

{
   "notificationType":"Bounce",
   "bounce":{
      "bounceType":"Permanent",
      "bouncedRecipients":[
         {
            "emailAddress":"jane@example.com",
            "status":"5.1.1",
            "action":"failed",
            "diagnosticCode":"smtp; 550 5.1.1 <jane@example.com>... User"
         }
      ],
      "bounceSubType":"General",
      "timestamp":"2016-01-27T14:59:38.237Z"
   },
   "mail":{
      "source":"john@example.com",
      "messageId":"00000138111222aa-33322211-cccc-cccc-cccc-ddddaaaa0680-000000"
   }
}

For a Permanent bounce of the General type, AWS says to remove the address from your list immediately. SES also keeps an account-level suppression list, on by default for accounts created since November 2019, with three details that surprise people. Of the bounces, only hard bounces are added automatically, soft bounces never are. A message to a suppressed address is accepted by the API and then not sent, yet still counts toward your daily quota. And Gmail does not send complaint data to SES, so complaints from Gmail users never reach that list. Your own suppression list, fed by every bounce and complaint webhook, is still your job.

Can you send cold email through a transactional email API?

No, and the providers say so in writing. Resend's acceptable use policy prohibits "sending unsolicited messages of any kind, including cold outreach, purchased lists, or scraped contact data". Mailgun's acceptable use policy states that contact lists "bought, rented or scraped from third-parties" are prohibited on its servers and requires explicit, provable consent. Postmark's terms of service require every list to be a permission-based subscription and prohibit lists purchased or rented from a third party. SendGrid falls under Twilio's email policy, which requires affirmative consent before any non-transactional email and prohibits purchased or rented lists. Amazon's acceptable use policy prohibits sending unsolicited mass email, and its service terms let it scan SES mail to block spam and unsolicited email and suspend accounts whose mail is abusive.

The thresholds above explain why. Transactional providers send most customers' mail from shared IP pools by default, and their deliverability depends on every customer sending wanted mail. A cold campaign that draws one complaint per 1,000 emails already sits at the level where AWS opens a review, and one sender's complaints hurt delivery for everyone on the same addresses. Cold outreach needs its own infrastructure: separate domains, mailboxes that send like a person, low volume per mailbox and fast stop rules.

What does a mailbox API cost, and what limits does it inherit?

A mailbox API connects to an inbox that already exists, at Google, Microsoft or any IMAP host, and lets your product read, search, sync and send as that user. Messages go out from the user's own account, so they land like any email that person writes, and they count against that account's limits.

Nylas Pro becomes cheaper than Essentials from 27 accounts, and EmailEngine's flat license beats Nylas from about 61 mailboxes and Unipile from 22, before hosting. Going direct to the Gmail API and Microsoft Graph costs nothing in fees but means two integrations, two OAuth applications and two sets of limits:

• Google. Reading Gmail needs restricted scopes (gmail.readonly, gmail.modify or the full mail.google.com scope), and a public app that stores or transmits that data on its servers must pass Google's verification and a security assessment, renewed every 12 months. An app that only sends can use gmail.send, which Google classes as sensitive, not restricted.
• Microsoft. Mail sent through Graph is subject to Exchange Online's limits: 10,000 recipients a day per mailbox, 30 messages a minute and a per-message recipient limit that admins can raise to 1,000. Graph itself allows each app 10,000 requests per mailbox in 10 minutes, with 4 concurrent requests. A sendMail call returns 202 Accepted, which Microsoft says does not mean processing has completed. Our guide to Outlook sending limits covers these limits and the tenant-wide cap on external recipients.

Our guides cover each option in depth: Gmail sending limits for the Gmail quotas and errors, Nylas pricing, Unipile pricing, the EmailEngine review for the self-hosted route, and Nylas alternatives for the managed options side by side.

A mailbox API is not a cold email tool on its own. It sends what you tell it to, from one mailbox at a time, within that mailbox's limits. The campaign logic, the rotation across mailboxes and the deliverability work are yours to build.

What is a cold email API?

It is the API for the job the other two families refuse or leave to you: sending outreach to people who have not opted in, from pools of dedicated mailboxes, with the safeguards that keep those mailboxes deliverable.

The first kind is an outreach platform with an API on top. Instantly, Smartlead and lemlist are products built for people, and what their APIs include depends on the plan. Instantly's pricing page starts at $47 a month on Growth, and its help center says API access comes with every outreach plan, while webhooks start on Hypergrowth at $97. Smartlead's pricing page includes the API and webhooks from Pro at $94 a month, and its $39 Base plan has neither. Our guides to cold email software and Instantly alternatives compare those platforms, and our outreach API comparison covers what each API exposes.

The second kind is outreach infrastructure built to sit under your own product or agent. The Swarmhit cold email API runs campaigns on a pool of mailboxes and keeps one mailbox per lead for the whole thread, with per-mailbox daily caps and today's usage readable in the API, sending windows, bounce and complaint suppression, and email steps that can run in the same sequence as LinkedIn steps. You connect your own Google, Microsoft or IMAP mailboxes, or buy a domain and Google Workspace or Microsoft 365 mailboxes that arrive connected and already warming. Cold email on Swarmhit is in beta, opened workspace by workspace, from $59 a month for 50,000 sends with unlimited mailboxes, and its pricing may change during the beta.

How do you choose an email API?

By the message you are sending:

FAQ

What is an email API?

An email API is an HTTP interface that lets an application send, receive or manage email without speaking SMTP or IMAP directly. You send a request such as "send this message" and receive JSON and webhook events in return. There are three main kinds: transactional APIs for mail your users expect, mailbox APIs that work inside users' own inboxes, and cold email APIs that run outreach campaigns from pools of mailboxes.

What is the best email API?

It depends on the job. For transactional mail, Amazon SES is the cheapest at volume, $10 to $16 for 100,000 emails a month, while Postmark and Resend are known for developer experience. For working inside users' Gmail or Outlook, the Gmail API and Microsoft Graph are free but separate, and Nylas, Unipile, Aurinko or EmailEngine unify them. For cold outreach, you need a cold email API with mailbox pools and caps, not a transactional sender.

Can I send cold email with SendGrid or Mailgun?

No. SendGrid falls under Twilio's email policy, which requires affirmative consent before any non-transactional email and prohibits purchased or rented lists. Mailgun prohibits contact lists bought, rented or scraped from third parties, and Resend's policy names cold outreach explicitly. Providers enforce this with reviews and suspensions, because most customers share IP pools. Cold email needs separate domains and dedicated mailboxes, sent through a platform or API built for outreach.

Is there a free email API?

Several have free tiers sized for testing. Resend allows 3,000 emails a month and up to 100 a day, Mailgun 100 a day, Postmark 100 a month, and SendGrid offers a 60-day trial at 100 a day. New AWS customers get up to $200 in Free Tier credits usable on SES, which starts in a sandbox capped at 200 messages a day. The Gmail API and Microsoft Graph cost nothing to call but send under each mailbox's limits.

Does a successful API response mean the email was delivered?

No. Microsoft says a 202 from Graph's sendMail means the request was accepted, not that processing completed. Amazon SES accepts a message to an address on your suppression list and then does not send it, while still counting it toward your quota. Google warns that a 200 from the Gmail API does not prove the email was sent. Delivery is confirmed by the events that come back later: deliveries, bounces and complaints.

What is the difference between SMTP and an email API?

SMTP is the protocol mail servers use to send messages, and an email API is an HTTP layer on top that your code calls instead. APIs are easier to integrate, return structured errors and usually add webhooks for deliveries, bounces and replies. Most transactional providers offer both. Postmark, for example, runs separate SMTP hosts for transactional and broadcast mail, and mailbox APIs often use SMTP and IMAP underneath on your behalf.