Use the K2Mailer REST API

Create an API key

1. 1

   Open Settings → API and enable API access for the tenant.

2. 2

   Select Create API Key, give the integration a clear name, and grant only the scopes it needs.

3. 3

   Choose an expiry period or Never, then create the key.

4. 4

   Copy the full secret from the one-time confirmation. K2Mailer does not display newly created secrets again.

5. 5

   Send the secret in the Authorization header as Bearer YOUR_API_KEY.

6. 6

   Use the complete endpoint reference at k2mailer.com/help/api for required scopes, request fields, examples, responses, and rate limits.

Manage keys safely

• Create a separate key for each integration such as Production, Zapier, reporting, or an internal service.
• Use least-privilege scopes. Read endpoints and write endpoints require separate scopes.
• Review Last used and the last-used IP to identify stale or unexpected integrations.
• Revoke a compromised or retired key individually. Revoking one key does not affect other active keys.
• Expired and revoked keys return 401. A valid key without the required endpoint scope returns 403.
• Disabling API access at the tenant level immediately blocks every API key for that tenant.

Available scopes and resources

• account.read reads basic tenant account information.
• clients.write creates client workspaces through approved provisioning workflows.
• groups.read and groups.write control group access.
• lists.read and lists.write control contact-list access.
• custom_fields.read and custom_fields.write control contact custom fields.
• contacts.read and contacts.write control contact access.
• campaigns.read and campaigns.write control saved broadcast content. These endpoints do not send or schedule a campaign.

Responses, rate limits, and pagination

• Most resource responses use a status and response JSON envelope. GET /user returns the user object directly.
• Some business-rule failures can use HTTP 200 with status set to Error, so inspect both the HTTP code and JSON status.
• Invalid, expired, or revoked keys use HTTP 401. Missing scope or disabled tenant API access uses HTTP 403. Validation uses 422 and rate limiting uses 429.
• K2Mailer REST routes are limited to 60 requests per minute by the application API middleware.
• Collection endpoints use start_from as a zero-based offset and return up to 500 records. They do not accept a limit parameter.

Legacy API keys