Connect REST API & webhooks to MailNesto
Everything in the app is available over a REST API, with signed webhooks for every event.
REST API & webhooks and MailNesto, together
Everything you do day to day in MailNesto can also be done from your own code. The REST API speaks plain JSON over HTTPS with a Bearer key, so any language works, and the API reference inside the app includes examples for curl, JavaScript, Python and PHP.
Outbound webhooks do the opposite job: they tell your server when something happens, such as a new contact, a click, a bounce or an order. Each delivery is signed, retried with growing gaps if your server is down, and logged so you can see exactly what was sent and resend it.
What moves between REST API & webhooks and MailNesto
List, create, update and delete contacts; bulk add or remove tags and lists, unsubscribe, suppress; CSV import; list lists, segments, custom fields; add suppressions.
Create a draft campaign, edit content and audience, send or schedule it, read its report; list automations and enrol contacts in one.
Send one message or a batch of up to 100 with a saved template or your own HTML, attachments, tags, metadata, scheduling and idempotency keys; search the message log.
Post orders and carts for revenue tracking and cart recovery, and keep your product catalogue current for product blocks.
Contact created, updated, subscribed, unsubscribed, tag added or removed, left a list, form submitted; email opened, clicked, bounced, complained; campaign sent; order received; transactional sent or failed.
Connect REST API & webhooks in a few minutes
- 1
Create an API key
Open Developers → API keys and create a key. Choose full access or read-only, and optionally restrict it to your server’s IP addresses. The key (nsk_…) is shown once, so store it safely.
- 2
Make your first call
Send requests to the base URL shown in Developers with the header Authorization: Bearer nsk_…. For example, POST /contacts with {"email":"priya@example.com","firstName":"Priya","tags":["api"]}.
- 3
Add a webhook endpoint
Under Developers → Webhooks add your endpoint’s URL, pick the events and copy the signing secret. Use “Send test event” to see a sample delivery and your server’s response.
- 4
Verify signatures
Each delivery carries a signature header with a timestamp and an HMAC-SHA256 of the timestamp and body. Recompute it with your secret before trusting the payload; rotate the secret any time.
- 5
Watch the delivery log
Every attempt is logged with the response status and time. Failed deliveries are retried up to five times, and you can retry any delivery by hand.
What you can do with it
A fintech app in Bengaluru can create a contact with plan and KYC-status fields when a user signs up, then enrol them in an onboarding automation through the API.
Use POST /transactional/send for order receipts with a saved template and the order details as data, and follow each message in the log.
Listen for “Contact unsubscribed” and “Email bounced” webhooks and update your users table, so your app never emails someone who opted out.
When an editor publishes a big story, create a campaign draft through the API with the article as content, ready for a person to check and send.
Questions about the REST API & webhooks integration
Is there an SDK?
The API is plain JSON over HTTPS, so any HTTP client works. The API reference in the app has copy-ready examples.
What are the rate limits?
Up to 600 requests a minute per IP address, and your plan can set a lower allowance. A 429 response means wait briefly and retry.
Can a key be limited?
Yes. Keys can be read-only and restricted to IP addresses. Each key acts on one workspace only, and you can revoke it at any time.
Can I get webhooks for a single campaign?
Yes. Besides account-wide webhooks, a campaign’s settings can post its own opens, clicks, unsubscribes and bounces to a URL, signed the same way.
How long are failed deliveries retried?
After the first try, up to five retries at roughly 30 seconds, 1, 2, 4 and 8 minutes. After that the delivery is marked failed and stays in the log for a manual retry.