Everything an AI agent can do with the SendGrid API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints25
API versionv3
Last updated23 June 2026
Orientation

How the SendGrid API works.

The SendGrid API is how an app or AI agent works with a SendGrid account: sending an email to a recipient, adding or searching marketing contacts, organizing them into lists and segments, managing transactional templates, or reading delivery and engagement statistics. Access is granted through an API key, and the key can be scoped to specific permissions like sending only or marketing only, so a call reaches only the areas the key allows. SendGrid can also push an event to a registered endpoint whenever a message is delivered, opened, clicked, or bounced.

25Endpoints
7Capability groups
9Read
16Write
12Permissions
Authentication
Every v3 request authenticates with an API key sent as a Bearer token in the Authorization header, not with OAuth or a username and password. A key is created in the account and its full value is shown only once. The v2 Mail Send endpoint still exists, but v3 is the supported path for new integrations.
Permissions
An API key can be scoped to specific permissions, like mail.send for sending, marketing.read for the Email Marketing API (contacts, lists, and segments), templates.read or templates.create for templates, suppression.read for unsubscribe groups, and stats.read for statistics, so a key carries only the access an integration needs. A key without a required scope returns a 403, and billing permissions cannot be combined with any others.
Async marketing writes
Several Marketing API writes, like the contacts upsert and bulk import, are processed asynchronously: the call returns a 202 with a job to poll rather than the finished result. An integration confirms the change by searching contacts or checking the import status, not by reading the immediate response.
Events over webhook
Rather than polling for delivery results, an app registers an Event Webhook and SendGrid posts an array of event objects describing what happened to each message, like processed, delivered, open, click, bounce, dropped, and spamreport. Signed Event Webhook lets the receiver verify each request really came from SendGrid.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to SendGrid determines what it can reach. There is a route for making calls and a route for receiving events, and each is governed by the API key behind it and the permissions that key carries.

Ways to connect

REST API

The v3 Web API takes JSON request bodies, returns JSON, and is reached at https://api.sendgrid.com/v3. A call authenticates with an API key sent as a Bearer token in the Authorization header. Marketing endpoints under /v3/marketing process some writes asynchronously, returning a 202 and a job to poll.

Best forConnecting an app or AI agent to SendGrid.
Governed byThe API key and the permission scopes it carries.
Docs ↗

Event Webhook

SendGrid POSTs a JSON array of event objects to an HTTPS endpoint configured in the Mail Settings. Each event reports a delivery or engagement signal for a message, like processed, delivered, open, click, or bounce. Signed Event Webhook adds an ECDSA signature header so the receiver can verify the request came from SendGrid.

Best forReceiving delivery and engagement events at an app or AI agent.
Governed byThe webhook configuration and the verification key on the endpoint.
Docs ↗
Authentication

API key

Every v3 request authenticates with an API key sent as a Bearer token in the Authorization header. A key is created in the account with a chosen permission level, and a leaked key reaches only the scopes it was granted. The full key value is shown only once, when it is created.

TokenBearer API key (SG..)
Best forAll server-side calls to the v3 API.
Docs ↗

Scoped API key permissions

An API key can be limited to specific scopes, like mail.send for sending only, marketing.read for the Email Marketing API, or stats.read for statistics, so a key carries only the access an integration needs. Billing permissions are mutually exclusive from all others. A key with too few scopes for a request returns a 403.

TokenBearer API key scoped to chosen permissions
Best forLeast-privilege access limited to specific API areas.
Docs ↗
Endpoint reference

Every SendGrid API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Mail Send

Methods for sending email, both transactional and one-off.1

The from address must be a verified sender. Each request may include up to 1,000 recipients.

Acts onmail
Permission (capability)mail.send
VersionAvailable since the API’s base version
Webhook eventprocessed
Rate limitUp to 10,000 requests per second

Contacts

Methods for adding, finding, and removing marketing contacts.6

Asynchronous: returns 202 with a job id; use the search endpoint to confirm the change landed. The marketing.read scope grants read and write on the Email Marketing API.

Acts oncontact
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts oncontact
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts oncontact
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A POST used to read, not to change data.

Acts oncontact
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Irreversible; a delete_all_contacts flag removes every contact in the account.

Acts oncontact
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Returns an upload URL and an import job id; the import runs asynchronously.

Acts oncontact_import
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Lists

Methods for working with static lists of contacts.4

Adding contacts to the list is done through the Contacts API.

Acts onlist
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts onlist
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A core write.

Acts onlist
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A delete_contacts flag can also delete the contacts that belonged only to this list.

Acts onlist
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Segments

Methods for working with dynamic audience segments.3

A segment updates automatically as contacts match or stop matching its conditions.

Acts onsegment
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts onsegment
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Deletes the segment definition, not the contacts it matched.

Acts onsegment
Permission (capability)marketing.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Templates

Methods for working with transactional templates and their versions.6

A core write.

Acts ontemplate
Permission (capability)templates.create
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts ontemplate
Permission (capability)templates.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts ontemplate
Permission (capability)templates.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Each template can hold multiple versions, with one active.

Acts ontemplate_version
Permission (capability)templates.versions.create
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Full scope is templates.versions.activate.create. Changes which version live mail using the template renders.

Acts ontemplate_version
Permission (capability)templates.versions.activate
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Irreversible; sends that reference this template id will fail.

Acts ontemplate
Permission (capability)templates.delete
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Unsubscribe Groups

Methods for working with suppression (unsubscribe) groups.4

A core write.

Acts onunsubscribe_group
Permission (capability)suppression.create
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts onunsubscribe_group
Permission (capability)suppression.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A core write.

Acts onunsubscribe_group
Permission (capability)suppression.update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Removes the group recipients could opt out of.

Acts onunsubscribe_group
Permission (capability)suppression.delete
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Stats

Methods for reading email delivery and engagement statistics.1

Read-only; aggregated by day, week, or month.

Acts onstat
Permission (capability)stats.read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

SendGrid can notify an app when something happens to a message it sent, like the message being delivered, opened, clicked, or bounced. It posts an array of event objects to a registered HTTPS endpoint, so an integration learns about delivery and engagement without polling.

EventWhat it signalsTriggered by
processedSendGrid accepted the message and can deliver it./v3/mail/send
deliveredSendGrid succeeded in delivering the message to the receiving server./v3/mail/send
openA recipient opened the HTML message; requires Open Tracking to be on./v3/mail/send
clickA recipient clicked a link in the message; requires Click Tracking to be on./v3/mail/send
bounceThe receiving server permanently rejected the message for this recipient./v3/mail/send
droppedSendGrid dropped the message before sending, for example a suppressed or previously bounced address./v3/mail/send
deferredThe receiving server temporarily rejected the message, and SendGrid will retry./v3/mail/send
spamreportA recipient marked the message as spam./v3/mail/send
unsubscribeA recipient clicked the Opt Out of All Emails link./v3/mail/send
group_unsubscribeA recipient unsubscribed from a specific suppression group./v3/mail/send
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

SendGrid limits how fast an app can call, both at the account level and per endpoint, and returns the remaining quota on each response so an integration can pace itself.

Request rate

SendGrid limits how fast an app can call, both across the account and per endpoint, and most v3 responses carry X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers so an integration can pace itself before it is throttled. The v3 Mail Send endpoint allows up to 10,000 requests per second. The Marketing contacts upsert endpoint queues work asynchronously and processes in batches rather than per request. Going over a limit returns HTTP 429.

Pagination

List endpoints page differently by area. The Marketing API (contacts, lists, segments) uses a page_size parameter with a page_token cursor returned in the response for the next page. Other v3 list endpoints use limit and offset query parameters. A response includes the metadata needed to request the next page.

Request size

A single Mail Send request may address up to 1,000 recipients. Contacts are added or updated in batches, and bulk imports run asynchronously from an uploaded CSV. Email statistics are aggregated and category statistics are retained for the previous thirteen months.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400Bad requestThe request was malformed or a parameter was invalid, with the reasons listed in the response errors array.Read the errors array, fix the request body or parameters, and resend. The request is not retryable as-is.
401Requires authenticationNo valid API key was provided, or the key is missing from the Authorization header.Send a valid API key as a Bearer token, and rotate the key if it may be compromised.
403ForbiddenThe key lacks a scope the request needs, or the from address does not match a verified sender, or sending is temporarily blocked.Grant the needed scope on the key, verify the sender identity, or wait out the temporary block.
406Missing Accept headerThe request did not send an Accept: application/json header.Add the Accept: application/json header and resend.
429Too many requestsA rate limit was exceeded. Responses carry X-RateLimit headers showing the limit, what remains, and when it resets.Back off and retry after the reset shown in the rate-limit headers, and smooth the request rate.
500Internal server errorAn error on SendGrid's side. It is rare.Retry with backoff, and contact SendGrid support if it persists.
Versioning & freshness

Version history.

SendGrid serves a single, continuously updated v3 API rather than dated versions, and ships changes through the Twilio changelog. The older v2 Mail Send endpoint still exists but v3 is the supported path for new integrations.

Version history

What changed, and when

Latest versionv3
v3Current version
Current v3 Web API

SendGrid serves a single, continuously updated v3 Web API rather than dated versions. Changes ship through the Twilio changelog as additions and occasional deprecations. The v3 Mail Send endpoint and the Marketing API (contacts, lists, segments) are the supported surfaces for new integrations.

What changed
  • v3 Mail Send, Marketing contacts, lists, segments, templates, suppressions, and stats are the current supported surfaces.
  • Event Webhook delivers processed, delivered, open, click, bounce, and related events; Signed Event Webhook verifies authenticity.
2025-06-02Requires migration
v2 Mail Send recipient limit aligned to v3

The legacy v2 Mail Send endpoint was changed to allow up to 1,000 recipients per request, down from 10,000, aligning its behavior with the v3 Mail Send endpoint. The change took effect on 9 July 2025.

What changed
  • v2 Mail Send capped at 1,000 recipients per request (effective 9 July 2025).
  • Aligns the v2 endpoint with the v3 Mail Send endpoint; v3 is the recommended path.
2025-05-28Feature update
Free plans retired

Twilio SendGrid began retiring its free Email API and free Marketing Campaigns plans, requiring an upgrade to a paid plan to keep sending email and using key tools.

What changed
  • Free Email API and free Marketing Campaigns plans retired starting 28 May 2025.
  • Existing free accounts kept access for 60 days before an upgrade was required.
Earlier
New Marketing Campaigns API

SendGrid introduced the current Marketing Campaigns API (the /v3/marketing endpoints for contacts, lists, and segments) and began deprecating the legacy Marketing Campaigns and contactdb endpoints.

What changed
  • Current /v3/marketing endpoints for contacts, lists, and segments introduced.
  • Legacy Marketing Campaigns and contactdb endpoints deprecated.

There is one current v3 API; track the changelog for additive changes and deprecations.

SendGrid changelog ↗
Questions

SendGrid API, answered.

How does authentication work for the SendGrid v3 API?+
Every request sends an API key as a Bearer token in the Authorization header, like Authorization: Bearer SG.xxxx. The key is created in the account with a chosen permission level and its full value is shown only once, so it must be stored at creation. SendGrid does not use a username and password for the v3 API.
What permission scopes can an API key have?+
A key can be limited to specific scopes so it carries only the access it needs. Common ones are mail.send for sending mail, marketing.read for the Email Marketing API covering contacts, lists, and segments, templates.read and templates.create for transactional templates, suppression.read for unsubscribe groups, and stats.read for statistics. A request that needs a scope the key lacks returns a 403, and billing permissions cannot be combined with any other scopes.
Why does adding a contact return a 202 instead of the contact?+
Adding or updating contacts is asynchronous. The upsert call queues the work and returns a 202 with a job id rather than the finished contact, so the response confirms the request was accepted, not that the data has changed yet. To confirm the change landed, search the contacts or poll the import status.
How do I receive delivery and engagement events?+
Register an Event Webhook in the Mail Settings with an HTTPS URL. SendGrid then posts a JSON array of event objects to that URL as messages move through the system, covering processed, delivered, open, click, bounce, deferred, dropped, spamreport, unsubscribe, group_unsubscribe, and group_resubscribe. Open and click events require Open Tracking and Click Tracking to be enabled.
How can I verify that a webhook request really came from SendGrid?+
Turn on Signed Event Webhook. SendGrid then signs each request with an ECDSA key and sends the signature and a timestamp in request headers. The receiver verifies the signature against SendGrid's public verification key over the raw request body, and rejects any request that does not match, which prevents spoofed events.
How many recipients can one Mail Send request include?+
A single call to the v3 Mail Send endpoint may address up to 1,000 recipients across its personalizations. The endpoint itself accepts up to 10,000 requests per second. For larger audiences, send multiple requests or use the Marketing API with a list or segment.
Related

More marketing API guides for agents

What is Bollard AI?

Control what every AI agent can do in SendGrid.

Bollard AI sits between a team's AI agents and SendGrid. Grant each agent exactly the access it needs, read or write, area by area, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared SendGrid key.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
SendGrid
Email Agent
Send email ActionOffReadFull use
Read contacts ResourceOffReadFull use
Delete contacts ActionOffReadFull use
Unsubscribe groups ResourceOffReadFull use
Per-agent access, set in Bollard AI, not in SendGrid