Sandbox

Every Sandbox endpoint.

GET/v1/sandbox/messages

List captured test sends

Nothing listed here was ever delivered: each row is what a TEST-mode send captured on the sandbox mail server. Reached with a test-mode API key (`zst_<prefix>_<secret>`) or from a dashboard session.

Auth: apiKey or jwt

Parameters

Name	In	Required	Description
page	query	optional
limit	query	optional

Responses

200 : Default Response

Field	Type	Required
data	array	required
data[].created_at	string	required · nullable
data[].from	string	required
data[].id	string	required
data[].message_id	string	required
data[].subject	string	required · nullable
data[].tag	string	required · nullable
data[].to	array	required
data[].to[]	string	optional
pagination.limit	number	required
pagination.page	number	required
pagination.pages	number	required
pagination.total	number	required

curl

curl https://api.zsender.io/v1/sandbox/messages \
  -H "Authorization: Bearer $ZSENDER_API_KEY"

GET/v1/sandbox/messages/{id}

Get one captured test message

Reached with a test-mode API key (`zst_<prefix>_<secret>`) or from a dashboard session. `inspect` is live-fetched from the sandbox mail server (rendered/text/raw/headers/inspection views; `null` if the mail server is still holding the message). `recipient` selects which of a captured message's per-recipient messages to inspect; omitted means the first. `audit` is the link/alt-text audit computed at send time over what was actually submitted, `null` for a row sent before that column existed.

Auth: apiKey or jwt

Parameters

Name	In	Required	Description
recipient	query	optional
id	path	required

Responses

200 : Default Response

Field	Type	Required
audit	object	required · nullable
audit.findings	array	required
audit.findings[].detail	string	required
audit.findings[].kind	string	required
audit.findings_truncated	boolean	required
audit.links	array	required
audit.links[].text	string	required
audit.links[].url	string	required
audit.links_truncated	boolean	required
audit.truncated	boolean	required
created_at	string	required · nullable
from	string	required
id	string	required
inspect	object	required · nullable
inspect.headers	object	required
inspect.inspection	object	required
inspect.raw_message	string	required · nullable
inspect.recipient	string	required
inspect.spam_checks	object	required
inspect.spam_status	string	required · nullable
message_id	string	required
subject	string	required · nullable
tag	string	required · nullable
to	array	required
to[]	string	optional

curl

curl https://api.zsender.io/v1/sandbox/messages/{id} \
  -H "Authorization: Bearer $ZSENDER_API_KEY"

POST/v1/sandbox/messages/{id}/simulate

Fire a synthetic webhook event for a captured message

Reached with a test-mode API key (`zst_<prefix>_<secret>`) or from a dashboard session. A real, signed POST to a stored endpoint or an ad-hoc URL. Its own rate bucket of 20/min per tenant, separate from and much tighter than the normal send rate limit, answers 429 once exhausted. Body: `event` (string, required, one of the public webhook event names, e.g. `email.delivered`) and exactly one of `endpoint_id` (a stored webhook endpoint's id, signed with that endpoint's real `whsec_` secret) or `url` (an ad-hoc target, signed with an ephemeral secret). One of the two is required.

Auth: apiKey or jwt

Parameters

Name	In	Required	Description
id	path	required

Responses

200 : Default Response

Field	Type	Required
error	string	required · nullable
ok	boolean	required
response_body	string	required · nullable
signed_with_real_secret	boolean	required · nullable
status_code	number	required · nullable

curl

curl https://api.zsender.io/v1/sandbox/messages/{id}/simulate \
  -X POST \
  -H "Authorization: Bearer $ZSENDER_API_KEY"