sending.ac support
Mailbox API
Overview
A drop-in Microsoft Graph proxy for mailboxes you provisioned through sending.ac.
sending.ac Mailbox API v1alpha1
Section titled “sending.ac Mailbox API v1alpha1”The Mailbox API lets you send and read mail from mailboxes you own on sending.ac, using an unmodified Microsoft Graph SDK.
Point your Graph client at this base URL and authenticate with a sending.ac API key. We handle the rest.
Stability
v1alpha1 is explicitly unstable. Endpoints, payloads and error codes may change without notice and without a version bump. Do not build anything you cannot redeploy.
Authentication
Send your key as a bearer token:
Authorization: Bearer sk_live_xxxxxxxxxxxxThe key must be scope mailbox and environment live. Both are enforced:
- a Provisioning key returns
403/ErrorAccessDenied - a sandbox key returns
403/ErrorAccessDenied
Sandbox keys are refused by design rather than downgraded to a mock. Every call here touches a real Microsoft 365 mailbox and sendMail delivers real mail to real recipients, so there is nothing sandbox-like to offer. Mint a Mailbox key under Production Credentials in the customer portal.
Using a Microsoft Graph SDK
The /azure surface mirrors Graph’s own URL layout, so an official SDK works unchanged — but two settings are mandatory:
import { Client } from '@microsoft/microsoft-graph-client';
const client = Client.init({
baseUrl: 'https://api.customers.ac/api/mailbox/v1alpha1/azure',
defaultVersion: 'v1.0',
authProvider: (done) => done(null, 'sk_live_xxxxxxxxxxxx'),
// Required: the SDK only attaches the Authorization header to hosts it trusts.
// Without this your requests arrive unauthenticated and fail with 401.
customHosts: new Set(['api.customers.ac']),
});
await client.api('/users/sender@yourdomain.com/sendMail').post({ message, saveToSentItems: true });The SDK also refuses to authenticate over plain http://, so there is no way to point it at a non-TLS host for testing.
Paging
@odata.nextLink in responses is rewritten to point back at this API, so PageIterator and equivalent helpers follow pages through the proxy with the same API key. You never receive a raw graph.microsoft.com link.
Error format
Errors on /azure and /google use Microsoft’s OData error shape, not a sending.ac envelope, so Graph SDKs deserialise them as ordinary GraphErrors:
{
"error": {
"code": "InvalidAuthenticationToken",
"message": "The API key is invalid or has been revoked.",
"innerError": { "request-id": "…", "date": "…" }
}
}innerError.request-id is the correlation id for the request. Quote it in support requests.
Rate limits
60 requests per minute per API key on the Graph surface. Exceeding it returns 429 with Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset.
Retries
sendMail is never retried automatically on a transport error, because the failure is ambiguous — Microsoft may already have accepted and delivered the message. Retry it yourself only if a duplicate send is acceptable. Read-only calls are safe to retry.
Authentication
Section titled “Authentication”BearerAuth
Section titled “BearerAuth”A sending.ac API key with scope mailbox and environment live. Issue one under Production Credentials in the customer portal. Provisioning keys and sandbox keys are rejected with 403.
Security scheme type: http