Mailgun API defined by OpenAPI Specification (OAS) 3.1.0
Mailgun API (3.0.0)
https://api.mailgun.net/
https://api.eu.mailgun.net/
Domain Tracking
Mailgun offers tracking for clicks, unsubscribes, and opens, with optional HTTPS protocol support on tracking URLs. To enable HTTPS, Mailgun uses Let’s Encrypt with HTTP-01 challenges through your existing tracking CNAME record to issue a TLS certificate. This setup also includes support for HTTP Strict Transport Security (HSTS) for enhanced security.
Account Webhooks
Webhooks API to manage account-specific webhooks. You can create, retrieve, update, and delete webhooks programmatically. Account-level webhooks are configured independently for US and EU regions. When triggered, webhook URLs are deduplicated by event type, across account and domain levels to prevent redundant webhook sends.
Stats
Mailgun collects many different events and generates event statistics which are available in your Control Panel. This data is also available via our stats API endpoint.
WARNING: This API is deprecated in favor of our Metrics API.
Events
Mailgun keeps track of every inbound and outbound message event and stores this data for at least 3 days.
WARNING: This API is deprecated in favor of our Logs API.
Send Alerts
Mailgun allows you to get instant notifications on the sending metrics that matter most, configured specifically for your unique business needs and assets. Route these alerts to the channels your team relies on. Stay on top of sending performance without the need to manually monitor.
- US Mailgun
https://api.mailgun.net/v1/alerts/events
- EU Mailgun
https://api.eu.mailgun.net/v1/alerts/events
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
-u <username>:<password> \
https://api.mailgun.net/v1/alerts/events{ "events": [ "ip_listed", "ip_delisted" ] }
Request
Use this endpoint to add new alert settings record. This service facilitates notifications (Webhook, Slack, or Email) for both Mailgun Optimize and Send Alert threshold breaches.
This section covers details around consuming alerts via webhooks. If you are familiar with Mailgun Send webhooks (which provide status updates on individual email deliveries), there is a lot of overlapping similarity, however, there are also a few minor nuances to account for.
HMAC is used to verify the integrity as well as the authenticity of received webhooks. To verify the origin of a webhook:
- Encode the webhook’s entire POST request body with the HMAC algorithm (using your webhook signing key and SHA256 digest mode)
- Compare the resulting hexdigest to the signature provided in the POST request’s X-Sign header.
NOTE: If you’re consuming Mailgun Send webhooks, please note that your Mailgun Send webhook signing key differs from your Alerts webhook signing key. Your Alerts webhook signing keys, used for both Optimize and Send Alert products, are available within the Mailgun Alerts UI.
When adding or updating a webhook URL for alerts, we will ensure the endpoint is reachable by sending a GET request to the provided URL. If a 200 response is not returned from your endpoint, the request will be rejected and your alert setting will not be saved. We intentionally chose to send a GET request instead of a POST when validating URLs so that your webhook endpoint does not have to account for test requests.
Additionally, when a POST request is sent to your webhook URL, if a 2xx is not returned, we will attempt retries via an exponential backoff strategy for up to ~8 hours. If the max retry count is reached, the alert will be disabled and the related alert settings record’s disabled_at field will be populated.
The delivery method for the alert.
| Enum Value | Description |
|---|---|
| webhook | webhook |
| slack | Slack |
The details pertaining to the specified channel. Please note that the contents of this object differ per channel type.
- US Mailgun
https://api.mailgun.net/v1/alerts/settings/events
- EU Mailgun
https://api.eu.mailgun.net/v1/alerts/settings/events
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X POST \
-u <username>:<password> \
https://api.mailgun.net/v1/alerts/settings/events \
-H 'Content-Type: application/json' \
-d '{
"event_type": "ip_listed",
"channel": "webhook",
"settings": {
"url": "https://yourwebhookurl.com"
}
}'{ "id": "00000000-0000-0000-0000-000000000000", "event_type": "ip_listed", "channel": "webhook", "settings": { "url": "https://yourwebhookurl.com" } }
Request
Use this endpoint to update an existing alert setting record.
NOTE: When updating a webhook alert, we will ensure the endpoint is reachable by sending a GET request to the provided URL. If a 200 response is not returned, a 400 will be returned and the alert setting update will be rejected.
The delivery method for the alert.
| Enum Value | Description |
|---|---|
| webhook | webhook |
| slack | Slack |
The details pertaining to the specified channel. Please note that the contents of this object differ per channel type.
- US Mailgun
https://api.mailgun.net/v1/alerts/settings/events/{id}
- EU Mailgun
https://api.eu.mailgun.net/v1/alerts/settings/events/{id}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X PUT \
-u <username>:<password> \
'https://api.mailgun.net/v1/alerts/settings/events/{id}' \
-H 'Content-Type: application/json' \
-d '{
"event_type": "ip_delisted",
"channel": "email",
"settings": {
"emails": [
"recipient-a@example.com",
"recipient-b@example.com"
]
}
}'{ "message": "settings updated" }
Bounces
Bounces - Bounce list stores events of delivery failures due to permanent recipient mailbox errors such as non-existent mailbox. Soft bounces (for example, mailbox is full) and other failures (for example, ESP rejects an email because it thinks it is spam) are not added to the list.
Allowlist
The allowlist API provides the ability to allowlist specific addresses from being added to bounce list. You can allowlist by domain name (i.e example.com) or by specific address (i.e. alice@example.com). Mailgun doesn’t add an address to bounce list if the address is allowlisted. This API is very useful if you test against your private services and don’t want to constantly clean up bounce lists