Lists, subscribers, bulk import, campaigns, automations, sending servers and file upload — over HTTP, at /api/v1, with a bearer token. Plus webhooks out, webhooks in, and an SMTP relay for the apps that only speak mail.
The API is authenticated with a per-user API token. Straight bearer auth. We'll be direct about what that means: there are no OAuth scopes and no granular permissions — the token has your access, all of it. Treat it like a password, keep it server-side, and don't paste it into a browser bundle.
API access is gated by an entitlement, included from the Starter tier upward. Writes are rate-limited. There is an in-app API docs page with the full surface, and it is the same document our own support team reads.
# add a subscriber to a list curl -X POST https://app.cleverlybox.com/api/v1/lists/{list_id}/subscribers \ -H "Authorization: Bearer $CB_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "email": "[email protected]", "first_name": "Ada", "tags": ["trial", "uk"] }'
Illustrative. Exact paths and payloads are in the in-app API docs.
Not a token-generation endpoint and a promise. The resources below are the working surface of the platform — the same things you'd do in the UI, done from your own code.
Create, read, update and delete lists. Add a custom field to a list from the API, so a new field in your product schema doesn't require a human clicking through settings.
Create, read, update, delete. Look up by email address. Add or remove a tag. Subscribe and unsubscribe. Everything your app needs to keep its user table and your list in agreement.
A bulk subscriber import endpoint that runs synchronously for small batches, or queues as an async job for large ones — with import-job status endpoints so you can poll for progress instead of guessing.
Full CRUD, plus pause, run and resume. And downloads: tracking, open, click, bounce, feedback and unsubscribe logs, pulled straight into your own warehouse rather than a manual CSV click.
List your automations, execute one, or hit the API-trigger call to fire a flow from your own backend. Your product event becomes an email sequence without a middleman tool in between.
Sending servers get full CRUD over the API — useful if you provision infrastructure programmatically. File upload is there too, for the assets your campaigns need.
Indicative shape. The in-app API docs page carries the authoritative reference.
Anyone can offer a bulk import endpoint. The question is what happens when you POST 400,000 rows at it. Here, the import queues as a job and you get import-job status endpoints to poll.
Small batch? Run it synchronously and get the result inline. The API doesn't force you into an async workflow for a 12-row upload, and it doesn't pretend a 400,000-row upload will finish inside an HTTP timeout.
"Webhooks" on a feature list can mean almost anything. This is the specific set, with no rounding up.
Not everything you run has an HTTP client and a token in its config. WordPress, n8n, a legacy PHP app, a cron script — they speak SMTP. CleverlyBox issues you SMTP credentials so they can hand mail to us as a relay.
The mail is DKIM-signed with your sending domain and relayed through your sending server. It needs a verified sending domain, and it's included on Business and Agency — 10,000 and 50,000 relay messages a month, with prepaid top-ups beyond that. Full detail on SMTP Relay, and the config blocks are in the setup guide.
User signs up in your app: POST a subscriber. Upgrades: add a tag. Cancels: remove the tag, unsubscribe from the onboarding list. Look up by email means you never have to store our IDs alongside yours.
The API-trigger call starts an automation from your own event. Trial expiring, invoice failed, feature adopted — your code decides, the flow runs, and you didn't need a workflow SaaS sitting in the middle taking a cut.
Campaign log downloads — tracking, open, click, bounce, feedback, unsubscribe — go straight into your own analytics on a schedule, not into a folder of CSVs someone downloaded once in March.
A per-user API token, passed as a bearer token. No OAuth, no scopes, no per-endpoint permissions — one token with your access. We'd rather tell you that plainly than let you discover it during an integration review. Keep it server-side.
API access is an entitlement included from the Starter tier upward. It is not restricted to enterprise pricing, because an API you can only reach at the top of the price list isn't an API, it's a sales tactic.
Yes — API writes are rate-limited. Bulk work should go through the bulk subscriber import endpoint, which queues as a job, rather than a loop of single-subscriber POSTs.
Campaign opens and campaign clicks. Only those two. If you need something to happen at another point in a sequence, use the automation webhook node instead — it sits inside a flow and fires any HTTP verb at any step you like.
Yes. The bulk subscriber import runs synchronously for small batches and queues as an async job for large ones, with import-job status endpoints so you can poll progress and handle failures properly rather than waiting on an HTTP connection that will time out.
In-app. There is an API docs page inside the product covering the full endpoint surface — lists, subscribers, import, campaigns, automations, sending servers and file upload. Sign up free and read it before you commit to anything.
The API docs page is inside the product. The free account costs nothing and takes a minute.