MCP servercom.commsharbor/commsharbor

Create an audience or saved segment. Only allowlisted filter fields are accepted — a saved segment cannot be turned into an arbitrary query over the CRM.

Delete an audience and its memberships. Contacts themselves are untouched.

Read one audience of this organization.

Add a CRM contact to a static audience. Only for `static` audiences: a saved segment's membership comes from its filter, not from this route.

Remove a contact from a static audience.

List the contacts currently in one audience.

Rename an audience or change its saved filter.

List static audiences and saved segments.

List tenant audit events. Audit records are never rewritten and never carry recipient PII.

Read the organization's plan, limits and global entitlements. Read this before a bulk send: `state.active` says whether sending is allowed and `warning` says when the plan runs out

Read plans, prices and x402 network. Public and unauthenticated: an agent should be able to learn what things cost before deciding whether to sign up at all.

Buy a pass or top-up through the house's payment door (credit or x402); 409 while live checkout is off. While `catalog.checkout_live` is false this answers **409 `checkout_disabled

Create a campaign draft. All three must already exist and be usable: a draft cannot be created against an unverified domain or an unpublished template.

Read one campaign, without any recipient data.

Freeze and launch or schedule a campaign idempotently. The freeze happens once and never again: consent, suppressions and audience membership are evaluated at this moment, and the

Reconcile campaign deliveries and feedback. Counts only. Which specific person opened what is not something this API answers.

Edit, pause, resume or cancel a campaign. Content can only change while the campaign is a draft. After launch this route moves state — the frozen recipient set and the frozen templ

List the campaigns of the organization.

Download a tenant CSV before expiry. Files expire seven days after creation. Durable audit and row-level results survive the file.

Confirm an import with a mandatory idempotency key. The idempotency key is mandatory here. Reusing it returns the same import and never creates a second Queue message — which is wh

List the row-numbered errors of one import, so the source file can be fixed.

Read one durable contact import and its current counts.

Upload and preview a consent-declared CSV. Nothing is created by this call. The consent declaration is mandatory: an import that cannot say why these people may be emailed is an im

List the contact imports of the organization.

Read consent and preference for a CRM contact. Being in the CRM is not permission to email. This resource is where permission actually lives.

Record permission-based marketing consent. This NEVER restores a previous unsubscribe. If the contact opted out, they stay out and `marketing_enabled` remains false — recording con

Create a CSV export of the organization's contacts, retained for seven days.

Resolve the active organization identity. Read this before a write when you are not certain which tenant is active. Guessing is how data lands in the wrong organization. An organiz

Creates a activity in the tenant CRM. Required: note. Needs crm:write on the organization. Returns the created resource with its absolute url.

Deletes one activity from the tenant CRM. Needs crm:write on the organization. A foreign or missing id answers 404.

Reads one activity from the tenant CRM. Needs crm:read on the organization. A foreign or missing id answers 404.

Lists activities in the tenant CRM — something that happened with a contact, company or deal. Cursor-paginated: limit 1-100, opaque cursor from the previous page. Filters: q, deal_

Updates one activity in the tenant CRM; only the fields you send change. Needs crm:write on the organization. A foreign or missing id answers 404.

Creates a company in the tenant CRM. Required: name. Needs crm:write on the organization. Returns the created resource with its absolute url.

Deletes one company from the tenant CRM. Needs crm:write on the organization. A foreign or missing id answers 404.

Reads one company from the tenant CRM. Needs crm:read on the organization. A foreign or missing id answers 404.

Lists companies in the tenant CRM — an organization in the tenant CRM — a customer of the customer. Cursor-paginated: limit 1-100, opaque cursor from the previous page. Filters: q.

Updates one company in the tenant CRM; only the fields you send change. Needs crm:write on the organization. A foreign or missing id answers 404.

Creates a contact in the tenant CRM. Required: email, first_name. Needs crm:write on the organization. Returns the created resource with its absolute url. Being in the CRM is not p

Deletes one contact from the tenant CRM. Needs crm:write on the organization. A foreign or missing id answers 404. Being in the CRM is not permission to email: consent lives in the

Reads one contact from the tenant CRM. Needs crm:read on the organization. A foreign or missing id answers 404. Being in the CRM is not permission to email: consent lives in the `m

Lists contacts in the tenant CRM — a person in the tenant CRM. Cursor-paginated: limit 1-100, opaque cursor from the previous page. Filters: q, company_id. Needs crm:read on the or

Updates one contact in the tenant CRM; only the fields you send change. Needs crm:write on the organization. A foreign or missing id answers 404. Being in the CRM is not permission

Creates a deal in the tenant CRM. Required: title, pipeline_id, stage_id. Needs crm:write on the organization. Returns the created resource with its absolute url. Money is in minor

Deletes one deal from the tenant CRM. Needs crm:write on the organization. A foreign or missing id answers 404. Money is in minor units: `value_minor: 10000` with `currency: "USD"`

Reads one deal from the tenant CRM. Needs crm:read on the organization. A foreign or missing id answers 404. Money is in minor units: `value_minor: 10000` with `currency: "USD"` is

Lists deals in the tenant CRM — an opportunity moving through a pipeline. Cursor-paginated: limit 1-100, opaque cursor from the previous page. Filters: q, pipeline_id, stage_id, st

Updates one deal in the tenant CRM; only the fields you send change. Needs crm:write on the organization. A foreign or missing id answers 404. Money is in minor units: `value_minor

Creates a pipeline in the tenant CRM. Required: name. Needs crm:write on the organization. Returns the created resource with its absolute url.

Deletes one pipeline from the tenant CRM. Needs crm:write on the organization. A foreign or missing id answers 404.

Reads one pipeline from the tenant CRM. Needs crm:read on the organization. A foreign or missing id answers 404.

Lists pipelines in the tenant CRM — a named sequence of stages that deals move through. Cursor-paginated: limit 1-100, opaque cursor from the previous page. Filters: q. Needs crm:r

Updates one pipeline in the tenant CRM; only the fields you send change. Needs crm:write on the organization. A foreign or missing id answers 404.

Creates a stage in the tenant CRM. Required: name. Needs crm:write on the organization. Returns the created resource with its absolute url.

Deletes one stage from the tenant CRM. Needs crm:write on the organization. A foreign or missing id answers 404.

Reads one stage from the tenant CRM. Needs crm:read on the organization. A foreign or missing id answers 404.

Lists stages in the tenant CRM — one step of a pipeline, addressed under the pipeline it belongs to. Cursor-paginated: limit 1-100, opaque cursor from the previous page. Needs crm:

Updates one stage in the tenant CRM; only the fields you send change. Needs crm:write on the organization. A foreign or missing id answers 404.

Creates a task in the tenant CRM. Required: title. Needs crm:write on the organization. Returns the created resource with its absolute url.

Deletes one task from the tenant CRM. Needs crm:write on the organization. A foreign or missing id answers 404.

Reads one task from the tenant CRM. Needs crm:read on the organization. A foreign or missing id answers 404.

Lists tasks in the tenant CRM — work someone still has to do in the tenant CRM. Cursor-paginated: limit 1-100, opaque cursor from the previous page. Filters: q, status, deal_id, co

Updates one task in the tenant CRM; only the fields you send change. Needs crm:write on the organization. A foreign or missing id answers 404.

Create a seven-day tenant JSON export. Scoped to one organization by construction: an export can never contain another tenant's data.

Download one tenant-scoped JSON export before it expires.

List the tenant data exports, which are retained for seven days.

Replay one campaign or webhook dead letter. One record at a time, addressed explicitly. There is no "replay everything": a bulk replay of an unknown set is how a bad hour becomes a

Inspect nominal dead letters. What ended up here after every retry. Records are addressed by opaque ID and carry no recipient PII.

Cancel a scheduled tenant erasure. That is what the seven days are for: after they pass, there is nothing left to cancel.

Read the latest tenant deletion request. `status: "none"` means no erasure was ever requested — the resource always answers, so a client never has to interpret a 404 as "nothing sc

Schedule tenant erasure after seven days using the exact confirmation phrase. The confirmation phrase must be exactly `delete <organization_id>` — typing the id is the point, so no

Read deliverability and backlog aggregates. This is the operator's single view of whether sending is healthy. It carries no recipient PII.

List normalized SES feedback events for one delivery. Open and Click are ADDITIVE: they are recorded alongside delivery state and never overwrite it.

Read one delivery and its SES MessageId without recipient data. `ses_message_id` is what correlates this record with AWS when you need to chase a message there.

Register the organization's exact sending domain and queue SES provisioning. Asking twice does not provision twice. Publish the returned DKIM records, then call `verify` to have th

List a domain's deliveries without recipient addresses.

Read one stored sending-domain resource. This returns what was stored at the last observation. To look again, call `verify`.

Read domain delivery and feedback aggregates.

Send one controlled smoke to the server-side recipient secret; never accepts a recipient argument. The request never accepts a recipient: the destination is a server-side secret. T

Refresh domain readiness from real SES and DNS observations. This is the ONLY operation that can move a domain to `active`, and only because it actually looked.

List sending domains with their last observed state. `status` is what was last OBSERVED at SES and DNS. It does not become `active` because provisioning was requested.

Read deployment health and build. Smoke tests wait for their own commit to appear here instead of racing edge propagation.

Get a five-minute signed URL for one attachment, by its index in the message. The URL expires; the stored file does not. Two steps on purpose: the URL is what travels to a browser,

Create a receiving address on a verified sending domain. Fails with 422 when the domain is not verified: receiving on an unproven domain is relay. The domain must already be `verif

Stop accepting mail at this address. History stays readable — this disables, it never erases. Disables, never erases: mail already received stays readable, because it is the custom

Read one receiving address and whether it is still accepting mail.

Read one message: body, chosen headers and `auth`. `from` is text the sender chose; `auth` is the SPF/DKIM/DMARC verdict the receiving edge reached. Decide on `auth`. `auth` is wha

List what arrived at one address, newest first. Summaries only, no body. Summaries only — no body. Read one message to get its text, HTML and headers.

List the addresses this organization receives on. Up to 100, newest first. A disabled address stays listed: its history is still readable.

Revoke the current session. Bootstrap/CSRF must belong to this browser and session. Other product sessions remain active.

Send one controlled permission-based marketing smoke. Like the transactional smoke, the destination is a server-side secret. `contact_id` must be the CRM contact that matches it —

Read the current account profile and platform role. `user.id` is the shared-account ID. Organizations are not listed here: they live in the shared account, which does not list them

Queue one idempotent transactional delivery. Same behaviour and same idempotency as `POST /api/messages`. `X-Organization-Id` is still required with the session and must match the

Read the organization's timezone and whether marketing is currently paused.

Update timezone or pause state. Pausing is always allowed. Resuming is not: if the pause came from reputation or SES tenant risk, a healthy observation has to exist first.

List current operational alerts without PII. Covers dead letters, backlog, worker and SNS failures, reputation, paused sending, quota and conservative SES/SNS cost capacity — never

Refresh alerts, quota and capacity observations. The GET reads what was last stored; this goes and looks again. Same distinction as domain verification.

Open an organization by id: name, your role and the CommsHarbor plan. This is how a workspace is opened. Name and role come from the shared account (null with an organization API k

Confirm the caller's platform role. Tenant ownership grants nothing here: platform access is a separate, explicit grant.

Creates a activity in the platform CRM. Required: note. Needs a human session with the platform_admin grant; tenant ownership does not qualify. Returns the created resource with it

Deletes one activity from the platform CRM. Needs a human session with the platform_admin grant; tenant ownership does not qualify. A foreign or missing id answers 404.

Reads one activity from the platform CRM. Needs a human session with the platform_admin grant; tenant ownership does not qualify. A foreign or missing id answers 404.

Lists activities in the platform CRM — our note about a prospective tenant. Cursor-paginated: limit 1-100, opaque cursor from the previous page. Filters: q. Needs a human session w

Updates one activity in the platform CRM; only the fields you send change. Needs a human session with the platform_admin grant; tenant ownership does not qualify. A foreign or miss

Creates a lead in the platform CRM. Required: email, name. Needs a human session with the platform_admin grant; tenant ownership does not qualify. Returns the created resource with

Deletes one lead from the platform CRM. Needs a human session with the platform_admin grant; tenant ownership does not qualify. A foreign or missing id answers 404.

Reads one lead from the platform CRM. Needs a human session with the platform_admin grant; tenant ownership does not qualify. A foreign or missing id answers 404.

Lists leads in the platform CRM — a prospective ORGANIZATION in our own funnel — platform CRM is not tenant data. Cursor-paginated: limit 1-100, opaque cursor from the previous pag

Updates one lead in the platform CRM; only the fields you send change. Needs a human session with the platform_admin grant; tenant ownership does not qualify. A foreign or missing

Creates a task in the platform CRM. Required: title. Needs a human session with the platform_admin grant; tenant ownership does not qualify. Returns the created resource with its a

Deletes one task from the platform CRM. Needs a human session with the platform_admin grant; tenant ownership does not qualify. A foreign or missing id answers 404.

Reads one task from the platform CRM. Needs a human session with the platform_admin grant; tenant ownership does not qualify. A foreign or missing id answers 404.

Lists tasks in the platform CRM — work on a platform lead — about a prospective tenant, not about a tenant's customer. Cursor-paginated: limit 1-100, opaque cursor from the previou

Updates one task in the platform CRM; only the fields you send change. Needs a human session with the platform_admin grant; tenant ownership does not qualify. A foreign or missing

Read preference through a signed capability. The token IS the credential. It reveals preference state and nothing else — no email address, no CRM record.

Create signed preference and unsubscribe URLs. The capability is scoped to one organization and one contact, it expires, and it embeds no email address. Put `marketing_headers` in

Apply one-click unsubscribe through a signed capability. This is the endpoint mail clients call from the `List-Unsubscribe-Post` header, which is why the body is form-encoded and f

Suppress one recipient inside the active organization.

List organization suppressions. Global, organization and SES tenant suppressions are all checked BEFORE quota and before any queue work.

Archive a template and preserve its versions. Deliveries that referenced a version must keep resolving to it, so archiving hides the draft and keeps the history.

Create a canonical block template draft. Creating never publishes. Nothing can send this template until `publish` freezes a version.

Export the latest published HTML, text and MJML.

Read one template draft owned by this organization.

Import a safe HTML subset as a draft. Active content, forms and unsafe URLs are rejected, not sanitised-and-kept. What survives is stored as blocks, so an imported template behaves

Compile and render a safe template preview. `warnings` tells you what was stripped and what would not render — read it before publishing rather than after sending.

Publish an immutable template version. The version's identity is the hash of its compiled content — publishing identical content does not create a second version.

Update one template draft. Editing a draft can never change what a past delivery rendered: published versions are immutable.

List the immutable published versions of a template.

List the versioned email templates of the organization.

Read the organization's tracking domain, the CNAME it needs and whether the platform actually answers on it. Null when there is none: links then use the shared platform origin. `nu

Register the host that will serve this organization's message links. One per organization; registering never activates it. One per organization, and the host is unique across the p

Remove the tracking domain; NEW messages go back to the platform origin. Links already sent keep pointing at the removed host. Links already sent keep pointing at the removed host:

Probe the host now and store what was seen. The ONLY way to reach `active`, and only after reaching this product on that host — DNS resolving is not enough. The only operation that

Create a webhook and reveal its secret once. Deliveries are signed with timestamped HMAC-SHA256 and retried with exponential backoff; what still fails lands in the tenant-scoped de

List the signed attempts made to one webhook and their retry state.

Disable a webhook without deleting the evidence of what it already delivered.

Read one webhook, without its signing secret.

List the webhook endpoints of the organization, without their signing secrets.

Current public prices and free allowances; no charge.