Validate and render an email WITHOUT sending it. Returns the exact payload that would go to SendGrid plus a single-use confirm_token (valid 10 minutes). Sending requires passing that token to send_email — there is no direct-send path. BCC is not accepted by design.

Send the email previously rendered by preview_email. Accepts ONLY a confirm token — the payload cannot be altered between preview and send. Tokens are single-use and expire after 10 minutes. In dry-run mode (the default) this simulates and audits but sends nothing.

Add an address to a suppression list (default: global unsubscribes). Suppressing is the SAFE direction — it stops future sends to the address.

Remove an address from a suppression list. DANGEROUS direction — it re-enables sending to someone who bounced or unsubscribed, which can be a compliance violation. Requires confirm=true, is rate-limited, and audited.

List transactional email templates (dynamic + legacy).

Fetch one template with its versions (subject + content preview).

Global email stats (requests/delivered/opens/clicks/bounces/spam) from start_date (YYYY-MM-DD). aggregated_by: day|week|month.

List a suppression list: unsubscribes|bounces|blocks|spam_reports|invalid_emails.

Check whether an address appears on any suppression list. Run this before drafting mail to someone — sending to suppressed addresses hurts deliverability and may violate consent.

List authenticated sending domains and their DNS validity — the first thing to check when deliverability drops.

This server's security posture: mode, rate-limit remaining, allowlist, caps, audit-log path, and whether an API key is present (never the key).