API Reference

Developer Documentation

Integrate SplashSend into your application with our REST API. Add people, manage subscriptions, and trigger drip campaigns programmatically.

Authentication

All API requests require a valid API key sent in the Authorization header as a Bearer token. You can create and manage API keys from the Setup page in your dashboard.

curl https://splashsend.com/api/v1/contacts \
  -H "Authorization: Bearer sk_live_your_api_key_here"

bash

Keep your API keys safe

Never expose API keys in client-side code. Always make API calls from your server. Keys are shown only once at creation and cannot be retrieved later.

Base URL

All API endpoints are relative to:

https://splashsend.com/api/v1

text

People

Create, list, update, and manage your people.

Every endpoint, always current

People, orders, events, products and your data sets — with every field, every response and a console to try them in. It is generated from the API itself, so it is never out of date.

Open the API reference

Webhooks

Receive real-time notifications when events happen in your account. Configure webhook endpoints in your dashboard under Setup → Integrations.

Secure by default

Every webhook request is signed with HMAC-SHA256 using a secret key unique to each endpoint. Always verify the signature before processing payloads.

Event types

Event	Description
contact.subscribed	A new contact subscribes or an existing contact re-subscribes
contact.unsubscribed	A contact unsubscribes from your emails
campaign.sent	A campaign finishes sending to all recipients
email.delivered	An email is successfully delivered to the recipient
email.bounced	An email bounces (hard or soft)
email.complained	A recipient marks your email as spam

Payload format

Each webhook POST request includes a JSON body and two special headers:

Header	Description
X-SplashSend-Event	The event type (e.g. `contact.subscribed`)
X-SplashSend-Signature	HMAC-SHA256 hex digest of the raw request body

{
  "event": "contact.subscribed",
  "timestamp": "2026-02-27T14:30:00.000Z",
  "data": {
    "contactId": "clx123...",
    "email": "jane@example.com",
    "name": "Jane Doe"
  }
}

json

Verifying signatures

To verify a webhook is authentic, compute the HMAC-SHA256 of the raw request body using your webhook secret and compare it to the signature header.

# The signature header looks like:
# X-SplashSend-Signature: a1b2c3d4e5f6...

# Compute expected signature:
echo -n '$REQUEST_BODY' | openssl dgst -sha256 -hmac 'your_webhook_secret'

# Compare the hex output with the header value

curl

Delivery & retries

SplashSend attempts each delivery up to 3 times: immediately, then after 1 second, then after 5 seconds. Each attempt has a 10-second timeout. If all attempts fail, the failure is recorded against the webhook endpoint. Webhooks that accumulate too many consecutive failures are automatically disabled. You can monitor and manage your webhooks from the Integrations tab in Setup.

Error Handling

All errors return a consistent JSON envelope with an error code and human-readable message.

{
  "error": {
    "code": "validation_error",
    "message": "email is required and must be a string"
  }
}

json

Status	Code	Description
400	validation_error	Request body is invalid or missing required fields
401	unauthorized	API key is missing, invalid, or revoked
403	plan_limit_reached	You've reached the people limit on your current plan. Upgrade to add more.
404	not_found	The requested resource does not exist
429	rate_limited	Too many requests. Slow down and retry after a moment.
500	internal_error	Something went wrong on our end

Rate Limiting

The API currently does not enforce strict rate limits. However, we recommend keeping requests below 60 requests per minute per API key.

Need higher limits?