API Access and Integration

AtrioMail has a REST API, so your own billing system, portal or automation can manage email objects without anyone signing in to the control panel.

Getting an API key

1. Open API Keys in the control panel
2. Create a key
3. Copy the key and store it somewhere safe

Notes on keys:

• The key is shown in full once, at creation. It is stored hashed, so it cannot be shown again.
• A key can be given an expiry date, and can be switched off or regenerated at any time.
• A key carries the full permissions of the account that created it. There are no read-only or scoped keys.
• Repeated failed attempts are temporarily locked out.

Making a request

Send your key in the X-API-KEY header over HTTPS.

The API allows up to 30 requests per minute.

What the API covers

• Domains, including each domain's provisioning state after the automated security check (screening, review, ready or rejected)
• Mailboxes and mailbox storage
• Forwarders and catch-all addresses
• Customer accounts, and domains owned by those customers
• IMAP migration jobs (create, update, pause, remove)
• DNS record checks for your own domains, against their exact DKIM key and Amazon SES records
• Single-use sign-in links that take a customer straight into their control panel (valid 60 seconds, one use). This is not SAML or OpenID Connect, and it does not sign in to webmail.
• The DNS records a domain needs (MX, SPF, Amazon SES verification and DKIM) and the IMAP and SMTP settings to give end users

Per-domain caps on mailbox count and total storage can be set through the API. Requests over the cap are refused, and a cap cannot be lowered below current usage.

Retrying a customer creation returns the existing account instead of an error.

Common use cases

• Create a domain and its first mailbox when a client orders from your own system
• Create customer accounts for the clients you manage
• Show a client their DNS records and mail client settings inside your own portal
• Hand a client a single-use sign-in link from your portal
• Start and track IMAP migration jobs

If you use WHMCS, you do not need to build any of this yourself: download the provisioning module from the Plugins page in the control panel.

Any automation tool that can send HTTPS requests with a custom header, such as n8n's generic HTTP Request node, can call the API.

Keeping your key safe

• 🔒 Treat the key like a password: it has the same permissions as the account that created it
• 🔒 Keep it server side, never in a browser, mobile app or public repository
• 🔒 Use HTTPS only
• 🔒 Regenerate or switch off the key if it may have been exposed

Need Help?

Contact support through the live chat in the control panel.