Everything an AI agent can do with the Campaign Monitor API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints51
API versionv3.3
Last updated23 June 2026
Orientation

How the Campaign Monitor API works.

The Campaign Monitor API is how an app or AI agent works with an email marketing account: adding and importing subscribers onto lists, creating and sending campaigns, building segments, and sending transactional email. Access is granted through an account API key or an OAuth token carrying coarse scopes like ManageLists, SendCampaigns, and ImportSubscribers, and an agent is limited to the accounts and clients that key or token can reach. Campaign Monitor can also push subscriber changes to a webhook so an integration learns about them without polling.

51Endpoints
9Capability groups
20Read
31Write
10Permissions
Authentication
Every call needs either an API key or an OAuth 2.0 access token. An API key is sent as the username in HTTP Basic auth with any password value, and grants full access to whatever account or client the key belongs to. An OAuth token is sent as a bearer token in the Authorization header and is limited to the scopes it was granted. Reading a client's details returns that client's own API key, so that read exposes full access to the client.
Permissions
OAuth uses a fixed set of coarse scopes, requested as a comma-separated list: ViewReports, ManageLists, CreateCampaigns, ImportSubscribers, SendCampaigns, ViewSubscribersInReports, ManageTemplates, AdministerPersons, AdministerAccount, ViewTransactional, SendTransactional, and Automation. Each scope spans a whole area, so SendCampaigns covers sending any campaign and ImportSubscribers covers adding or removing subscribers on any list. An API key carries no scopes at all and can do everything its account or client can.
Versioning
The API is versioned by number in the request path, and the current version is v3.3. Earlier versions such as v3.2 keep working, so an integration moves up by changing the version segment in its paths when it chooses. The v3.3 release added pagination on campaign results, a campaign tagging endpoint, subscriber list-join-date tracking, and SMS consent fields on subscriber records.
Data model
Resources nest from the account down. An account holds clients, each client holds lists, campaigns, segments, and templates, and each list holds subscribers, custom fields, and webhooks. Most reads and writes accept and return JSON or XML, chosen by the .json or .xml suffix on the path, while the transactional endpoints are JSON only. Reads that return many subscribers, like a list's active subscribers, come back as fixed-size paged results.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Campaign Monitor determines what it can reach. There is a route for making calls and a route for receiving events, each governed by the key or token behind it and the permissions it carries.

Ways to connect

REST API

The REST API answers at https://api.createsend.com/api/v3.3/. Most endpoints accept and return both JSON and XML, while the transactional endpoints are JSON only.

Best forConnecting an app or AI agent to Campaign Monitor.
Governed byThe API key or OAuth token and the permissions it carries.
Docs ↗

Webhooks

List webhooks deliver batched Subscribe, Update, and Deactivate events to a receiver URL chosen when the webhook is created, with up to 1,000 events per delivery.

Best forLearning about subscriber changes without polling.
Governed byThe API key or OAuth token and the permissions it carries.
Docs ↗
Authentication

API key (HTTP Basic auth)

An account or client API key is sent as the username in HTTP Basic auth, with any value for the password, and grants full access to whatever that key's account or client can reach. Reading a client's details returns that client's own key.

TokenAPI key
Best forServer-side integrations on a single account
Docs ↗

OAuth 2.0

OAuth 2.0 lets an app act on a Campaign Monitor account without its username and password, granting an access token scoped to a comma-separated list of coarse permissions like ManageLists, ImportSubscribers, SendCampaigns, and ViewReports. The token is sent as a bearer token and can be refreshed.

TokenOAuth 2.0 access token
Best forApps acting for other people's accounts
Docs ↗
Capability map

What an AI agent can do in Campaign Monitor.

The Campaign Monitor API is split into areas an agent can act on, like subscribers, lists, campaigns, segments, and transactional email. Each area has its own methods, and writes in some areas send real mail to real people.

Subscribers

7 endpoints

Add and update a single subscriber, import many at once, read a subscriber's details and history, unsubscribe, and delete.

Writes here add real people to a mailing list and change their consent state.
View endpoints

Lists

8 endpoints

Create, read, update, and delete a list, and read its active, unsubscribed, bounced, and unconfirmed subscribers.

Writes here change real list data and who an agent can mail.
View endpoints

Campaigns

8 endpoints

Create a draft campaign from content or a template, send or schedule it, send a preview, and read its results.

Sending a campaign delivers real email to real subscribers and cannot be recalled once it leaves.
View endpoints

Segments

5 endpoints

Create, read, update, and delete a segment on a list, manage its rules, and read the subscribers it matches.

Writes here change which subscribers a campaign reaches.
View endpoints

Custom fields

3 endpoints

Create, update, and delete the custom fields that store extra data against each subscriber on a list.

Deleting a custom field also removes any segment rules built on it.
View endpoints

Clients

6 endpoints

Create a client, read its details, lists, segments, and campaigns, manage its suppression list, and delete it.

Reading client details returns the client's own API key, and writes here change billing and account data.
View endpoints

Templates

4 endpoints

Create, read, update, and delete the email templates a client builds campaigns from.

Writes here change real template data.
View endpoints

Transactional

6 endpoints

Send a smart or classic transactional email, list smart emails, and read message timelines and statistics.

Sending a transactional email delivers real mail to the named recipient immediately.
View endpoints

Webhooks

4 endpoints

List, create, delete, activate, and deactivate the webhooks that notify an app of subscriber changes on a list.

Writes here change where Campaign Monitor sends subscriber event data.
View endpoints
Endpoint reference

Every Campaign Monitor API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Subscribers

Add and update a single subscriber, import many at once, read a subscriber's details and history, unsubscribe, and delete.7

OAuth scope ImportSubscribers. With an API key, the key's account access governs the call instead of a scope.

Acts onsubscriber
Permission (capability)ImportSubscribers
VersionAvailable since the API’s base version
Webhook eventsubscribe
Rate limitStandard limits apply

OAuth scope ImportSubscribers. The email query parameter identifies the current record before any change.

Acts onsubscriber
Permission (capability)ImportSubscribers
VersionAvailable since the API’s base version
Webhook eventupdate
Rate limitStandard limits apply

OAuth scope ImportSubscribers. A request with more than 1,000 records is rejected and must be split.

Acts onsubscriber
Permission (capability)ImportSubscribers
VersionAvailable since the API’s base version
Webhook eventsubscribe
Rate limitUp to 1,000 subscribers per request

OAuth scope ViewSubscribersInReports. Set includetrackingpreference to true to return consent state.

Acts onsubscriber
Permission (capability)ViewSubscribersInReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewSubscribersInReports.

Acts onsubscriber
Permission (capability)ViewSubscribersInReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ImportSubscribers. Whether the email is suppressed depends on the list's settings.

Acts onsubscriber
Permission (capability)ImportSubscribers
VersionAvailable since the API’s base version
Webhook eventdeactivate
Rate limitStandard limits apply

OAuth scope ImportSubscribers. A deleted subscriber can be re-added later, unlike a suppressed one.

Acts onsubscriber
Permission (capability)ImportSubscribers
VersionAvailable since the API’s base version
Webhook eventdeactivate
Rate limitStandard limits apply

Lists

Create, read, update, and delete a list, and read its active, unsubscribed, bounced, and unconfirmed subscribers.8

OAuth scope ManageLists.

Acts onlist
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewReports.

Acts onlist
Permission (capability)ViewReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageLists.

Acts onlist
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageLists. Deleting a list removes its subscribers and reporting.

Acts onlist
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewSubscribersInReports.

Acts onlist
Permission (capability)ViewSubscribersInReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitUp to 1,000 records per page

OAuth scope ViewSubscribersInReports.

Acts onlist
Permission (capability)ViewSubscribersInReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitUp to 1,000 records per page

OAuth scope ViewSubscribersInReports.

Acts onlist
Permission (capability)ViewSubscribersInReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitUp to 1,000 records per page

OAuth scope ViewSubscribersInReports.

Acts onlist
Permission (capability)ViewSubscribersInReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitUp to 1,000 records per page

Campaigns

Create a draft campaign from content or a template, send or schedule it, send a preview, and read its results.8

OAuth scope CreateCampaigns. Creating a draft does not send any mail on its own.

Acts oncampaign
Permission (capability)CreateCampaigns
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope CreateCampaigns.

Acts oncampaign
Permission (capability)CreateCampaigns
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope SendCampaigns. This delivers the campaign to every recipient on the chosen lists and segments.

Acts oncampaign
Permission (capability)SendCampaigns
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope SendCampaigns. A preview goes only to the addresses given, not the campaign's lists.

Acts oncampaign
Permission (capability)SendCampaigns
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewReports.

Acts oncampaign
Permission (capability)ViewReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewReports.

Acts oncampaign
Permission (capability)ViewReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitUp to 1,000 records per page

OAuth scope SendCampaigns. This works only before the scheduled send time.

Acts oncampaign
Permission (capability)SendCampaigns
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope CreateCampaigns.

Acts oncampaign
Permission (capability)CreateCampaigns
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Segments

Create, read, update, and delete a segment on a list, manage its rules, and read the subscribers it matches.5

OAuth scope ManageLists.

Acts onsegment
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageLists. If rules are omitted, the existing rules stay in place.

Acts onsegment
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewReports.

Acts onsegment
Permission (capability)ViewReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewSubscribersInReports.

Acts onsegment
Permission (capability)ViewSubscribersInReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitUp to 1,000 records per page

OAuth scope ManageLists.

Acts onsegment
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Custom fields

Create, update, and delete the custom fields that store extra data against each subscriber on a list.3

OAuth scope ManageLists.

Acts oncustom field
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageLists.

Acts oncustom field
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageLists.

Acts oncustom field
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Clients

Create a client, read its details, lists, segments, and campaigns, manage its suppression list, and delete it.6

OAuth scope AdministerAccount. Creating clients is an agency-level account feature.

Acts onclient
Permission (capability)AdministerAccount
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewReports. The response includes the client's own API key, which grants full access to that client.

Acts onclient
Permission (capability)ViewReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewReports.

Acts onclient
Permission (capability)ViewReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewReports.

Acts onclient
Permission (capability)ViewReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageLists. Suppressed addresses are blocked from all of the client's future sends.

Acts onclient
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope AdministerAccount. Deleting a client removes its lists, campaigns, and reporting.

Acts onclient
Permission (capability)AdministerAccount
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Templates

Create, read, update, and delete the email templates a client builds campaigns from.4

OAuth scope ManageTemplates.

Acts ontemplate
Permission (capability)ManageTemplates
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ViewReports.

Acts ontemplate
Permission (capability)ViewReports
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageTemplates.

Acts ontemplate
Permission (capability)ManageTemplates
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageTemplates.

Acts ontemplate
Permission (capability)ManageTemplates
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Transactional

Send a smart or classic transactional email, list smart emails, and read message timelines and statistics.6

OAuth scope ViewTransactional. Transactional endpoints accept and return JSON only.

Acts ontransactional email
Permission (capability)ViewTransactional
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitRate-limited, see response headers

OAuth scope ViewTransactional.

Acts ontransactional email
Permission (capability)ViewTransactional
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitRate-limited, see response headers

OAuth scope SendTransactional. The content is managed in Campaign Monitor; the call supplies the recipient and variables.

Acts ontransactional email
Permission (capability)SendTransactional
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitRate-limited, see response headers

OAuth scope SendTransactional. Unlike a smart email, the request carries the entire message body.

Acts ontransactional email
Permission (capability)SendTransactional
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitRate-limited, see response headers

OAuth scope ViewTransactional.

Acts ontransactional email
Permission (capability)ViewTransactional
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitRate-limited, see response headers

OAuth scope ViewTransactional.

Acts ontransactional email
Permission (capability)ViewTransactional
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitRate-limited, see response headers

Webhooks

List, create, delete, activate, and deactivate the webhooks that notify an app of subscriber changes on a list.4

OAuth scope ManageLists.

Acts onwebhook
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageLists. The chosen events and the receiver URL are set when the webhook is created.

Acts onwebhook
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageLists.

Acts onwebhook
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

OAuth scope ManageLists. Campaign Monitor automatically deactivates a webhook after sustained delivery failures over a week.

Acts onwebhook
Permission (capability)ManageLists
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Campaign Monitor can notify an app or AI agent when subscribers on a list change, instead of the app repeatedly asking. It posts batched events to a webhook URL that has been registered on that list.

EventWhat it signalsTriggered by
SubscribeFires when a subscriber joins a list, is manually added, imported, or activated./api/v3.3/subscribers/{listid}.json
/api/v3.3/subscribers/{listid}/import.json
UpdateFires when a subscriber's details change through editing, re-importing, or an API call./api/v3.3/subscribers/{listid}.json?email={email}
DeactivateFires when a subscriber unsubscribes, bounces, reports spam, or is removed from a list./api/v3.3/subscribers/{listid}/unsubscribe.json
/api/v3.3/subscribers/{listid}.json?email={email}
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Campaign Monitor limits how much an app or AI agent can read at once through fixed-size paged results, and rate-limits the transactional email endpoints separately with request-quota headers on each response.

Request rate

Most of the Campaign Monitor API has no published per-second request quota; the constraints are on how much is read or written at once. Reads return fixed-size paged results, and the subscriber import accepts at most 1,000 records per request, with a larger batch rejected outright. The transactional endpoints are rate-limited separately: each response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers, and going over returns HTTP 429.

Pagination

List endpoints that return subscribers or campaign results, like a list's active subscribers or a campaign's recipients, return a paged result of up to 1,000 records per page, with the page number, page size, order field, and order direction set through query parameters. Following pages are fetched by incrementing the page number until the result is empty.

Request size

The subscriber import accepts at most 1,000 records in a single request, and a batch larger than that is rejected and must be split. Paged read endpoints return at most 1,000 records per page. Requests and responses are JSON or XML, except the transactional endpoints, which are JSON only.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400Bad RequestThe input is invalid. The body carries a numeric Code and a Message naming the problem, such as 100 for an invalid API key, 102 for an invalid client ID, or 250 for a list title that is not unique within a client.Read the Code and Message, correct the named input, and resend.
401UnauthorizedThe credentials are missing or invalid, or an OAuth token is invalid (Code 120), expired (Code 121), or revoked (Code 122).Check the API key or OAuth token, refreshing an expired token before retrying.
403ForbiddenThe call targets an agency-only feature that the authenticated customer is not entitled to use.Use an account with the required agency entitlement, or omit the agency-only call.
404Not FoundThe resource named in the path does not exist, such as an unknown list, campaign, or subscriber.Confirm the ID in the path is correct and the resource still exists.
429Too Many RequestsA transactional endpoint's rate limit was exceeded. The X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers report the quota and when it resets.Wait until the reset time in the X-RateLimit-Reset header, then retry.
500Internal Server ErrorAn unexpected error occurred on Campaign Monitor's side.Retry after a short delay, and contact support if it persists.
Versioning & freshness

Version history.

Campaign Monitor versions its API by number in the request path. The current version is v3.3, and earlier versions like v3.2 keep working so an integration moves up when it chooses.

Version history

What changed, and when

Latest versionv3.3
v3.3Current version
Current version, replacing v3.2

Version 3.3 is the current API version. It added pagination and performance improvements when requesting campaigns, a campaign tagging endpoint, subscriber list-join-date tracking, journey copying, template copying, and triggering of subscriber-activity journeys. Subscriber endpoints gained ListJoinedDate, MobileNumber, and ConsentToSendSms fields, with SMS consent returned when a mobile number is present. Earlier versions like v3.2 keep working, so an integration upgrades by changing the version segment in its paths.

What changed
  • Pagination and performance improvements when requesting campaigns
  • Added a campaign tagging endpoint
  • Subscriber records now track ListJoinedDate
  • Subscriber records gained MobileNumber and ConsentToSendSms fields, returning SMS consent when a mobile number is present
  • Added journey copying and template copying
  • Added triggering of subscriber-activity journeys
v3.2
Previous version

Version 3.2 was the prior API version, superseded by v3.3. It remains reachable at its own version segment in the request path, so an integration written against it keeps working until it chooses to move up to v3.3.

What changed
  • Prior numbered version, still reachable at its own path segment

An integration pins a version in the path and moves up on a schedule that suits it.

Campaign Monitor API what's new ↗
Questions

Campaign Monitor API, answered.

API key or OAuth, which should an integration use?+
An API key is the simpler choice for a server-side integration acting on a single account that the integration owns. It is sent as the username in HTTP Basic auth with any password, and grants full access to that account or client. OAuth 2.0 suits an app acting for other people's accounts, because the user authorizes it without sharing a password and the resulting token is limited to chosen scopes. OAuth tokens also expire and can be refreshed.
What OAuth scopes are there, and how broad are they?+
There are twelve scopes, requested as a comma-separated list: ViewReports, ManageLists, CreateCampaigns, ImportSubscribers, SendCampaigns, ViewSubscribersInReports, ManageTemplates, AdministerPersons, AdministerAccount, ViewTransactional, SendTransactional, and Automation. Each one spans a whole area rather than a single method, so ImportSubscribers covers adding, updating, and removing subscribers across any list the token can reach, and SendCampaigns covers sending any campaign. There is no per-list or per-campaign scope.
How are the API's rate limits set?+
Most endpoints have no published per-second quota; the limits are on volume. Reads come back as paged results of up to 1,000 records, and the subscriber import takes at most 1,000 records per request, rejecting anything larger. The transactional endpoints are rate-limited separately, and each response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers, with HTTP 429 returned when the limit is exceeded.
How does the error model work?+
Failed calls return a standard HTTP status, such as 400 for bad input, 401 for an authentication problem, 403 for an agency-only feature, 404 for a missing resource, or 500 for a server error. The body carries a numeric Code and a human-readable Message, like Code 100 for an invalid API key, Code 102 for an invalid client ID, or Codes 120 to 122 for an invalid, expired, or revoked OAuth token. Read the Code to know exactly what failed.
How does an integration receive events instead of polling?+
List webhooks deliver subscriber changes without polling. A receiver URL is registered on a list with a chosen set of events, which are Subscribe, Update, and Deactivate. Campaign Monitor posts batched events, up to 1,000 at a time, to that URL when subscribers change. If a webhook fails repeatedly over more than a week, Campaign Monitor automatically deactivates it, and it can be reactivated through the API.
What changed between v3.2 and v3.3?+
Version 3.3 added pagination and performance improvements when requesting campaigns, a campaign tagging endpoint, subscriber list-join-date tracking, journey and template copying, and the ability to trigger subscriber-activity journeys. Subscriber records gained ListJoinedDate, MobileNumber, and ConsentToSendSms fields, with SMS consent returned when a mobile number is present and the SMS preference flag is set. Earlier versions still work, so an integration upgrades by changing the version in its request paths.
Related

More marketing API guides for agents

What is Bollard AI?

Control what every AI agent can do in Campaign Monitor.

Bollard AI sits between a team's AI agents and Campaign Monitor. Grant each agent exactly the access it needs, read or write, resource by resource, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Campaign Monitor API key.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Campaign Monitor
Email Agent
Read list subscribers ResourceOffReadFull use
Import subscribers ActionOffReadFull use
Send campaigns ActionOffReadFull use
Per-agent access, set in Bollard AI, not in Campaign Monitor