Everything an AI agent can do with the Constant Contact API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints53
API versionv3
Last updated23 June 2026
Orientation

How the Constant Contact API works.

The Constant Contact API is how an app or AI agent works with a Constant Contact account: adding and updating contacts, organizing them into lists, tags, and segments, building and scheduling email campaigns, and reading who opened or clicked. Access is granted through an OAuth access token whose scopes decide which areas a call can reach, like contact data, campaign data, or account settings, and a call outside its scopes is refused. It runs as a single continuously updated API, where new endpoints and fields arrive through monthly release notes rather than dated versions.

53Endpoints
10Capability groups
23Read
30Write
4Permissions
Authentication
Constant Contact's V3 API uses OAuth 2.0 only. Every call sends an access token as 'Authorization: Bearer ', and a token lasts 24 hours. Server-side apps use the authorization code flow with a client secret; apps that cannot keep a secret use PKCE. Including the offline_access scope returns a refresh token, so a new access token can be obtained without the user signing in again.
Permissions
Access is scoped by five OAuth scopes. contact_data covers contacts, lists, tags, custom fields, segments, and bulk activities; campaign_data covers email campaigns and reporting; account_read reads account data and account_update changes it; offline_access returns a refresh token. A call to an endpoint outside the granted scopes returns 403. Scopes are requested space-delimited at authorization time.
Versioning
There is a single V3 API at api.cc.email/v3, with no dated versions to pin. New endpoints and fields ship through monthly release notes without a new version string, so changes are additive rather than a version an integration upgrades to. The earlier V2 API is retired.
Data model
The API is resource-oriented JSON over HTTPS at api.cc.email/v3. Contacts sit at the center, joined to contact lists, tags, custom fields, and segments, and changed in bulk through asynchronous activity jobs. An email campaign holds one or more campaign activities that carry the actual email content, which is scheduled to send to lists, and reporting endpoints return per-campaign tracking. Collections are cursor-paginated.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Constant Contact determines what it can reach. Access runs through the V3 API, authorized by OAuth, and the permissions that the access token carries decide which contacts, campaigns, and account data a call can read or change.

Ways to connect

V3 REST API

The V3 REST API answers at https://api.cc.email/v3. It accepts JSON request bodies, returns JSON responses, and pages through collections with a cursor carried in a next link. Every call sends an OAuth access token in the Authorization header, and TLS 1.2 or better is required.

Best forConnecting an app or AI agent to Constant Contact.
Governed byThe OAuth access token and the scopes it carries.
Docs ↗

Partner webhooks

Constant Contact offers webhooks only to partner integrations, and only for billing and account events, like a plan change or a new account. A partner subscribes per topic, and Constant Contact POSTs a notification with a URL to fetch the event details. There are no webhooks for contact or campaign activity, so a regular integration polls the API instead.

Best forPartner integrations tracking billing and account changes.
Governed byThe partner credentials and the topics subscribed to.
Docs ↗
Authentication

OAuth 2.0 authorization code flow

A server-side app sends the user to authorize at authz.constantcontact.com, receives a short-lived authorization code, and exchanges it for an access token using its client_id and client_secret. This is the recommended flow because the client secret stays on the server. Adding the offline_access scope returns a refresh token.

TokenOAuth access token (Bearer), valid 24 hours
Best forServer-side apps that can keep a client secret
Docs ↗

OAuth 2.0 PKCE flow

The PKCE flow is the authorization code flow hardened for apps that cannot keep a secret, like a single-page or mobile app. The app proves it started the request with a code verifier instead of a client secret, then exchanges the authorization code for an access token.

TokenOAuth access token (Bearer), valid 24 hours
Best forSingle-page and mobile apps that cannot store a secret
Docs ↗

OAuth 2.0 implicit flow

The implicit flow returns an access token directly to a browser app without a server exchange. It cannot return a refresh token, so the user must re-authorize when the token expires, and Constant Contact points new integrations to the PKCE flow instead.

TokenOAuth access token (Bearer), valid 24 hours, no refresh token
Best forLegacy browser-only apps; PKCE is preferred
Docs ↗
Capability map

What an AI agent can do in Constant Contact.

The Constant Contact API is split into areas an agent can act on, like contacts, contact lists, email campaigns, segments, and reporting. Each area has its own methods, and writes in some areas send live email or change who is on a list.

Contacts

6 endpoints

Create, read, update, and delete contacts, and create or update a contact through a sign-up form.

Writes here change real contact data.
View endpoints

Contact lists

5 endpoints

Create, read, update, and delete the lists that contacts belong to.

Writes here change real contact list data.
View endpoints

Tags

5 endpoints

Create, read, rename, and delete tags, the labels used to group contacts.

Writes here change real tag data.
View endpoints

Custom fields

5 endpoints

Create, read, update, and delete the custom fields stored on contacts.

Writes here change real custom field data.
View endpoints

Segments

5 endpoints

Create, read, update, and delete segments, the saved rules that select contacts.

Writes here change real segment data.
View endpoints

Bulk activities

7 endpoints

Run background jobs that import, export, delete, or list-tag many contacts in one call, and check a job's status.

Writes here change real contact data across thousands of records at once.
View endpoints

Email campaigns

5 endpoints

Create, read, list, rename, and delete email campaigns.

Writes here change real email campaign data.
View endpoints

Campaign activities

6 endpoints

Read and edit a campaign's email content, send a test, and schedule or unschedule the send.

Scheduling here sends live email to real contacts.
View endpoints

Account

3 endpoints

Read and update account summary details and list the account's verified email addresses.

Writes here change real account data.
View endpoints

Reporting

6 endpoints

Read campaign summary counts and per-campaign tracking, like who was sent, opened, clicked, bounced, or opted out.

Reads here expose contact-level engagement data.
View endpoints
Endpoint reference

Every Constant Contact API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Contacts

Create, read, update, and delete contacts, and create or update a contact through a sign-up form.6

Read-only. The contact_data scope governs every /contacts endpoint.

Acts oncontact
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts oncontact
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A core write. Creating a contact with an email that already exists returns a 409.

Acts oncontact
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

This is a full replace; omitted fields, including custom field values, are cleared.

Acts oncontact
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Deleting a contact removes any list memberships but does not remove it from the account's billed contact count until purged.

Acts oncontact
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Treats the contact as having opted in through a form, so it can resubscribe a previously unsubscribed contact.

Acts oncontact
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Contact lists

Create, read, update, and delete the lists that contacts belong to.5

Read-only. The contact_data scope governs every /contact_lists endpoint.

Acts oncontact_list
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts oncontact_list
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A list name that already exists returns a 409.

Acts oncontact_list
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A core write.

Acts oncontact_list
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Runs as an asynchronous activity; deleting the list does not delete its contacts.

Acts oncontact_list
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Tags

Create, read, rename, and delete tags, the labels used to group contacts.5

Read-only. A tag is a label used to group contacts.

Acts ontag
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts ontag
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

An account is limited to 500 tags.

Acts ontag
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A core write.

Acts ontag
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Removes the tag from all contacts; the contacts themselves are not deleted.

Acts ontag
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Custom fields

Create, read, update, and delete the custom fields stored on contacts.5

Read-only. The contact_data scope governs every /contact_custom_fields endpoint.

Acts oncustom_field
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts oncustom_field
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

An account is limited to 100 custom fields.

Acts oncustom_field
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A core write.

Acts oncustom_field
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Removes the field's stored value from every contact.

Acts oncustom_field
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Segments

Create, read, update, and delete segments, the saved rules that select contacts.5

Read-only. A segment is a saved rule that selects contacts by criteria like activity, list, or contact details.

Acts onsegment
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts onsegment
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

An account is limited to 100 segments.

Acts onsegment
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Both name and segment_criteria are required even when changing only one.

Acts onsegment
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Deletes the rule, not the contacts it matched.

Acts onsegment
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Bulk activities

Run background jobs that import, export, delete, or list-tag many contacts in one call, and check a job's status.7

Read-only. A job runs asynchronously; poll about once every 30 seconds until it completes.

Acts onactivity
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Accepts up to 500 contacts per call. Returns an activity_id to poll for completion.

Acts onactivity
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Uses a multipart form upload rather than a JSON body. Returns an activity_id to poll.

Acts onactivity
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Selects contacts by contact_ids, list_ids, segment_id, or all_active_contacts.

Acts onactivity
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Removes list membership only; the contacts are not deleted.

Acts onactivity
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Selects contacts to delete by contact_ids, list_ids, or segment_id.

Acts onactivity
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Runs as a write activity even though it reads data, because it creates an export job. The CSV is fetched once the job completes.

Acts onactivity
Permission (capability)contact_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Email campaigns

Create, read, list, rename, and delete email campaigns.5

Read-only. The campaign_data scope governs every /emails endpoint.

Acts onemail_campaign
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts onemail_campaign
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A campaign name that already exists returns a 409.

Acts onemail_campaign
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Changes the campaign name only; the email content is edited through the campaign activity.

Acts onemail_campaign
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

An email that has already been sent cannot be deleted.

Acts onemail_campaign
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Campaign activities

Read and edit a campaign's email content, send a test, and schedule or unschedule the send.6

Read-only. A campaign activity holds the subject, from address, and HTML for one send.

Acts oncampaign_activity
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Only a campaign in draft can be edited; an already scheduled or sent activity cannot.

Acts oncampaign_activity
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Sends real email to the test recipients, but not to the campaign's contact lists.

Acts oncampaign_activity
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

This sends live email to every contact on the campaign's lists once the scheduled time arrives.

Acts oncampaign_activity
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only.

Acts oncampaign_activity
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Only works before the scheduled send time is reached.

Acts oncampaign_activity
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Account

Read and update account summary details and list the account's verified email addresses.3

Read-only. Use the extra_fields parameter to also return physical_address or company_logo.

Acts onaccount
Permission (capability)account_read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Needs the account_update scope, which is separate from the account_read scope used to read account data.

Acts onaccount
Permission (capability)account_update
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only. Only a verified address can be used as a campaign's from or reply-to address.

Acts onaccount_email
Permission (capability)account_read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Reporting

Read campaign summary counts and per-campaign tracking, like who was sent, opened, clicked, bounced, or opted out.6

Read-only. Reporting uses the campaign_data scope and the ui:campaign:metrics user privilege.

Acts onreport
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only; returns contact-level data including email addresses.

Acts onreport
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only; returns contact-level engagement data.

Acts onreport
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only; returns contact-level engagement data.

Acts onreport
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only; returns contact-level data.

Acts onreport
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Read-only; returns contact-level data.

Acts onreport
Permission (capability)campaign_data
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Constant Contact pushes events only to partner integrations, and only for billing and account changes, like a plan being upgraded or an account being created. A regular integration learns about contact and campaign changes by calling the API rather than by receiving a push.

EventWhat it signalsTriggered by
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Constant Contact limits how fast and how much an app or AI agent can call, through a daily request quota and a separate per-second ceiling, both tied to the application's API key.

Request rate

Constant Contact meters requests against the application's API key, not per user. The key allows up to 10,000 requests per day and 4 requests per second, with the daily count resetting at UTC 00:00:00. Going over returns HTTP 429: an error_key of quota_exceeded for the daily limit and throttled for the per-second limit. Bulk activity jobs have their own ceiling, with at most 1,000 queued activities at a time.

Pagination

Collection endpoints are cursor-based. A limit parameter sets the page size, and each response includes a _links object with a next href that carries an opaque cursor; following that link returns the next page until no next link remains. The cursor should be used as given rather than constructed by hand.

Request size

A bulk JSON contact import accepts up to 500 contacts per call, and add_list_memberships takes up to 500 contact_ids or 50 list_ids. The campaign summary report covers up to 500 of the most recent campaigns. An account is capped at 100 custom fields, 100 segments, and 500 tags. A test send goes to at most 5 addresses.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400Bad RequestThe request includes malformed JSON or does not match the expected schema, like a missing required field or a contact_id in an invalid format.Fix the JSON or the field against the schema before resending; do not retry the same body unchanged.
401UnauthorizedThe access token is missing, invalid, or expired. Access tokens last 24 hours.Refresh the access token using the refresh token, then resend with a valid Bearer token.
403ForbiddenThe token lacks the scope the endpoint needs, the user lacks the required privilege, or the application is deactivated. For example, calling a /contacts endpoint without the contact_data scope returns 403.Re-authorize with the right scope, like contact_data or campaign_data, or check the account's user privileges.
404Not FoundThe requested resource does not exist, or the path is misspelled or malformed.Verify the resource id and the request path.
409ConflictA create or update would collide with a name that already exists, like a duplicate list name, campaign name, or account email address.Use a unique name, or update the existing resource instead of creating a new one.
415Unsupported Media TypeThe Content-Type header does not match what the endpoint expects, for example sending a body that is not application/json.Set Content-Type to application/json (or multipart form for file import) to match the endpoint.
429Too Many RequestsA rate limit was hit. The error_key is quota_exceeded for the daily limit and throttled for the per-second limit; the bulk-activity queue is also capped at 1,000 jobs.Slow the request rate below 4 per second, and wait for the daily reset at UTC 00:00 when the daily quota is hit.
500Server ErrorAn unexpected condition on Constant Contact's side. It is rare.Retry after a short delay, and contact support if it persists.
503Service UnavailableThe service is temporarily unavailable.Back off and retry after a delay.
Versioning & freshness

Version history.

Constant Contact runs a single, continuously updated V3 API rather than dated versions. New endpoints and fields ship through monthly release notes without minting a new version string.

Version history

What changed, and when

Latest versionv3
v3Current version
Constant Contact V3 API (current, continuously updated)

The V3 API is the single live API at api.cc.email/v3. It is not versioned by date; new endpoints and fields ship through monthly release notes rather than a new version string. The entries below are notable additions from those release notes, newest first, grouped by period.

What changed
  • April 2026: new social media endpoints for profiles, connections, hashtag groups, and creating posts.
  • March 2026: event management endpoints to create, update, copy, and check in tickets for events.
  • February 2026: endpoint to unsubscribe contacts under a partner's client accounts.
  • December 2025: endpoints to get individual events and event registration collections.
2025 updates
2025 release-note highlights

Additive feature releases during 2025, shipped to the same live V3 API.

What changed
  • September 2025: OAuth login prompt parameter and new custom field data types (datetime, currency, text_area, number, boolean, single_select, multi_select).
  • May 2025: create and manage SMS-only contacts without an email address.
  • February 2025: SMS data import and export in contact bulk activities.
2024 updates
2024 release-note highlights

Additive feature releases during 2024, shipped to the same live V3 API.

What changed
  • November 2024: SMS campaign summary reporting endpoint.
  • August 2024: account physical address creation endpoint.
  • June 2024: JSON contact import with SMS information and expanded list-membership filtering.

There is one live API; track the release notes for new endpoints and fields.

Constant Contact V3 API release notes ↗
Questions

Constant Contact API, answered.

How does authentication work, and how long do tokens last?+
The V3 API uses OAuth 2.0. An app sends the user through an authorization flow, then exchanges the resulting code for an access token that is sent on every call as a Bearer token. Access tokens are valid for 24 hours (1,440 minutes). Requesting the offline_access scope also returns a refresh token, which the app uses to get a new access token without the user re-authorizing.
What OAuth scopes are there, and which endpoints does each cover?+
There are five scopes. contact_data covers /contacts, /contact_lists, /contact_tags, /contact_custom_fields, /segments, and /activities. campaign_data covers /emails and the /reports endpoints. account_read reads /account data and account_update changes it. offline_access returns a refresh token. Scopes are requested space-delimited, and calling an endpoint without its scope returns 403.
What are the rate limits?+
An application's API key is allowed up to 10,000 requests per day and 4 requests per second, with the daily count resetting at UTC 00:00:00. Exceeding either returns HTTP 429, with an error_key of quota_exceeded for the daily cap or throttled for the per-second cap. Bulk activity jobs are separately limited to 1,000 queued at a time.
Does Constant Contact support webhooks?+
Only for partner integrations, and only for billing and account events, such as a plan change or a new account being created. A partner subscribes per topic and receives an HTTP POST when an event fires. There are no webhooks for contact or campaign activity, so a standard integration learns about those changes by calling the API rather than receiving a push.
How do bulk activities work?+
Endpoints under /activities create asynchronous background jobs for importing, exporting, deleting, or list-tagging many contacts at once, up to 500 per import. A create call returns an activity_id, and the job runs in a queue; the app polls GET /v3/activities/{activity_id} about once every 30 seconds until the status shows it has completed. Jobs can take from about 30 seconds to 15 minutes or more.
How does pagination work?+
Collection endpoints are cursor-based. A limit parameter sets the page size, and each response carries a _links object with a next href containing an opaque cursor. The app follows that next link to get the following page, repeating until there is no next link, rather than building page URLs by hand.
How do I send an email campaign through the API?+
Create an email campaign with POST /v3/emails, which also creates its primary campaign activity. Edit that activity's content (subject, from address, HTML) with PUT on /v3/emails/activities/{campaign_activity_id} while it is in draft, optionally send a test, then schedule it with POST on the activity's /schedules endpoint. Scheduling is what sends live email to the campaign's contact lists; DELETE on /schedules unschedules it before it sends.
Related

More marketing API guides for agents

What is Bollard AI?

Control what every AI agent can do in Constant Contact.

Bollard AI sits between a team's AI agents and Constant Contact. Grant each agent exactly the access it needs, read or write, resource by resource, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Constant Contact token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Constant Contact
Email Marketing Agent
Read contacts and lists ResourceOffReadFull use
Schedule and send campaigns ActionOffReadFull use
Draft email campaigns ResourceOffReadFull use
Per-agent access, set in Bollard AI, not in Constant Contact