# Docs

- Guides: Concepts and how-tos
  - [Introduction](/docs): One API key and one SDK for every communication primitive.
  - [Quickstart](/docs/quickstart): Send your first email with the TypeScript SDK.

  - **Concepts**
  - [Environments and API keys](/docs/environments): Organizations, projects, environments, and the keys that belong to them.
  - [Webhooks](/docs/webhooks): Get told when something happens, instead of polling.
  - [Plans and billing](/docs/billing): How COSS plans, usage credit, volume pricing and invoices work.
  - [Data retention](/docs/data-retention): How long COSS keeps your emails, delivery history and account data, and what happens after.
  - [Logs](/docs/logs): Every API request, email event and webhook attempt of an environment, in one place.
  - [Audit log](/docs/audit-log): Who changed what in your organization, from the dashboard, the API or COSS support.
  - [Log drains](/docs/log-drains): Stream an environment's logs and audit events to your own logging stack.

  - **Email**
  - [Sending email](/docs/email/sending): Addresses, content, headers, tags, categories and safe retries.
  - [Receiving email](/docs/email/receiving): Receive email at COSS's inbound address or your own domain, and read it from a webhook or the API.
  - [Domains](/docs/email/domains): Verify a domain to send live email from it.
  - [Open and click tracking](/docs/email/tracking): Count opens and clicks, and serve tracking links from your own domain.
  - [Delivery status](/docs/email/delivery): How an email and each of its recipients move through delivery.
  - [Suppressions](/docs/email/suppressions): Addresses that sends skip, after a bounce, a complaint or an unsubscribe.

  - **Hooks**
  - [Hooks](/docs/hooks): Webhooks as a service. Send a message once; COSS delivers it to every endpoint your customers registered.
  - [Portal](/docs/hooks/portal): A ready-made page where your customers manage their webhook endpoints.
  - [Receiving messages](/docs/hooks/receiving): What your customers' endpoints receive, and how they verify it. Share this with them.
  - [Delivery, retries and limits](/docs/hooks/delivery): How COSS retries, disables failing endpoints, recovers missed messages, and what it limits.

  - **Risk**
  - [Risk assessments](/docs/risk): Ask COSS whether a sign-up, login or other event looks like abuse, and why.
  - [Reasons and scores](/docs/risk/reasons): Every reason an assessment can give, and how they become a decision.
  - [Rules](/docs/risk/rules): Decide specific cases yourself, like "block sign-ups with a disposable email from a data center".
  - [Settings](/docs/risk/settings): Thresholds, reasons you don't want, and captcha verification for an environment.
  - [Lists, feedback and reviews](/docs/risk/lists-and-feedback): Teach COSS about your users, and work through the review queue.
  - [Testing](/docs/risk/testing): Exercise every decision from a sandbox environment.

  - **TypeScript SDK**
  - [Overview](/docs/sdk): Install the coss package, configure the client and handle results.
  - [Errors and retries](/docs/sdk/errors): The error object, error types, and automatic retries.
  - [Verifying webhooks](/docs/sdk/webhooks): Verify webhook requests with verifyWebhook.
- API Reference: The HTTP API
  - [Overview](/docs/api-reference): Base URL, authentication and conventions of the COSS HTTP API.
  - [Versioning](/docs/api-reference/versioning): Dated API versions, the Coss-Version header and your organization's pinned version.
  - [Changelog](/docs/api-reference/changelog): Every API version and the breaking changes it introduced.
  - [Errors](/docs/api-reference/errors): The error envelope and what each error type means.
  - [Idempotency](/docs/api-reference/idempotency): Retry POST requests without sending twice.

  - **Endpoints**
  - Audit log
    - [Retrieve an audit event](/docs/api-reference/audit-log/get-audit-event)
    - [List audit events](/docs/api-reference/audit-log/list-audit-events): The organization's audit log, newest first: changes made by members in the dashboard, by API keys (from any environment) and by COSS support. The audit log is organization-wide, so every key of the organization reads the same events. Filter by action (an entry ending in `.` matches a whole resource, e.g. `domain.`), actor, target, environment or time. Pass the last `id` as `after` to get the next page while `has_more` is true. Reading the audit log is not itself logged.
  - Billing
    - [Retrieve the organization's billing](/docs/api-reference/billing/get-billing): The organization's plan (and contract), the current billing month's usage and what it would add to the next invoice so far, its standing (`past_due`, billing holds), payment method, and what the plan includes. Organization-wide: every environment's key sees the same. Plan changes are made in the dashboard; subscribe to the `billing.*` webhook events to follow them.
    - [Retrieve an invoice](/docs/api-reference/billing/get-invoice): One invoice with its lines.
    - [List usage](/docs/api-reference/billing/list-billing-usage): Billable usage over a range (the current billing month by default), per meter, dimension and bucket (`hour`, `day` or `month`, UTC), oldest first; with `group_by=environment`, per environment too. Only live environments are billed, so only they appear. Usage counts when it becomes billable (an email when the provider accepts it) and is kept for 400 days.
    - [List credits](/docs/api-reference/billing/list-credits): The organization's credits, newest first: each month's plan credit, prepaid commitments and credits from COSS support (in dollars, or free units of a product), with what's left. Only usable ones by default (`status=all` for every one). Pass the last `id` as `after` to get the next page while `has_more` is true.
    - [List invoices](/docs/api-reference/billing/list-invoices): The organization's invoices, newest first, without their lines. Pass the last `id` as `after` to get the next page while `has_more` is true.
  - Domains
    - [Add a sending domain](/docs/api-reference/domains/create-domain): Claims the domain for the organization and returns the DNS records to publish. Domains belong to the organization, not to one environment, so every API key of the organization sees the same domains. The records are checked repeatedly in the background and verification gives up after 72 hours; until the domain is `verified`, live keys cannot send from it.
    - [Receive email at a domain](/docs/api-reference/domains/create-receiving-domain): Starts receiving email at the domain itself or a subdomain (e.g. `inbound.acme.com`): email sent to any address at that hostname becomes a received email of the API key's environment (an `email.received` webhook, `GET /v1/received_emails`). Publish the MX record in `receiving.record`; COSS checks it in the background. Using the domain itself moves all of its mail to COSS. A domain has at most one receiving hostname: remove it to use another one.
    - [Add a custom tracking domain](/docs/api-reference/domains/create-tracking-domain): Sets up a subdomain of the domain (e.g. `links.acme.com`) to serve open and click tracking. Publish the CNAME record in `tracking.record`; COSS then issues its certificate and checks it in the background, giving up after 72 hours. Open pixels and click redirects of emails sent from the domain (or its subdomains without a domain of their own) use the tracking domain while it is `active`, and the default tracking host otherwise. A domain has at most one tracking domain: remove it to use another hostname.
    - [Remove a sending domain](/docs/api-reference/domains/delete-domain): Removes the domain and its provider identity. Emails already sent are unaffected, but live keys can no longer send from it and the name becomes available again.
    - [Stop receiving email at a domain](/docs/api-reference/domains/delete-receiving-domain): Stops receiving at the domain's receiving hostname: later mail to it is dropped (remove the MX record too). Emails already received stay until their retention ends.
    - [Remove a custom tracking domain](/docs/api-reference/domains/delete-tracking-domain): Removes the domain's tracking domain. Later emails use the default tracking host, but links and open pixels in emails already sent through the tracking domain stop working.
    - [Retrieve a sending domain](/docs/api-reference/domains/get-domain): The domain with the result of the last DNS check, so you can show which records are still missing or mismatched.
    - [List sending domains](/docs/api-reference/domains/list-domains): Every domain of the organization, ordered by name. Domains belong to the organization, not to one environment, so every API key of the organization sees the same domains.
    - [Check a domain's DNS records now](/docs/api-reference/domains/verify-domain): Asks the delivery provider and DNS about the domain immediately instead of waiting for the next background check, and returns the updated domain. A `failed` domain starts verification over with fresh DKIM records, which have to be published again. Its tracking domain, if any, is checked too (and set up again if it `failed`).
  - Emails
    - [Cancel a scheduled email](/docs/api-reference/emails/cancel-email): Cancels an email sent with a future `scheduled_at` before it is sent. Canceling an already canceled email returns it unchanged. To send it at another time, reschedule it instead.
    - [Retrieve an email](/docs/api-reference/emails/get-email): Only emails sent from the API key's own environment can be retrieved.
    - [List an email's delivery events](/docs/api-reference/emails/list-email-events): Every delivery event of the email, oldest first: `email.scheduled`, `email.rescheduled`, `email.canceled`, `email.sent` and `email.failed` for the whole email, and `email.delivered`, `email.delivery_delayed`, `email.bounced`, `email.complained` and `email.suppressed` (skipped because of the suppression list) per recipient, plus `email.opened` and `email.clicked` when tracking is on (attributed to a recipient only when the email had a single one).
    - [List an email's tracked links](/docs/api-reference/emails/list-email-links): The links COSS rewrote for click tracking, in the order they appear in the HTML, with their click counts. Empty unless the email was sent with click tracking.
    - [Reschedule a scheduled email](/docs/api-reference/emails/reschedule-email): Moves an email sent with a future `scheduled_at` to a new time, at most 30 days from now, and records an `email.rescheduled` event. A time that is not in the future sends it within seconds. Rescheduling to the time it already has returns it unchanged. The domain and the suppression list are still checked when it is sent.
    - [Send a batch of emails](/docs/api-reference/emails/send-email-batch): Queues up to 100 emails in one request. Each email is handled exactly as by `POST /v1/emails` (sender checks, suppressions, scheduling, attachments, tracking), but the batch is all or nothing: if any email is invalid, or any `from` is not a verified domain (live keys), nothing is stored and the error names the email (e.g. `emails.3.to`). One `Idempotency-Key` covers the whole batch. The emails' recipients are charged against the send quota together, so a batch with more recipients than the quota allows at once is refused (`quota_exceeded` without `Retry-After`): split it. The request body shares the 40 MB limit of a single send.
    - [Send an email](/docs/api-reference/emails/send-email): Queues an email from the API key's environment and returns it with `status: "queued"`; it is handed to the delivery provider moments later. Follow it with `GET /v1/emails/{id}` or the `email.sent` / `email.failed` webhooks. Live (`coss_live_…`) keys must send from a verified domain of the organization. Sandbox (`coss_test_…`) keys accept any `from` and never deliver anything; the response has `sandbox: true`. Recipients on the environment's suppression list (for every email, or for the email's `category`) are skipped and get the status `suppressed`. With a future `scheduled_at` the email is stored with the status `scheduled` and sent at that time; the domain and the suppression list are checked again then. Attachments are base64-encoded; only metadata is kept after sending. Recipients count against the organization's send quota (per second and per day; sandbox environments have their own daily quota). With open or click tracking on (the environment's settings, or `tracking`), the HTML body is delivered with a tracking pixel and/or links rewritten to COSS redirects; the stored `html` stays as sent.
  - Hooks applications
    - [Create an application](/docs/api-reference/hooks-applications/create-hook-application): Creates an application: one of your customers (or users), who gets their own endpoints and portal. Give it a `uid` (e.g. your customer's id) to address it by in every path. Hooks resources belong to the API key's own environment: a `coss_test_…` key only ever sees sandbox ones, a `coss_live_…` key only production ones.
    - [Delete an application](/docs/api-reference/hooks-applications/delete-hook-application): Deletes the application with its endpoints and portal sessions; pending deliveries stop. Its messages are no longer reachable and are deleted with the rest of their day's data.
    - [Retrieve an application](/docs/api-reference/hooks-applications/get-hook-application): An application of the API key's environment, by its id or uid.
    - [List applications](/docs/api-reference/hooks-applications/list-hook-applications): The environment's applications, newest first. Hooks resources belong to the API key's own environment: a `coss_test_…` key only ever sees sandbox ones, a `coss_live_…` key only production ones.
    - [Update an application](/docs/api-reference/hooks-applications/update-hook-application): Changes the name, uid or metadata. Fields left out keep their value.
  - Hooks endpoints
    - [Create an endpoint](/docs/api-reference/hooks-endpoints/create-hook-endpoint): Registers a URL of the application's user that receives its messages, each request signed (Standard Webhooks) with the endpoint's own secret, returned here. Usually your users add endpoints themselves in the portal. Hooks resources belong to the API key's own environment: a `coss_test_…` key only ever sees sandbox ones, a `coss_live_…` key only production ones.
    - [Delete an endpoint](/docs/api-reference/hooks-endpoints/delete-hook-endpoint): Deletes the endpoint; its pending deliveries fail. Its delivery log stays.
    - [Retrieve a recovery](/docs/api-reference/hooks-endpoints/get-hook-endpoint-recovery): A recovery of the endpoint: `pending` while deliveries are still being requeued.
    - [Retrieve an endpoint's secret](/docs/api-reference/hooks-endpoints/get-hook-endpoint-secret): The endpoint's current signing secret, e.g. to show its user. Needs `hook:update`, like rolling it.
    - [Retrieve an endpoint](/docs/api-reference/hooks-endpoints/get-hook-endpoint): An endpoint of the application.
    - [List an endpoint's deliveries](/docs/api-reference/hooks-endpoints/list-hook-endpoint-deliveries): The endpoint's deliveries, newest first.
    - [List endpoints](/docs/api-reference/hooks-endpoints/list-hook-endpoints): The application's endpoints, oldest first. Secrets are never included.
    - [Recover failed deliveries](/docs/api-reference/hooks-endpoints/recover-hook-endpoint): Queues every delivery to the endpoint that failed, of messages sent since `since`, for one more attempt each, e.g. after its receiver was down. COSS works through them in the background (oldest first); follow `status` with the returned recovery. The endpoint must be enabled.
    - [Roll an endpoint's secret](/docs/api-reference/hooks-endpoints/roll-hook-endpoint-secret): Replaces the signing secret, returned here. Until `previous_secret_expires_at`, requests carry a signature with each secret, so the receiver can switch without rejecting any. Not idempotent.
    - [Send a test message](/docs/api-reference/hooks-endpoints/send-hook-endpoint-test): Sends a message to this endpoint only (whatever its filter), with the given payload or the event type's first example. It counts against the send quota like any message.
    - [Update an endpoint](/docs/api-reference/hooks-endpoints/update-hook-endpoint): Changes the URL, description, filter types, rate limit, metadata or `enabled`. Enabling it again clears a failure streak. The secret stays the same (see roll secret).
  - Hooks event types
    - [Archive an event type](/docs/api-reference/hooks-event-types/archive-hook-event-type): Hides the type from the portal and from new subscriptions. Endpoints already subscribed keep receiving it. Restore it with `PATCH … { archived: false }`.
    - [Create an event type](/docs/api-reference/hooks-event-types/create-hook-event-type): Adds a type to the catalog your applications' users subscribe from (in the portal, or the `filter_types` of an endpoint), with a description, a JSON Schema and examples to show them. Messages can be sent with any type, registered or not. Hooks resources belong to the API key's own environment: a `coss_test_…` key only ever sees sandbox ones, a `coss_live_…` key only production ones.
    - [Retrieve an event type](/docs/api-reference/hooks-event-types/get-hook-event-type): An event type of the API key's environment, archived or not.
    - [List event types](/docs/api-reference/hooks-event-types/list-hook-event-types): The environment's event types by name; archived ones only with `include_archived`.
    - [Update an event type](/docs/api-reference/hooks-event-types/update-hook-event-type): Changes its description, schema or examples, or archives or restores it.
  - Hooks messages
    - [Retrieve a delivery](/docs/api-reference/hooks-messages/get-hook-delivery): One message's delivery to one endpoint.
    - [Retrieve a message](/docs/api-reference/hooks-messages/get-hook-message): A message of the application, with its payload.
    - [List a delivery's attempts](/docs/api-reference/hooks-messages/list-hook-delivery-attempts): Every HTTP request of the delivery, oldest first, with response excerpts.
    - [List a message's deliveries](/docs/api-reference/hooks-messages/list-hook-message-deliveries): One delivery per endpoint the message went to.
    - [List messages](/docs/api-reference/hooks-messages/list-hook-messages): The application's messages, newest first (kept for 30 days).
    - [Retry a delivery](/docs/api-reference/hooks-messages/retry-hook-delivery): Queues a finished delivery for one more attempt within seconds, to the endpoint's current URL and secret. A `pending` delivery is returned unchanged.
    - [Send a message](/docs/api-reference/hooks-messages/send-hook-message): Queues a message to the application: COSS delivers it to each of its enabled endpoints subscribed to `event_type` within seconds, signed with each endpoint's secret, and retries failures with backoff for about a day. Each request's `webhook-id` header is the message's id. Counts against the send quota once per endpoint it goes to (at least once). Live sends are refused while the organization is suspended (`account_suspended`). Hooks resources belong to the API key's own environment: a `coss_test_…` key only ever sees sandbox ones, a `coss_live_…` key only production ones.
  - Hooks portal
    - [Create a portal session](/docs/api-reference/hooks-portal/create-hook-portal-session): Signs the application's user in to the portal, where they add endpoints, pick event types, see deliveries and retry them, without you building any UI. Create one each time the user opens it (from your backend: never expose the API key) and open or embed the returned `url`; embedding needs the site's origin in the environment's portal settings.
  - Log drains
    - [Create a log drain](/docs/api-reference/log-drains/create-log-drain): Streams the environment's logs to a URL: every line `GET /v1/logs` returns (API requests, email events, webhook attempts) and the environment's audit events, posted as signed NDJSON batches of up to 500 lines or 1 MB, usually within seconds. Log drains belong to the API key's own environment: a `coss_test_…` key only ever sees sandbox drains, and a `coss_live_…` key only production ones. The response carries the signing secret, which is returned only here: store it, and verify every batch with it (`verifyLogDrainBatch` in the SDK).
    - [Delete a log drain](/docs/api-reference/log-drains/delete-log-drain): Removes the drain and its batch log. Lines still waiting for it are dropped. To stop it temporarily, set `enabled` to `false` instead.
    - [Retrieve a batch](/docs/api-reference/log-drains/get-log-drain-batch): One batch of the drain, with every HTTP attempt.
    - [Retrieve a log drain](/docs/api-reference/log-drains/get-log-drain): The drain without its signing secret, which is only returned when created.
    - [List a drain's batches](/docs/api-reference/log-drains/list-log-drain-batches): The drain's delivery log, newest first: one batch per NDJSON request, with every HTTP attempt. A failing batch is retried with backoff for about a day (10 attempts); if every attempt fails, the drain is disabled. Pass the last `id` as `after` to get the next page while `has_more` is true.
    - [List log drains](/docs/api-reference/log-drains/list-log-drains): Every drain of the API key's environment, oldest first. Log drains belong to the API key's own environment: a `coss_test_…` key only ever sees sandbox drains, and a `coss_live_…` key only production ones.
    - [Update a log drain](/docs/api-reference/log-drains/update-log-drain): Changes the URL, description, sources or `enabled` flag. Omitted fields keep their current value, and the signing secret stays the same. Disabling a drain drops the lines still waiting for it, and nothing is kept for it while it is disabled; enabling it again (also after COSS disabled it for failing) sends lines logged from then on.
  - Logs
    - [Retrieve a log line](/docs/api-reference/logs/get-log)
    - [List log lines](/docs/api-reference/logs/list-logs): The API key's environment log, newest first: every API request made with one of its keys (`source: api`), every email event (`email`) and every webhook delivery attempt (`webhook`). Filter by time range (an hour by default, at most 31 days), source, level, type, status, method, route, key, request, resource or free text. Pass the last `id` as `after` to get the next page while `has_more` is true. Reading logs is not itself logged.
  - Receiving
    - [Delete a received email](/docs/api-reference/receiving/delete-received-email): Deletes the received email with its raw message and attachments right away, instead of at the end of its retention period.
    - [Retrieve the environment's inbound address](/docs/api-reference/receiving/get-inbound-address): The environment's own domain under COSS's inbound domain: email sent to any address at it (e.g. `support@<domain>`) is received by this environment, with no DNS setup. To receive at your own domain, add a receiving domain instead.
    - [Download an attachment of a received email](/docs/api-reference/receiving/get-received-email-attachment): The attachment's bytes, always as `application/octet-stream` (its declared type is the attachment's `content_type`): treat them as untrusted.
    - [Download a received email's raw message](/docs/api-reference/receiving/get-received-email-raw): The whole message as received (`message/rfc822`), for your own MIME parser or archive.
    - [Retrieve a received email](/docs/api-reference/receiving/get-received-email): The received email with its headers, text and HTML bodies (each cut at 2 MB, see `truncated`) and attachment metadata. HTML is the sender's: sanitize it before showing it to anyone.
    - [List received emails](/docs/api-reference/receiving/list-received-emails): Emails received by the API key's environment, newest first, without their bodies and headers (retrieve one for those). Pass the last `id` as `after` to get the next page while `has_more` is true. An `email.received` webhook announces each one as it arrives.
  - Reputation
    - [Retrieve the organization's sending reputation](/docs/api-reference/reputation/get-reputation): The organization's standing with the COSS reputation guard and the latest rates it measured over live environments. When a rate reaches its suspension threshold, live sending is suspended automatically (`account_suspended`) until COSS support reinstates the organization; sandbox keys keep working. Subscribe to the `account.*` webhook events to be notified of changes.
  - Risk
    - [Assess an event](/docs/api-reference/risk/create-risk-assessment): Assesses a sign-up, login or other event in the API key's environment and returns a decision (`allow`, `review` or `block`) with a score and the reasons behind it. COSS combines email and IP signals with what it has seen in this environment (velocity, accounts sharing a mailbox, identifiers you reported) and your allow and block lists. Signals that are unavailable at the moment are skipped and listed in `degraded`. Call it from your server, never from the browser, and treat errors as `allow` (fail open) so an outage never locks your users out. `review` decisions also fire a `risk.assessment.review` webhook. Sandbox (`coss_test_…`) keys accept documented test addresses (`192.0.2.x`, `@disposable.test`, `@undeliverable.test`).
    - [Report an assessment's outcome](/docs/api-reference/risk/create-risk-feedback): Tells COSS what the assessed user turned out to be. `fraud` and `abuse` make later assessments with the same mailbox, user, IP address or subnet flag it (`history.fraud_*`); `legitimate` takes back what this assessment reported. Resolves an open review. Sending the latest outcome again changes nothing.
    - [Add an allow or block list entry](/docs/api-reference/risk/create-risk-list-entry): Adds an email address (matched by mailbox), domain (with its subdomains), IP address or CIDR range, AS number, country or user id to the environment's allow or block list. An allow-list match makes the decision `allow` whatever else fired; a block-list match makes it `block`. Adding an entry that already exists returns it with status 200.
    - [Create a rule](/docs/api-reference/risk/create-risk-rule): Rules decide after the allow and block lists and before the score thresholds: the first enabled rule (lowest `position`, then oldest) whose conditions match the event sets the decision to its `action`. Conditions test the fields listed in the docs; a field without a value (no IP, no email) never matches. At most 50 rules per environment.
    - [Remove a list entry](/docs/api-reference/risk/delete-risk-list-entry)
    - [Delete a rule](/docs/api-reference/risk/delete-risk-rule)
    - [Forget a user](/docs/api-reference/risk/forget-risk-user): Call this when you delete one of your users: COSS deletes what identifies them in the environment (their mailbox, fraud reports, and the user id, email address, IP address and user agent on their assessments). Decisions and reasons stay. Forgetting a user COSS doesn't know succeeds too.
    - [Retrieve an assessment](/docs/api-reference/risk/get-risk-assessment): The email address and IP address are removed 90 days after the assessment; the decision, reasons and signals stay for a year.
    - [Retrieve a list entry](/docs/api-reference/risk/get-risk-list-entry)
    - [Retrieve a rule](/docs/api-reference/risk/get-risk-rule)
    - [Retrieve the risk settings](/docs/api-reference/risk/get-risk-settings): The API key's environment's decision thresholds, disabled reasons and captcha provider (never its secret).
    - [List assessments](/docs/api-reference/risk/list-risk-assessments): The assessments of the API key's environment, newest first. `review_status=open` is the review queue. Pass the last `id` as `after` to get the next page while `has_more` is true.
    - [List allow and block list entries](/docs/api-reference/risk/list-risk-list-entries): The environment's list entries, newest first. Pass the last `id` as `after` to get the next page while `has_more` is true.
    - [List rules](/docs/api-reference/risk/list-risk-rules): Every rule of the API key's environment, in evaluation order.
    - [Update a rule](/docs/api-reference/risk/update-risk-rule): Changes the fields given; `conditions` replaces the whole list.
    - [Update the risk settings](/docs/api-reference/risk/update-risk-settings): Changes the fields given. `review_threshold` must not exceed `block_threshold`. Disabled reasons never fire (rules still see the facts behind them). Setting a captcha provider makes assessments verify their `captcha.token` with it; `required` adds `captcha.missing` to assessments without one.
  - Suppressions
    - [Check whether an address is suppressed](/docs/api-reference/suppressions/check-suppression): Whether a send to `address` (with `category`, if given) would skip it, and the entries that match: those with scope `*` and, with a `category`, those for that category.
    - [Add an address to the suppression list](/docs/api-reference/suppressions/create-suppression): Suppresses an address in the API key's environment: later sends skip it, either for every email (`scope: "*"`, the default) or only for emails with the given `category` (e.g. to back an unsubscribe link). Adding an address that is already suppressed with the same scope returns the existing entry with status 200.
    - [Remove a suppression](/docs/api-reference/suppressions/delete-suppression): Removes the entry, so later sends reach the address again (unless another entry still matches). Entries added for bounces and complaints can be removed too.
    - [Export the suppression list as CSV](/docs/api-reference/suppressions/export-suppressions): The whole suppression list of the API key's environment (optionally filtered), oldest first, as CSV with the columns `address,scope,reason,created_at,email_id,id`. The file can be imported again as is. Values a spreadsheet would run as a formula are prefixed with `'`.
    - [Retrieve a suppression](/docs/api-reference/suppressions/get-suppression)
    - [Import suppressions in bulk](/docs/api-reference/suppressions/import-suppressions): Adds up to 1000 entries at once, with reason `import`. Each entry is validated on its own: invalid ones are skipped and listed in `invalid`, entries already on the list are left unchanged and counted in `existing`. Importing again is safe.
    - [List suppressed addresses](/docs/api-reference/suppressions/list-suppressions): The suppression list of the API key's environment, newest first. Pass the last `id` as `after` to get the next page while `has_more` is true.
  - Tracking
    - [Remove a category's tracking rule](/docs/api-reference/tracking/delete-tracking-category): Removes the rule: emails of this category follow the environment default again. Settings belong to the API key's own environment: a `coss_test_…` key only ever changes sandbox settings. Emails keep the settings that applied when they were sent.
    - [Remove the tracking default](/docs/api-reference/tracking/delete-tracking-default): Removes the environment default: emails without a rule for their category are then not tracked unless the send asks. Settings belong to the API key's own environment: a `coss_test_…` key only ever changes sandbox settings. Emails keep the settings that applied when they were sent.
    - [Retrieve tracking settings](/docs/api-reference/tracking/get-tracking-settings): The environment's open and click tracking default and its category rules. For each of `opens` and `clicks`, a send's own `tracking` wins, then the rule for its `category`, then the default, then off. Settings belong to the API key's own environment: a `coss_test_…` key only ever changes sandbox settings. Emails keep the settings that applied when they were sent.
    - [Update a category's tracking rule](/docs/api-reference/tracking/update-tracking-category): Sets the rule for emails sent with this `category`, which wins over the environment default, e.g. to track `marketing` but never `password-reset`. Fields left out keep their value; a new rule is created with them off. Settings belong to the API key's own environment: a `coss_test_…` key only ever changes sandbox settings. Emails keep the settings that applied when they were sent.
    - [Update the tracking default](/docs/api-reference/tracking/update-tracking-default): Sets the environment default, which applies to emails without a rule for their category. Fields left out keep their value; if there is no default yet, it is created with them off. Settings belong to the API key's own environment: a `coss_test_…` key only ever changes sandbox settings. Emails keep the settings that applied when they were sent.
  - Webhook endpoints
    - [Create a webhook endpoint](/docs/api-reference/webhook-endpoints/create-webhook-endpoint): Registers a URL that receives signed event notifications. Webhook endpoints belong to the API key's own environment: a `coss_test_…` key only ever sees sandbox endpoints, and a `coss_live_…` key only production ones. The response carries the signing secret, which is returned only here and when it is rolled: store it, and verify every delivery with it (`verifyWebhook` in the SDK).
    - [Delete a webhook endpoint](/docs/api-reference/webhook-endpoints/delete-webhook-endpoint): Removes the endpoint and its delivery log. Deliveries already queued for it are dropped. To stop deliveries temporarily, set `enabled` to `false` instead.
    - [Retrieve a delivery](/docs/api-reference/webhook-endpoints/get-webhook-delivery): One delivery of the endpoint, with every HTTP attempt and the payload as sent.
    - [Retrieve a webhook endpoint](/docs/api-reference/webhook-endpoints/get-webhook-endpoint): The endpoint without its signing secret, which is only returned when created or rolled.
    - [List an endpoint's deliveries](/docs/api-reference/webhook-endpoints/list-webhook-deliveries): The endpoint's delivery log, newest first: one delivery per event sent to it, with every HTTP attempt and the payload as sent. Pass the last `id` as `after` to get the next page while `has_more` is true. Deleting the endpoint deletes its log.
    - [List webhook endpoints](/docs/api-reference/webhook-endpoints/list-webhook-endpoints): Every endpoint of the API key's environment, oldest first. Webhook endpoints belong to the API key's own environment: a `coss_test_…` key only ever sees sandbox endpoints, and a `coss_live_…` key only production ones.
    - [Recover failed deliveries](/docs/api-reference/webhook-endpoints/recover-webhook-endpoint): Queues the endpoint's deliveries that `failed` since `since` for one more attempt each, oldest first, spread over the next minute, e.g. after fixing a receiver that was down. At most 1000 per call: while `has_more` is `true`, call again with the same `since`. The endpoint must be enabled.
    - [Retry a delivery](/docs/api-reference/webhook-endpoints/retry-webhook-delivery): Queues a finished delivery (`succeeded` or `failed`) for one more attempt, made within seconds, signed with the endpoint's current secret and sent to its current URL. A delivery that is still `pending` is returned unchanged: it is already scheduled for `next_attempt_at` (automatic retries stop after 8 attempts).
    - [Roll a signing secret](/docs/api-reference/webhook-endpoints/roll-webhook-endpoint-secret): Replaces the endpoint's signing secret with a new one, returned in the response (the only time it is). Until `previous_secret_expires_at`, every delivery is signed with both secrets (`webhook-signature` lists two signatures), so receivers verifying with either one accept it: deploy the new secret, then let the old one expire. Rolling again in that time stops the older secret at once. Not idempotent: after a lost response, roll again.
    - [Update a webhook endpoint](/docs/api-reference/webhook-endpoints/update-webhook-endpoint): Changes the URL, description, subscribed event types, API version or `enabled` flag. Omitted fields keep their current value, and the signing secret stays the same (see Roll a signing secret), so receivers keep verifying deliveries. Disabling an endpoint stops deliveries without losing its configuration.