First-party app
Maileroo

Maileroo

Send transactional, templated and bulk email, read delivery logs, statistics, domains, suppressions and templates, and run OTP verifications with Maileroo.

stable EmailCommunication

About

Maileroo ships in the w6w first-party pack. It declares 28 actions, 3 health checks, and the host runs its code in a sandbox that never sees the credential.

App id
io.w6w.maileroo
Version
0.1.0
Author
w6w
Licence
MIT
Categories
Email · Communication

Overview

Maileroo is an email delivery platform with an SMTP relay and a REST API. This app sends a transactional email, an email rendered from a dashboard template, or a personalised batch of up to 500, optionally scheduled up to 21 days ahead, and lists or cancels scheduled emails.

It reads the account’s plan and hourly/monthly usage, sending statistics, delivery logs (search by recipient, subject, tags or outcome, fetch the stored raw message, resend it), domains with their DNS-record status and analytics, templates and applications, and manages the suppression list. It also drives Maileroo OTP Verification: send a one-time code by SMS, voice, WhatsApp, Telegram or email, check the code the user enters, and read or cancel verifications.

A connection holds up to two keys, because Maileroo uses two credentials: a Sending Key for the Email API (the sending and scheduled-email actions) and a scoped Account API Key for everything else. Provide the one or both your workflow needs; each action’s description says which.

Health checks report whether both API hosts answer and how much of the plan’s hourly and monthly sending allowance is left.

Build with Maileroo

Three routes to the same 28 actions. The Workflow tab is generated from Maileroo's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.

Cancel Verification

cancel-verification

Cancel a verification that is still pending or sent. A verification already verified, expired, failed or cancelled answers 409. Account API Key (verify.verifications.write).

Check Verification Code

check-verification

Check the code a user entered. `status` is approved, incorrect, expired, failed or cancelled; a wrong code is a normal result, not an error. Each check uses an attempt. Account API Key (verify.verifications.write).

Add Suppression

create-suppression

Add an email address to the suppression list so Maileroo no longer delivers to it. Account API Key (suppressions.write).

Delete Scheduled Email

delete-scheduled-email

Cancel a scheduled email by its reference ID before it is sent. Irreversible. Needs the Sending Key.

Remove Suppression

delete-suppression

Remove an address from the suppression list so it can receive email again. Account API Key (suppressions.delete). A 404 means it was not suppressed.

Get Account

get-account

Read the account overview: identity, plan, hourly/monthly outbound and inbound usage, subscription and billing details. Needs the Account API Key (account.read).

Get Application

get-application

Read one application: SMTP username, authorized domains, IP allowlist, allowed From local parts and recipient domains, outbound IPs and notes. The SMTP password and sending key are deliberately not returned. Account API Key (applications.read).

Get Domain

get-domain

Read one domain with its DNS records (DKIM, SPF, DMARC, MX, tracking) and whether each is in place, its tracking settings and sending statistics. Account API Key (domains.read).

Get Domain Analytics

get-domain-analytics

Aggregate totals, a daily timeline and the top receiving providers for one domain. Account API Key (domains.analytics.read).

Get Stored Email

get-email-log

Fetch the stored raw RFC 822 message for a sent email by its message ID (from Search Email Logs). Account API Key (user_logs.read or domains.logs.read).

Get Sender Profile

get-sender-profile

Read one OTP Verification sender profile. Account API Key (verify.sender_profiles.read).

Get Statistics Summary

get-statistics-summary

Aggregate sending statistics for the current calendar month (delivered, bounced, opens, clicks, suppressions) plus per-country opens and clicks. Account API Key (statistics.read).

Get Statistics Timeline

get-statistics-timeline

Daily sending statistics for the last month, one entry per day, each with aggregate counts and per-country opens and clicks. Account API Key (statistics.read).

Get Template

get-template

Read one template including its HTML and plain-text content. Account API Key (templates.read).

Get Verification

get-verification

Read a verification and its lifecycle status (pending, sent, verified, expired, failed, cancelled). The code is never included. Account API Key (verify.verifications.read).

List Applications

list-applications

List the account's applications (SMTP/API credential sets scoped to domains and IPs) with their counts. SMTP password and sending key are deliberately not returned. Account API Key (applications.read).

List Domains

list-domains

List the account's sending domains with basic delivered / bounced / opened / clicked statistics and DNS verification status. Account API Key (domains.read).

List Scheduled Emails

list-scheduled-emails

List emails scheduled for future delivery, paginated. Needs the Sending Key. A domain-scoped key needs no domain; an application-scoped key must name one.

List Sender Profiles

list-sender-profiles

List OTP Verification sender profiles (name, enabled channels, rate limit). Their IDs feed Send Verification Code. Account API Key (verify.sender_profiles.read).

List Suppressions

list-suppressions

List suppressed email addresses (bounces, complaints, manual entries), paginated and searchable. Account API Key (suppressions.read).

List Templates

list-templates

List email templates (ID, name, type, preview). The ID feeds Send Templated Email and Send Bulk Emails. Account API Key (templates.read).

List Verifications

list-verifications

Search verification history (120 days retained), newest first, by status, channel, profile, destination, country, time range or IDs. Account API Key (verify.verifications.read).

Resend Email

resend-email

Requeue a previously sent email for another delivery attempt; it is reused as-is under a new reference ID. Limited to 1000 resends per 24 hours. Account API Key (user_logs.write).

Search Email Logs

search-email-logs

Search delivery logs (14 days retained) by message, reference ID, subject, sender, recipient, tags, outcome and time range, across the account or one domain. Account API Key (user_logs.read, or domains.logs.read for a domain).

Send Bulk Emails

send-bulk-emails

Send up to 500 personalised emails in one call: a shared subject and body (or template) with per-message recipients and template data. Needs the Sending Key.

Send Email

send-email

Send a transactional email (HTML and/or plain text) through the Maileroo Email API, optionally scheduled up to 21 days ahead. Needs the connection's Sending Key.

Send Templated Email

send-templated-email

Send an email rendered from a Maileroo template with per-send template data. Needs the connection's Sending Key. Find template IDs with List Templates.

Send Verification Code

send-verification

Send a one-time code to a phone number (SMS, voice, WhatsApp, Telegram) or an email address through Maileroo OTP Verification. The code is never returned; check what the user enters with Check Verification Code. Spends prepaid balance. Account API Key (verify.verifications.write).

A workflow step names the app and the action, and the editor fills in the connection when you pick one. This is the Step shape from the workflow spec, carrying Maileroo's real ids.

{
  "manifestVersion": "2",
  "name": "maileroo-example",
  "steps": [
    {
      "id": "check-verification",
      "uses": {
        "app": "io.w6w.maileroo",
        "action": "check-verification",
        "connection": "conn_YOUR_CONNECTION_ID"
      },
      "with": {
        "verificationId": "<verificationId>",
        "code": "<code>"
      }
    }
  ]
}

Here are some of the things you can do

  • Check Verification Code

    perform
    check-verification
  • Add Suppression

    perform
    create-suppression
  • Get Account

    read
    get-account
  • Get Application

    read
    get-application
  • Get Domain

    read
    get-domain

+23 more actions available

Every app-specific value here is a blank you have to fill in. An app action is reached through the connection that authenticates it, so the address is a connection id, not the app id — and connections belong to your account, so a public page cannot know yours. Create one for Maileroo, then fill in the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the parameters that action declares. The call itself is real — the shape is transcribed from the studio's own snippet builder, which prints the same kind of blanks — but nothing in it is specific to Maileroo. The Workflow tab is where this app's real ids are.

Install
npm install @w6w/sdk
yarn add @w6w/sdk
pnpm add @w6w/sdk
deno add npm:@w6w/sdk
Code
import { W6wClient, isActionRun } from "@w6w/sdk";

// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();

const envelope = await client.run({
  urn: "conn_YOUR_CONNECTION_ID",
  action: "check-verification",
  payload: {
    verificationId: "<value>",
    code: "<value>",
  },
});

if (isActionRun(envelope)) console.log(envelope.value);
Install the CLI
npm install -g @w6w/cli
CLI
w6w run conn_YOUR_CONNECTION_ID --action check-verification --payload '{"verificationId":"<value>","code":"<value>"}'

Give an AI agent Maileroo — without giving it Maileroo's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.

One tool call
{
  "name": "w6w_invoke",
  "arguments": {
    "ref": "app:io.w6w.maileroo#check-verification",
    "input": {
      "verificationId": "<verificationId>",
      "code": "<code>"
    }
  }
}

Every tool names its target with a single ref. The app: form above doesn't name a connection at all — the host resolves which of the caller's Maileroo connections to sign with, and refuses rather than guesses when the answer is ambiguous.

What the agent gets

Credentials it can't read

The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.

A tool surface scoped to the caller

Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.

A durable workflow in one call

Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.

Health-aware discovery

Maileroo's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.

The MCP surface is part of the hosted platform. Maileroo itself is MIT, and the runtime that executes it is source-available (FSL).

Request MCP access

Health checks

Maileroo declares its own checks, so its health is a property of the app rather than something the host guesses at.

service

Maileroo platform status

dependency

API reachable

Unauthenticated GET to the Account API and the Email API. Maileroo's own JSON auth-error body passes: it proves the application is answering.

quota

Sending headroom

Hourly and monthly outbound usage vs the plan, from GET /v1/account. Needs the Account API key with account.read.