First-party app
Amazon SES

Amazon SES

Send transactional and templated email, and manage identities, templates, suppression and contacts, in Amazon SES.

stable EmailCommunication

About

Amazon SES ships in the w6w first-party pack. It declares 23 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.

App id
io.w6w.ses
Version
0.1.0
Author
w6w
Licence
MIT
Categories
Email · Communication

Overview

Amazon SES sends a workflow’s email through your own AWS account — a single transactional message, a stored template rendered with per-message data, or a bulk send of one template to up to 50 recipients, each with its own values. Sends can carry a configuration set and message tags so delivery, bounce and complaint events stay attributable to the workflow that caused them.

Beyond sending, the app covers the account state a sender depends on: registering and inspecting verified email and domain identities (including the DKIM records to publish), keeping stored templates in sync, reading and editing the suppression list that stops mail to bounced or complaining addresses, and managing contact lists and their contacts.

Every request is signed locally with AWS Signature Version 4 against the SES v2 API in the region chosen on the connection, so no AWS SDK is needed. Health checks follow AWS’s per-region SES status and the account’s live 24-hour sending quota, so a workflow can see a sandbox limit or a suspended account before the next send fails.

Build with Amazon SES

Three routes to the same 23 actions. The Workflow tab is generated from Amazon SES's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.

Get Account

account-get

Read this region's SES account state: sending quota, production access, enforcement and suppression settings.

List Configuration Sets

configuration-set-list

List the configuration set names in this region, for use in the send actions.

Create Contact

contact-create

Add a contact to a contact list.

Delete Contact

contact-delete

Remove a contact from a contact list.

Get Contact

contact-get

Read one contact in a contact list, with its topic preferences.

List Contact Lists

contact-list-list

List the contact lists in this region.

List Contacts

contact-search

List the contacts in a contact list, optionally only those opted in or out.

Create Identity

identity-create

Register an email address or domain as a sending identity; SES emails a verification link for an address and returns DKIM tokens for a domain.

Delete Identity

identity-delete

Delete a sending identity. Mail from that address or domain stops sending immediately.

Get Identity

identity-get

Read one sending identity: verification status, DKIM tokens, MAIL FROM and feedback-forwarding settings.

List Identities

identity-list

List the email addresses and domains registered as sending identities in this region.

Send Bulk Templated Email

send-bulk-email

Send one stored template to many recipients (up to 50 per call), each with its own replacement data.

Send Email

send-email

Send a simple email (subject plus a text and/or HTML body) through Amazon SES.

Send Templated Email

send-templated-email

Send an email rendered from a stored SES template and a data object.

Remove Suppressed Destination

suppression-delete

Remove an address from the account suppression list.

Get Suppressed Destination

suppression-get

Check whether one address is on the suppression list, and why.

List Suppressed Destinations

suppression-list

List addresses on the account suppression list (bounces and complaints SES will no longer send to).

Add Suppressed Destination

suppression-put

Add an address to the account suppression list so SES stops sending to it.

Create Template

template-create

Create a stored email template with {{placeholder}} substitution.

Delete Template

template-delete

Delete a stored email template.

Get Template

template-get

Read one stored email template, including its subject, HTML and text.

List Templates

template-list

List the email templates stored in this region.

Update Template

template-update

Replace the subject and bodies of an existing template.

A workflow step names the app and the action, and the editor fills in the connection when you pick one. This is the Step shape from the workflow spec, carrying Amazon SES's real ids.

{
  "manifestVersion": "2",
  "name": "ses-example",
  "steps": [
    {
      "id": "contact-create",
      "uses": {
        "app": "io.w6w.ses",
        "action": "contact-create",
        "connection": "conn_YOUR_CONNECTION_ID"
      },
      "with": {
        "contactListName": "<contactListName>",
        "emailAddress": "<emailAddress>"
      }
    }
  ]
}

Here are some of the things you can do

  • Create Contact

    perform
    contact-create
  • Get Account

    read
    account-get
  • List Configuration Sets

    search
    configuration-set-list
  • Get Contact

    read
    contact-get
  • List Contact Lists

    search
    contact-list-list

+18 more actions available

Every app-specific value here is a blank you have to fill in. An app action is reached through the connection that authenticates it, so the address is a connection id, not the app id — and connections belong to your account, so a public page cannot know yours. Create one for Amazon SES, then fill in the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the parameters that action declares. The call itself is real — the shape is transcribed from the studio's own snippet builder, which prints the same kind of blanks — but nothing in it is specific to Amazon SES. The Workflow tab is where this app's real ids are.

Install
npm install @w6w/sdk
yarn add @w6w/sdk
pnpm add @w6w/sdk
deno add npm:@w6w/sdk
Code
import { W6wClient, isActionRun } from "@w6w/sdk";

// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();

const envelope = await client.run({
  urn: "conn_YOUR_CONNECTION_ID",
  action: "contact-create",
  payload: {
    contactListName: "<value>",
    emailAddress: "<value>",
    // topicPreferences: "<value>",
    // unsubscribeAll: "<value>",
    // attributesData: "<value>",
  },
});

if (isActionRun(envelope)) console.log(envelope.value);
Install the CLI
npm install -g @w6w/cli
CLI
w6w run conn_YOUR_CONNECTION_ID --action contact-create --payload '{"contactListName":"<value>","emailAddress":"<value>"}'

Give an AI agent Amazon SES — without giving it Amazon SES's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.

One tool call
{
  "name": "w6w_invoke",
  "arguments": {
    "ref": "app:io.w6w.ses#contact-create",
    "input": {
      "contactListName": "<contactListName>",
      "emailAddress": "<emailAddress>"
    }
  }
}

Every tool names its target with a single ref. The app: form above doesn't name a connection at all — the host resolves which of the caller's Amazon SES connections to sign with, and refuses rather than guesses when the answer is ambiguous.

What the agent gets

Credentials it can't read

The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.

A tool surface scoped to the caller

Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.

A durable workflow in one call

Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.

Health-aware discovery

Amazon SES's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.

The MCP surface is part of the hosted platform. Amazon SES itself is MIT, and the runtime that executes it is source-available (FSL).

Request MCP access

Health checks

Amazon SES declares its own checks, so its health is a property of the app rather than something the host guesses at.

service

Amazon SES platform status

AWS's public Service Health Dashboard current-events feed, filtered to SES's per-region services. Unauthenticated and unsigned.

quota

Sending quota headroom

24-hour send quota and send rate, read from GET /v2/email/account.