API docs

Import in Postman

Click Download Postman collection (JSON file).
Open Postman → Import → drop the file (or File → Import).
Select the collection → Variables:
- baseUrl — this server: https://email.kartmax.in
- emailApiKey — that website’s Email API key (from admin Websites, shown once on add/regenerate)
Open Send email → Send.

Collection auth is Bearer {{emailApiKey}}. You do not set SMTP / SES passwords in Postman — the key already maps to that website’s SMTP.

How the key works

Each website has one Email API key. The calling app sends that key as a Bearer token. The service loads that website, then uses its SMTP from / reply-to.

Add the website under Websites (SMTP host, username, password, from, reply-to, from name).
Copy the key shown once after save. It will not be shown again — use Regenerate if lost.
Call POST /v1/send with Authorization: Bearer <key>.

Dummy local key for williampenn.com: wp_live_dummy_william_penn_key_001xxxxxxxxxxxx

Endpoint

POST https://email.kartmax.in/v1/send

Header	Value
Authorization	Bearer <website Email API key>
Content-Type	application/json
X-Application-Name	Optional. Stored on the log (e.g. Kartmax, checkout, Postman).

Request body

JSON

{
  "website": "williampenn.com",
  "from": "[email protected]",
  "to": ["[email protected]"],
  "cc": ["[email protected]"],
  "bcc": ["[email protected]"],
  "subject": "Order Confirmation",
  "body": "Thank you
Order #12345",
  "body_type": "html",
  "reply_to": "[email protected]",
  "attachments": [
    {
      "filename": "invoice-12345.pdf",
      "content_type": "application/pdf",
      "content": "",
      "disposition": "attachment"
    }
  ]
}

Field	Required	Notes
to	Yes	Array of emails, 1–50
subject, body	Yes	Spam-scored with attachments
cc, bcc	No	Arrays of emails, max 50 each
from, reply_to	No	Defaults to website SMTP from / reply-to. From must match the site domain.
website	No	If sent, must match the key or the API returns success false
body_type	No	`html` (default) or `text`
attachments	No	Max 10. `content` is Base64. Inline images use `disposition: inline` + `content_id`.

Success response

{
  "success": true,
  "message": "Email queued for sending",
  "spam_score": 8
}

Every response is only these three fields. A success means the request was accepted and queued — SMTP runs in a background job. Check Email logs for queued, then sent or failed. Failures before queue (auth, validation, spam block) use success: false.

Error response

{
  "success": false,
  "message": "Invalid API credentials",
  "spam_score": 0
}

HTTP	Message
401	Invalid API credentials
403	Website does not match the Email API key
422	From email is not allowed for this website
422	Attachment type is not allowed
422	Email blocked by website spam policy (`spam_score` is the actual score). See the spam scoring note below.
422	Validation, e.g. The to field is required.

Spam scoring and block

How spam score and block work

Before SMTP, the service scores subject + body + attachment filenames from 0–100 (capped). Score is always stored on the log. Block happens only if Spam check and Block when over threshold are both on, and score is ≥ this website’s threshold (default 70). Then the API returns 422 and status is blocked_spam. If check is on but block is off, the mail still sends and the log is flagged. If check is off, score is stored as none and nothing is blocked.

What is checked	Points
Subject is ALL CAPS (more than 8 characters)	15
Subject has 3 or more `!`	10
Subject spam phrases: `free`, `winner`, `urgent`, `act now`, `limited offer`, `click here`, `congratulations`	20 each, max 40
Same phrases in the body	10 each, max 30
More than 5 `http://` or `https://` links in the body	15
Attachment filename ends with `.exe`, `.bat`, `.js`, `.vbs`, `.scr`	100
Double extension, e.g. `invoice.pdf.exe`	40
Attachment name contains a spam phrase (spaces as `_`)	15

Executable types are also rejected earlier as “Attachment type is not allowed”, before spam scoring. This is a local content score — not Gmail/Outlook inbox spam.

cURL

Example

curl -X POST https://email.kartmax.in/v1/send \
  -H "Authorization: Bearer wp_live_dummy_william_penn_key_001xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -H "X-Application-Name: Postman" \
  -d "{\"from\":\"[email protected]\",\"to\":[\"[email protected]\"],\"cc\":[\"[email protected]\"],\"subject\":\"Order Confirmation\",\"body\":\"<p>Hi</p>\"}"