API reference

Manage burner domains and site masking, and check blacklist status, straight from your own CRM or automation. Every endpoint below accepts either your dashboard cookie session or an Authorization: Bearer API key — create one under Settings → API keys. A key looks like dm_live_<64 hex characters> and is shown only once, at the moment it is created; Proxamail stores only its hash. Requests without a valid cookie or key get a 401.

List burner domains

GET /api/domains

Returns every burner domain in your organization, most recently added first.

Returns { domains: [...] } — each domain includes fields such as id, fqdn, status, dnsProvider, assignedNameServers and createdAt — see response for details.

curl https://proxamail.com/api/domains \
  -H "Authorization: Bearer dm_live_..."

Add a burner domain

POST /api/domains

Adds an existing domain you own to your burner pool (this is the "bring your own" path — it does not purchase a domain). Body: { fqdn: string }. Rate limited to 30 requests/minute per organization.

Returns { domain: {...} } with status 201. Returns 409 if the domain is already in your pool, and 422 if adding it would exceed your current domain quota (see Billing & plans).

curl -X POST https://proxamail.com/api/domains \
  -H "Authorization: Bearer dm_live_..." \
  -H "Content-Type: application/json" \
  -d '{"fqdn":"brightpath.org"}'

Get a burner domain

GET /api/domains/{id}

Returns a single burner domain by id, scoped to your organization. Returns { domain: {...} }, or 404 if it doesn't exist in your organization.

curl https://proxamail.com/api/domains/3f1b6c2e-...-a1c9 \
  -H "Authorization: Bearer dm_live_..."

Remove a burner domain

DELETE /api/domains/{id}

Removes a domain from your pool. This does not un-register a domain you own — it stays yours at the registrar. Returns { ok: true }, or 404 if it doesn't exist in your organization.

curl -X DELETE https://proxamail.com/api/domains/3f1b6c2e-...-a1c9 \
  -H "Authorization: Bearer dm_live_..."

Get the current ready burner

GET /api/masking/current

Returns the current ready burner hostname for each of your site-mirror connections, so your sending automation can always link to a ready burner instead of hard-coding one that might later be retired. Optional query parameter target (your main domain or its URL) filters to a single connection.

Returns { groups: [{ groupKey, targetBaseUrl, currentHostname, status, standbyCount }] }. status is "degraded" when there is no ready primary burner (add another burner in that case); currentHostname can be null.

curl "https://proxamail.com/api/masking/current?target=yourcompany.com" \
  -H "Authorization: Bearer dm_live_..."

List masking configs

GET /api/masking-configs

Returns your organization's masking configs — see response for details on each field.

curl https://proxamail.com/api/masking-configs \
  -H "Authorization: Bearer dm_live_..."

Create a masking config

POST /api/masking-configs

Creates a config for the legacy "tracking-tool masking" mode described in Site mirror & masking — it is off by default; contact support@proxamail.com if you need it enabled. Body: { sourceHostname, targetProvider: "instantly"|"smartlead"|"apollo"|"custom", targetBaseUrl, domainId }. targetBaseUrl must be a public HTTPS URL, and domainId must reference a burner domain in your pool that already has DNS set up. Rate limited to 20 requests/minute per organization.

Returns { maskingConfig: {...} } with status 201. Returns 400 if tracking-tool masking isn't enabled for your organization, the domain doesn't belong to you, or it has no DNS zone yet; 409 if the source hostname is already in use.

curl -X POST https://proxamail.com/api/masking-configs \
  -H "Authorization: Bearer dm_live_..." \
  -H "Content-Type: application/json" \
  -d '{"sourceHostname":"track.yourbrand.com","targetProvider":"custom","targetBaseUrl":"https://app.yoursender.example","domainId":"3f1b6c2e-...-a1c9"}'

Delete a masking config

DELETE /api/masking-configs/{id}

Deletes the config and releases any reserved capacity it held. Returns { ok: true }, or 404 if it doesn't exist in your organization.

curl -X DELETE https://proxamail.com/api/masking-configs/9a2e7d10-...-4b3f \
  -H "Authorization: Bearer dm_live_..."

Run a blacklist check

POST /api/blacklist/check

Runs an instant check of a domain against all monitored blacklists (see Blacklist monitoring & rotation) and persists the result. Body: { domainId: string }. Rate limited to 30 requests/minute per organization.

Returns { fqdn, listed, listedOn, checked, results: [{ provider, label, status }] }, where each result's status is "listed", "clean", or "unavailable". Returns 404 if the domain doesn't exist in your organization.

curl -X POST https://proxamail.com/api/blacklist/check \
  -H "Authorization: Bearer dm_live_..." \
  -H "Content-Type: application/json" \
  -d '{"domainId":"3f1b6c2e-...-a1c9"}'

Next: Frequently asked questions →