Agentic Fabriq
BigMailer
MARKETING · EMAIL
Brands, contacts, lists and campaigns sent from the account that person connected.
Connecting BigMailer in practice
BigMailer’s binding limit is concurrency rather than throughput: 10 API calls a second per account, but "accounts are limited to making 4 API calls concurrently", and neither figure is raisable without emailing them. Transactional sends are not side-effect free either — the transactional API stores the address and field values it was handed, creating or updating the contact and adding it to the campaign’s list, so a password-reset email silently subscribes someone.
Scopes that draw scrutiny
X-API-KeyOne account-level key, named APIKey in BigMailer’s own OpenAPI security scheme, reaching every brand in the account. Because BigMailer’s human permission model is brand-scoped, the key is strictly more powerful than any non-administrator user.Account administratorBigMailer’s own role wording. Account administrators "can access all brands and all account level settings (billing, users, API keys, etc)", while Brand manager, Campaign manager, Campaign viewer and Template manager are each documented as unable to reach API keys.
Rate limits
- 10 API calls per second per account by default.
- At most 4 API calls concurrently per account. "When either of these limits is exceeded, the API returns the HTTP status 429 Too Many Requests."
- Neither figure is self-service: BigMailer says to contact them "if your application requires more capacity than the default rate limits allow".
Who has to approve
API keys sit in account-level settings, which BigMailer documents as reachable only by the account owner and Account administrators. Four of its six roles — Brand manager, Campaign manager, Campaign viewer and Template manager — are each described as unable to "access account level settings (billing, users, API keys, etc)", so an ordinary marketing user cannot produce a credential.
Worth knowing
- Pagination is cursor-based with a limit "between 1 and 100" and a default of 10, so a large contact sync is a long serial walk against the four-request concurrency cap.
- A transactional send cannot be provisioned by API alone: you need three values from three different screens — an API key, the brand ID from the brand’s settings page, and the campaign ID from the campaign’s "API Settings" tab — so a human has to build the campaign in the console before an integration can send anything.
- field_values and variables look interchangeable and are not: field values are stored on the contact, while variables "are used to fill in merge tags and are then discarded".
- Campaigns pause themselves on thresholds you may never have set: bounce_danger_percent pauses a bulk campaign automatically at that percentage of bounces with a default of 8, and max_soft_bounces defaults to 12. Nearly every resource path is also nested under /brands/{brand_id}/, so brands are a mandatory dimension even for a single-brand customer.
Checked against BigMailer API getting started (2026-09-29), Transactional API (2026-09-29), User types and permissions (2026-09-29), BigMailer API reference (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put BigMailer behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.