MailBluster

MARKETING · MARKETING

Leads, custom fields, tags, and products in the account they connected.

Connect MailBluster with Fabriq Developer

Your user pastes their MailBluster credential on a page Agentic Fabriq hosts, so it never reaches your backend and never becomes one shared key across all of your users. Same call as OAuth, one more argument.

from af_sdk import AgenticFabriq

af = AgenticFabriq()                      # reads AF_APP_ID / AF_APP_SECRET

url = await af.initiate_connection(request, provider="mail_bluster", method="api_key")
return redirect(url)                      # an AF-hosted page, not yours

async with await af.for_user(request) as session:
    tools = await session.get_tools()     # only what this user granted

Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.

Connecting MailBluster in practice

MailBluster’s Developer API has no bulk operations at all: "Multiple lead updates are not supported; only single lead additions, updates, and deletions are allowed", and its own guidance for bulk imports is to use the main app instead of the API. The documented limit is 10 requests a second and 100 a minute, so ten a second is only sustainable for ten seconds out of each minute.

Scopes that draw scrutiny

API key (per brand) Generated per MailBluster Brand under Settings. There are no scopes, and because the key is brand-scoped an integration covering several brands holds several full-access keys.

Rate limits

"The default rate limit for MailBluster Developer API is 10 requests/second and 100 requests/minute."
The two interact: the per-minute cap means the per-second allowance is only usable for about ten seconds of each minute.

Worth knowing

There is no batch endpoint. A 50,000-contact sync is 50,000 single-lead calls at 100 a minute, which is why MailBluster points bulk imports at the UI.
Individual leads are addressed by a "lead hash" rather than by email or an ID, so reading or updating one requires obtaining that hash first.
Sending bulk email is not exposed through the Developer API either — campaign sending stays in the application.
The API reference at app.mailbluster.com/api-doc renders through a JavaScript shell, so the endpoint list cannot be read without a browser; the rate limit and integration notes live in the help centre instead.

Checked against API rate limit for MailBluster (2026-09-29), MailBluster integration help (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

mail_bluster_delete_api_fields_by_field_idWRITE

Delete a custom field from this brand -- irreversibly, and wider than it looks: the field's stored value goes with it on EVERY lead in the brand, and MailBluster documents no restore via DELETE /api/fields/{field_id}

api

mail_bluster_delete_api_leads_by_lead_hashWRITE

Delete one lead from this brand -- irreversibly, since MailBluster documents no trash, no soft-delete state and no restore -- addressed by the MD5 hash of its email address via DELETE /api/leads/{lead_hash}

api

mail_bluster_delete_api_orders_by_order_idWRITE

Delete one order and its line items from this brand -- irreversibly, since MailBluster documents no trash and no restore via DELETE /api/orders/{order_id}

api

mail_bluster_delete_api_products_by_product_idWRITE

Delete a product from this brand's catalogue -- irreversibly, since MailBluster documents no trash and no restore via DELETE /api/products/{product_id}

api

mail_bluster_get_api_fieldsREAD

List every custom field defined on this brand -- no parameters, no pagination -- with its display label and its merge tag, which is what tells a caller the keys a lead's `fields` object may carry via GET /api/fields

api

mail_bluster_get_api_leads_by_lead_hashREAD

Read one lead's name, custom field values, timezone, IP address, subscription state, opt-in status and tags, addressed by `lead_hash` -- the MD5 hash of its email address. There is no collection read for leads on this provider, so this is the only way to look one up via GET /api/leads/{lead_hash}

api

mail_bluster_get_api_ordersREAD

List this brand's orders one page at a time with `pageNo` and `perPage` (default 1 and 10), each with its customer lead, its campaign attribution and its line items; the `meta` object carries the total and the page count via GET /api/orders

api

mail_bluster_get_api_orders_by_order_idREAD

Read one order with its customer lead, its campaign attribution and its line items via GET /api/orders/{order_id}

api

mail_bluster_get_api_productsREAD

List this brand's products one page at a time with `pageNo` and `perPage` (default 1 and 10); the `meta` object carries the total, the page count and the neighbouring page numbers via GET /api/products

api

mail_bluster_get_api_products_by_product_idREAD

Read one product from this brand's catalogue by the id it was created with via GET /api/products/{product_id}

api

mail_bluster_post_api_fieldsWRITE

Define a custom field on this brand: a display label and the merge tag that campaigns and lead payloads address the value by via POST /api/fields

api

mail_bluster_post_api_leadsWRITE

Add a subscriber to this brand's list by email address, with an optional name, timezone, IP address, custom field values and tags; `subscribed` sets whether they receive email, `doubleOptIn` sends a confirmation message instead and makes `subscribed` irrelevant, and `overrideExisting` decides whether an address MailBluster already holds is overwritten or refused via POST /api/leads

api

mail_bluster_post_api_ordersWRITE

Record an ecommerce order against a customer's email address -- MailBluster creates the lead when that address is new and reuses the existing one otherwise -- with the order's currency, total price and line items, optionally attributed to a campaign via POST /api/orders

api

mail_bluster_post_api_productsWRITE

Register a product in this brand's ecommerce catalogue under an id YOU supply (MailBluster does not mint one) so that orders can reference it via POST /api/products

api

mail_bluster_put_api_fields_by_field_idWRITE

Change a custom field's display label or its merge tag, both of which MailBluster requires on every update -- a call that sends one and omits the other is refused rather than leaving the other half alone via PUT /api/fields/{field_id}

api

mail_bluster_put_api_leads_by_lead_hashWRITE

Change a lead's name, email address, custom field values, timezone, IP address or subscription state, and attach or detach tags -- `addTags` is applied before `removeTags`. The lead is addressed by `lead_hash`, the MD5 hash of its CURRENT email address via PUT /api/leads/{lead_hash}

api

mail_bluster_put_api_orders_by_order_idWRITE

Change an order's customer, campaign, currency, total price or line items. Every field is optional, but `items` REPLACES the whole line-item list rather than appending to it via PUT /api/orders/{order_id}

api

mail_bluster_put_api_products_by_product_idWRITE

Rename a product in this brand's catalogue. `name` is the only field MailBluster accepts here, and it is required via PUT /api/products/{product_id}

api