Moosend
MARKETING · MARKETING
Mailing lists, subscribers, segments, and campaigns in the account they connected.
Connecting Moosend in practice
Moosend rate-limits per endpoint rather than per account, and the bulk variants are tighter than the single-record ones: adding subscribers one at a time allows ten calls per ten seconds while subscribe-many allows two, and deleting one at a time allows forty while delete_many allows eight. Batching therefore reduces throughput here, which is the opposite of the assumption most integrations are built on.
Scopes that draw scrutiny
API key (account-wide)One key per account, found under More > Settings > API key, with a Generate new API key button to rotate it. There is no scoped or read-only form.
Rate limits
- Campaign statistics, GET /campaigns/{id}/stats/{Type}: 2 calls per 60 seconds — the tightest limit in the API.
- Add subscriber, POST /subscribers/{listId}/subscribe: 10 calls per 10 seconds. Add many, subscribe-many: 2 calls per 10 seconds.
- Delete subscriber: 40 calls per 10 seconds. Delete many, delete_many: 8 calls per 10 seconds.
- Unsubscribe from an account, a list, or a list and campaign: 20 calls per 10 seconds each.
- Send a transactional campaign, POST /campaigns/transactional/send: 6 calls per second.
- Over the limit the body carries {"Code": 429, "Error": "RATE-LIMITING"}.
Worth knowing
- Only account owners and admins can see the API key. Moosend states that other permission levels "will see all 0’s in place of the key", so a non-admin copies zeros and the integration fails looking like a bad credential rather than a permissions problem.
- Limits are per API key, so a second integration on the same account competes for the same per-endpoint budgets.
- Campaign statistics at two calls a minute rules out any design that polls for delivery results.
Checked against API rate limiting (2026-09-29), Authenticate a Moosend API request (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Moosend behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.