Skip to content
Agentic FabriqGet a demo
All integrations

UniOne

MESSAGING · MESSAGING

Transactional email sends, templates, suppressions, and sending domains on their key.

Connect UniOne with Fabriq Developer

Your user pastes their UniOne credential on a page Agentic Fabriq hosts, so it never reaches your backend and never becomes one shared key across all of your users. Same call as OAuth, one more argument.

from af_sdk import AgenticFabriq

af = AgenticFabriq()                      # reads AF_APP_ID / AF_APP_SECRET

url = await af.initiate_connection(request, provider="unione", method="api_key")
return redirect(url)                      # an AF-hosted page, not yours

async with await af.for_user(request) as session:
    tools = await session.get_tools()     # only what this user granted

Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.

Connecting UniOne in practice

UniOne pins a request to 10 MB and 500 recipients, and its email validation path is separately capped at two concurrent requests with a five-second server response limit, so validating a list is inherently serial. The base URL also pins the data region — api., eu1. and us1.unione.io are three different hosts, not one endpoint with a parameter.

Scopes that draw scrutiny

  • X-API-KEY header (or the api_key JSON field) UniOne accepts the key either way, which means it can end up in a logged request body as well as a header.
  • user API key Taken from account settings and valid across the account’s projects, so it is the wider of the two key types.
  • project API key Taken from the Projects page and scoped to one project. The narrower choice for an agent, and the one to ask for.

Rate limits

  • Maximum request size: 10 MB. Over it returns 413.
  • Up to 500 recipients per email request.
  • Email validation: maximum 2 concurrent requests, with a 5-second server response limit.
  • Over the rate limit returns 429 Too Many Requests, with the instruction to slow the request rate.

Worth knowing

  • The three base URLs are regional; picking one decides where the data is processed, so it is a compliance choice rather than a latency one.
  • 413 for an oversized request and 429 for too many requests are different failures with different fixes — split the batch, or slow down — and code that retries both identically will loop on the first.
  • 403 Forbidden means insufficient rights on a valid key, distinct from 401 for a bad key, so permission problems and credential problems are distinguishable if you check.
  • Two concurrent validation requests with a five-second ceiling each means list hygiene runs at roughly 24 addresses a minute in the worst case.

Checked against UniOne Web API reference (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

unione_post_domain_delete_jsonWRITE

Delete a sending domain. Permanently removes one sending domain from the account, after which no address at that domain can send until it is added and verified again. (POST https://api.unione.io/en/transactional/api/v1/domain/delete.json)

api
unione_post_domain_get_dns_records_jsonWRITE

Add a sending domain and return its DNS records. Returns the SPF, DKIM, ownership-verification, DMARC and link-tracking records to publish for a sending domain -- and ADDS the domain to the account if it is not there yet, which is why this is a write rather than a read. UniOne refuses a public free-mail domain (code 1103) and a domain its resolver cannot see (code 1101); both measured 2026-09-16. (POST https://api.unione.io/en/transactional/api/v1/domain/get-dns-records.json)

api
unione_post_domain_list_jsonREAD

List sending domains. Returns the account's sending domains with their SPF, DKIM, verification and DMARC state, optionally filtered to one domain and paginated with limit and offset. An account with none answers 200 and an empty list. (POST https://api.unione.io/en/transactional/api/v1/domain/list.json)

api
unione_post_domain_validate_dkim_jsonWRITE

Validate a sending domain's DKIM record. Asks UniOne to re-check the published DKIM record for a domain and record the result. Answers 400 code 1401 for a domain the resolver cannot see. (POST https://api.unione.io/en/transactional/api/v1/domain/validate-dkim.json)

api
unione_post_domain_validate_verification_record_jsonWRITE

Validate a sending domain's ownership record. Asks UniOne to re-check the ownership TXT record for a domain and record the result, which is what moves the domain towards 'verified'. Answers 400 code 1201 for a domain the resolver cannot see. (POST https://api.unione.io/en/transactional/api/v1/domain/validate-verification-record.json)

api
unione_post_email_send_jsonWRITE

Send an email. Queues one message for up to 500 recipients in a single call, from an inline body (HTML, plaintext and/or AMP) or a stored template, with per-recipient substitutions, attachments, tags, metadata and scheduling. Returns a job_id that identifies the send in statistics and event dumps. REQUIRES A CONFIRMED SENDING DOMAIN: the from_email's domain must be added to the account and verified (SPF, DKIM, ownership) first, or UniOne answers HTTP 400 naming the from_email field -- code 1574 'use address from a confirmed domain' for email/send, code 1003 'You don't have checked domain' for email/subscribe (both measured 2026-09-16 on an account with zero domains). Add the domain with domain/get-dns-records, publish the records UniOne returns, then domain/validate-verification-record and domain/validate-dkim. (POST https://api.unione.io/en/transactional/api/v1/email/send.json)

api
unione_post_email_subscribe_jsonWRITE

Send a subscription confirmation request. Sends a double opt-in confirmation email to one address, using UniOne's own confirmation template or a stored one, so the recipient's consent is recorded before any campaign reaches them. REQUIRES A CONFIRMED SENDING DOMAIN: the from_email's domain must be added to the account and verified (SPF, DKIM, ownership) first, or UniOne answers HTTP 400 naming the from_email field -- code 1574 'use address from a confirmed domain' for email/send, code 1003 'You don't have checked domain' for email/subscribe (both measured 2026-09-16 on an account with zero domains). Add the domain with domain/get-dns-records, publish the records UniOne returns, then domain/validate-verification-record and domain/validate-dkim. (POST https://api.unione.io/en/transactional/api/v1/email/subscribe.json)

api
unione_post_email_validation_single_jsonWRITE

Validate one email address. Checks a single address for syntax, MX presence, disposable and role-account patterns and likely typos, returning a result (valid/invalid/unknown), a validity score and a did_you_mean suggestion. CONSUMES the account's email-validation quota (system/info reports validations_included and validations_used). (POST https://api.unione.io/en/transactional/api/v1/email-validation/single.json)

api
unione_post_event_dump_create_jsonWRITE

Create an event dump. Starts an asynchronous export of delivery events for a time window, optionally filtered (by job, campaign, recipient, sender, status or tag) and aggregated. Returns a dump_id; poll event-dump/get for the file URLs. The format is 'csv' or 'csv_gzip' -- 'json' is refused with code 3304 (measured 2026-09-16). Events are retained for up to 32 days, depending on tariff. (POST https://api.unione.io/en/transactional/api/v1/event-dump/create.json)

api
unione_post_event_dump_delete_jsonWRITE

Delete an event dump. Permanently removes one export and its generated files by dump_id. (POST https://api.unione.io/en/transactional/api/v1/event-dump/delete.json)

api
unione_post_event_dump_get_jsonREAD

Get an event dump. Returns one export's status (in_process, ready or failed) and, once ready, the temporary URLs of its files. The URLs are time-limited. (POST https://api.unione.io/en/transactional/api/v1/event-dump/get.json)

api
unione_post_event_dump_list_jsonREAD

List event dumps. Returns every export currently held for the account, with each one's status and files. (POST https://api.unione.io/en/transactional/api/v1/event-dump/list.json)

api
unione_post_project_create_jsonWRITE

Create a project. Creates a UniOne project -- the per-tenant isolation unit, with its own API key, domains, templates, suppression lists and statistics -- and returns its id and key. ACCOUNT GATE, not a defect: UniOne disables Projects by default -- 'By default, access to this page and methods is disabled for security reasons. To enable projects functionality, please contact our support team.' -- and every project/* method answers HTTP 403 {"code":403,"message":"Access Denied."} until support enables it (measured 2026-09-16). This is an account provisioning gate and applies to any UniOne credential, so ask UniOne support to enable Projects rather than reconnecting. (POST https://api.unione.io/en/transactional/api/v1/project/create.json)

api
unione_post_project_delete_jsonWRITE

Delete a project. Permanently removes one project, named by project_id or project_api_key, along with the isolation its key provided. ACCOUNT GATE, not a defect: UniOne disables Projects by default -- 'By default, access to this page and methods is disabled for security reasons. To enable projects functionality, please contact our support team.' -- and every project/* method answers HTTP 403 {"code":403,"message":"Access Denied."} until support enables it (measured 2026-09-16). This is an account provisioning gate and applies to any UniOne credential, so ask UniOne support to enable Projects rather than reconnecting. (POST https://api.unione.io/en/transactional/api/v1/project/delete.json)

api
unione_post_project_list_jsonREAD

List projects. Returns the account's projects with their ids, names and API keys, or one project when project_id or project_api_key is given. ACCOUNT GATE, not a defect: UniOne disables Projects by default -- 'By default, access to this page and methods is disabled for security reasons. To enable projects functionality, please contact our support team.' -- and every project/* method answers HTTP 403 {"code":403,"message":"Access Denied."} until support enables it (measured 2026-09-16). This is an account provisioning gate and applies to any UniOne credential, so ask UniOne support to enable Projects rather than reconnecting. (POST https://api.unione.io/en/transactional/api/v1/project/list.json)

api
unione_post_project_update_jsonWRITE

Update a project. Renames a project or changes its settings, naming it by project_id or by its project_api_key. ACCOUNT GATE, not a defect: UniOne disables Projects by default -- 'By default, access to this page and methods is disabled for security reasons. To enable projects functionality, please contact our support team.' -- and every project/* method answers HTTP 403 {"code":403,"message":"Access Denied."} until support enables it (measured 2026-09-16). This is an account provisioning gate and applies to any UniOne credential, so ask UniOne support to enable Projects rather than reconnecting. (POST https://api.unione.io/en/transactional/api/v1/project/update.json)

api
unione_post_suppression_delete_jsonWRITE

Delete a suppression. Removes the suppressions this account created for one address. UniOne's own bounce-derived suppressions are marked is_deletable false and are not removed by this call. (POST https://api.unione.io/en/transactional/api/v1/suppression/delete.json)

api
unione_post_suppression_get_jsonREAD

Get an address's suppressions. Returns every suppression recorded for one address, each with its cause, source (user or UniOne's own bounce handling) and whether it is deletable. An address with none answers 200 and an empty list. (POST https://api.unione.io/en/transactional/api/v1/suppression/get.json)

api
unione_post_suppression_list_jsonREAD

List suppressions. Returns the account's suppressions, filterable by cause, source and start_time, and paginated with a cursor rather than an offset. (POST https://api.unione.io/en/transactional/api/v1/suppression/list.json)

api
unione_post_suppression_set_jsonWRITE

Add a suppression. Suppresses one address for a stated cause (unsubscribed, temporary or permanently unavailable, complained), so UniOne stops attempting delivery to it. Distinct from the unsubscribe list: a suppression created here can be removed again with suppression/delete. (POST https://api.unione.io/en/transactional/api/v1/suppression/set.json)

api
unione_post_system_info_jsonREAD

Get account information. Returns the account's user id, email and current billing period, with the emails and validations included and used in it -- the cheapest way to see what quota a connection still has. (POST https://api.unione.io/en/transactional/api/v1/system/info.json)

api
unione_post_system_ping_jsonREAD

Check the API key. UniOne's own credential check: 'This method checks API key validity and returns user ID'. Answers 200 {"status":"success","user_id":N} for a working key and 401 code 114 'user not found' for a bad one, or for a good key sent to the wrong regional host. This is the endpoint the paste-time probe uses. (POST https://api.unione.io/en/transactional/api/v1/system/ping.json)

api
unione_post_tag_delete_jsonWRITE

Delete a tag. Permanently removes one tag by its numeric id. Answers 400 code 3703 naming the id when no such tag exists (measured 2026-09-16). (POST https://api.unione.io/en/transactional/api/v1/tag/delete.json)

api
unione_post_tag_list_jsonREAD

List tags. Returns the tags the account has used on sends, with their numeric ids -- which is where the tag_id that tag/delete takes comes from. (POST https://api.unione.io/en/transactional/api/v1/tag/list.json)

api
unione_post_template_delete_jsonWRITE

Delete a template. Permanently removes one stored template by id. Any send that names the deleted template id afterwards fails. (POST https://api.unione.io/en/transactional/api/v1/template/delete.json)

api
unione_post_template_get_jsonREAD

Get a template. Returns one stored template by id, including its body parts, sender, attachments, global substitutions and creation time. (POST https://api.unione.io/en/transactional/api/v1/template/get.json)

api
unione_post_template_list_jsonREAD

List templates. Returns the account's stored templates, newest first, with their full bodies. Paginated with limit (1-100) and offset. (POST https://api.unione.io/en/transactional/api/v1/template/list.json)

api
unione_post_template_set_jsonWRITE

Create or update a template. Stores a reusable message template -- subject, HTML/plaintext/AMP body, sender, attachments and global substitutions -- and returns its id. Passing an existing template id UPDATES that template in place rather than creating a second one, so omit the id to create. (POST https://api.unione.io/en/transactional/api/v1/template/set.json)

api
unione_post_unsubscribed_check_jsonREAD

Check whether an address is unsubscribed. Answers is_unsubscribed for one address without changing anything. Use this before a send rather than inferring the answer from a failure. (POST https://api.unione.io/en/transactional/api/v1/unsubscribed/check.json)

api
unione_post_unsubscribed_list_jsonREAD

List unsubscribed addresses. Returns the account's unsubscribe list with the time each address was unsubscribed, optionally from a date_from cutoff. (POST https://api.unione.io/en/transactional/api/v1/unsubscribed/list.json)

api
unione_post_unsubscribed_set_jsonWRITE

Unsubscribe an address. Adds one address to the account's unsubscribe list, after which UniOne refuses to send to it. IRREVERSIBLE THROUGH THIS API: UniOne's Web API publishes no method that removes an address from the unsubscribe list (only set, check and list exist), so an entry added here can be undone only from the UniOne dashboard, if at all. (POST https://api.unione.io/en/transactional/api/v1/unsubscribed/set.json)

api
unione_post_webhook_delete_jsonWRITE

Delete a webhook. Permanently removes one registered webhook, named by its url. UniOne stops posting events to it immediately. (POST https://api.unione.io/en/transactional/api/v1/webhook/delete.json)

api
unione_post_webhook_get_jsonREAD

Get a webhook. Returns one registered webhook by its url, with its event selection, delivery format, parallelism and status. (POST https://api.unione.io/en/transactional/api/v1/webhook/get.json)

api
unione_post_webhook_list_jsonREAD

List webhooks. Returns every webhook registered on the account, paginated with limit and offset. (POST https://api.unione.io/en/transactional/api/v1/webhook/list.json)

api
unione_post_webhook_set_jsonWRITE

Create or update a webhook. Registers the URL UniOne posts delivery and status events to, and which events it sends (email_status, unsubscribed, spam, and the per-status selections beneath them). The URL is the webhook's IDENTITY: calling this again with the same url updates that webhook rather than adding a second one. (POST https://api.unione.io/en/transactional/api/v1/webhook/set.json)

api

Put UniOne behind one governed endpoint.

Same permissions, same audit trail, whatever else you connect next.