---
title: "Subscribe a contact to a list"
method: POST
path: "/v1/projectId/{projectId}/subscriber-lists/{id}/subscribers"
tags: ["Subscriber Lists"]
---

# Subscribe a contact to a list

`POST /v1/projectId/{projectId}/subscriber-lists/{id}/subscribers`

## Request

- Base URL: `https://api.bluefox.email`
- URL: `https://api.bluefox.email/v1/projectId/{projectId}/subscriber-lists/{id}/subscribers`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Project-scoped equivalent of POST /v1/subscriber-lists/{id} (which is a legacy flat URL shape kept for hosted 
signup forms - it also accepts a whitelisted Origin header and CAPTCHA, neither of which apply here). Creates the 
contact if it doesn't exist yet. Accepts a SubscriptionToken in place of an api key - see that security scheme's 
description for how a custom subscription-preferences page uses this to let a subscriber re-join a list they had left.

Double opt-in: when it is on for the list and the request uses an API key (or a whitelisted Origin), a new contact - or one who is unverified or unsubscribed on the list - is not activated. They get the verification email and stay as they are (new contacts become "unverified") until they click its link, and the response is { success: true, info } instead of the subscriber. Sending status "active" does not skip this. A paused subscriber is reactivated directly, without an email. With a SubscriptionToken the subscriber has already proven they own the address, so they are activated directly.

## Path parameters

- `projectId` string, required
- `id` string, required

## Request body

- object
  - `email` string, required
  - `name` string
  - `status` 'unverified' | 'active'
  - `tags` string[]

## Response `201`

Created

- object
  - `status` integer
  - `result` object
    - `email` string
    - `status` 'unverified' | 'active' | 'unsubscribed' | 'paused'
    - `customFields` object: Custom contact field values, keyed by field name.

## Other responses

- `400`: Invalid request body or query - every violation found (missing/invalid/unexpected fields) is reported in one response, semicolon-separated, not just the first one hit.
- `403`: Missing or invalid API key
- `404`: Subscriber list not found
- `405`: The operation is blocked by a business rule (e.g. the resource is still in use)

---

[API](https://skmtc.dev/bluefox/apis/bluefox-email-public-api.md) · [All operations](https://skmtc.dev/bluefox/apis/bluefox-email-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bluefox/apis/bluefox-email-public-api/revisions/fa1a0a835c7f?raw)