---
title: "Send a sandbox test email"
method: POST
path: "/api/v1/emails/test"
tags: ["Emails"]
---

# Send a sandbox test email

`POST /api/v1/emails/test`

## Request

- Base URL: `https://api.sendly.now`
- URL: `https://api.sendly.now/api/v1/emails/test`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://app.sendly.now/api/auth/oauth2/authorize`, token URL `https://app.sendly.now/api/auth/oauth2/token`, scopes: `emails:test`)

Prove that sending works — before any domain, DNS record or verification exists.

The message is sent FROM this project's sandbox address (`sandbox_address` on `GET /api/v1/projects`) and can only reach ONE recipient: the project owner's own verified account email, which is also what `to` defaults to. Naming any other recipient answers 403, and naming a `from` answers 422 — the sender is resolved server-side and a request that expects a different one is refused rather than quietly re-addressed.

That restriction is the reason `emails:test` is a separate, non-sensitive scope: a call under it cannot put mail in a stranger's inbox, so it can sit in a default grant where `emails:send` may not. It is not a way to send real mail cheaply — use `POST /api/v1/emails` for that.

Sandbox sends are capped per project per day, and the response's `sandbox: true` marks the receipt so a relayed summary cannot pass a test send off as a real one.

Requires the `emails:test` scope — Send test emails to your own address from the Sendly sandbox.

## Request body

- SendTestEmailV1: Body for POST /api/v1/emails/test. `subject` and `body` are required; `to` defaults to the project owner's verified email, and `from` is refused.
  - `body` string, required: HTML body. Merge tags are rendered as on any other send.
  - `from` string: NOT ACCEPTED. The sender is always this project's sandbox address, resolved server-side; naming one here is refused rather than ignored, so a request that expects a different sender never gets a success it would misread. Read `sandbox_address` from `GET /api/v1/projects` to learn the address, or `from` off this response.
  - `subject` string, required
  - `to` string, email: Where to send it. Optional — it defaults to the project owner's own verified account email, which is the only address a sandbox send may reach. Any other value is refused.

## Response `202`

Test email queued

- EmailTestV1: Receipt for a sandbox test send.
  - `from` string, email, required: This project's sandbox sender — resolved server-side, never from the body.
  - `id` string, uuid, required: The Email row this send created.
  - `sandbox` true, required: Always true. It is here so a model relaying this result cannot describe a test send as a real one: the message came from the shared sandbox domain and could only reach the project owner's own inbox.
  - `status` 'PENDING' | 'SENDING' | 'SENT' | 'DELIVERED' | 'RECEIVED' | 'BOUNCED' | 'FAILED' | 'REJECTED' | 'RENDERING_FAILURE' | 'DELIVERY_DELAY' | 'CANCELLED', required: Delivery status at the moment of the response — `PENDING` for a send still queued.
  - `to` string, email, required: The recipient the message was queued for.

## Other responses

- `401`: `invalid_api_key` or `invalid_session` — missing or invalid credentials.
- `403`: `scope_missing`, `project_disabled`, or `forbidden` — the recipient is not the project owner's own verified account email (including the case where that address is not verified yet, so there is no default recipient), or `content_rejected` from automated content review.
- `409`: `conflict` — this project has no sandbox sender. The handle is derived from the project owner's email and this project has no owner; no retry fixes it.
- `422`: `validation_error` — the body did not match the schema, most often because it named a `from`. A test send always comes from the sandbox address.
- `429`: `rate_limited` — the project's daily sandbox send cap is spent. It resets at 00:00 UTC.
- `500`: `internal_error`.
- `503`: `content_review_unavailable` — content review could not run for this new account. Safe to retry.

---

[API](https://skmtc.dev/sendly/apis/sendly-api.md) · [All operations](https://skmtc.dev/sendly/apis/sendly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendly/apis/sendly-api/revisions/ce7cfb7f7c7e?raw)