API documentation

On the dashboard, Register an app is seven steps. The first three are required, the next three are optional and can be switched on later, and the last one issues the key.

1. Basics — the website name, and the email address submissions should be delivered to. Any inbox works.
2. Form fields — the fields you need from your form. Only these are emailed; anything else your form posts is refused with 400 unknown_field (Max: 25 fields).
3. Mail design — one of 5 designs for how a submission looks in the inbox. Switchable any time.
4. Auto-reply (optional) — a message emailed back to whoever submitted the form.
5. Spam guard (optional) — a bot fills every input it finds and submits instantly, while a person leaves a hidden field alone and takes a few seconds. Name a honeypot field and a timing field your form posts and either signal refuses the submission with 422.
6. Attachments (optional) — let submissions carry files.
7. Generate key — creates the app and shows the secret key, once.

const res = await fetch("https://mail.satz.co.in/api/v1/send", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${SECRET_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    name: "Jane Doe",
    email: "jane@example.com",
    message: "Hello!",
  }),
});

const res = await fetch("https://mail.satz.co.in/api/v1/send", {
  method: "POST",
  headers: { "Authorization": `Bearer ${SECRET_KEY}` },
  body: new FormData(form),
});

if (res.ok) form.success(); // your function

With attachments on, the whole request may total 5.0 MB — fields and every file together, not per file — across at most 5 files. .doc/.xls are not accepted.Supported formats: .png, .jpg, .jpeg, .gif, .webp, .pdf, .txt, .csv, .docx, .xlsx, .pptx.

Always JSON plus a status, never a redirect — so what a visitor sees next is your decision. Success is { "ok": true }; every failure carries a machine-readable error code, and the two field errors name the field.

• 500 emails a day per app, on the UTC calendar day. Past it, submissions are refused with 429 rather than dropped silently — ask us at contact@satz.co.in if your form needs more.
• Repeats are collapsed. An identical submission within 60 seconds answers 200 with "duplicate": true and sends no second email, so a double-clicked submit is safe. A failed send is not a repeat, so retrying after a 502 does deliver.
• Body size is capped at 500KB, or 5.0 MB with attachments on, and nesting at 5 levels.
• Content is scored for spam on every submission — link volume, anchor or BBCode markup and mail-header probes → 422 spam_rejected, recorded in the app's activity with the reason. A honeypot field and a minimum fill time are available per app on the dashboard; neither belongs in your field list, since both are stripped before the field check runs.
• A blocked submission costs nothing from the daily allowance. Anything that reaches the mail server counts, including a send that fails there.
• From: is always our address and the submitter goes in Reply-To:, so replying from your inbox reaches them. Sending as their address would fail SPF and DMARC.
• An optional automatic reply to the submitter can be switched on per app. It is a second email and uses a second send; if the day's allowance runs out, the submission still goes through and the reply is the part skipped.
• Rotating the key invalidates the old one immediately. Only a hash is stored, so a lost key cannot be recovered — rotate and update your integration.
• Delivered submissions are not stored. The activity log keeps the status, the time and the mail server's reply, not the fields you received. Only a blocked submission records what triggered the block.
• Every attempt is logged against the app, successes and failures alike, so a missing email is diagnosable from the dashboard.