Send Attachments

Attach files to any email by including the attachments array in your send payload. Files must be base64-encoded, and you can include multiple attachments in a single call.

POSThttps://mail.sendcorex.com/v3.0/send

Attachments use the same endpoint as Send Email. Add the attachments array next to the other body parameters.

Attachment parameters

Each item in the attachments array is an object with the fields below.

filenamestringrequired
The filename shown to the recipient in their email client.
e.g. "invoice.pdf"
contentstringrequired
The file content encoded as a base64 string.
e.g. "JVBERi0xLjQKJeLjz9MK..."
encodingstringrequired
The encoding of content. Must be "base64".
e.g. "base64"

Quick start

import axios from 'axios';
import fs from 'fs';

const fileContent = fs.readFileSync('./invoice.pdf').toString('base64');

try {
  const response = await axios.post(
    'https://mail.sendcorex.com/v3.0/send',
    {
      to: 'user@example.com',
      from: 'noreply@yourdomain.com',
      senderName: 'My App',
      subject: 'Your Invoice #1042',
      body: '<p>Please find your invoice attached.</p>',
      attachments: [
        {
          filename: 'invoice.pdf',
          content: fileContent,
          encoding: 'base64',
        },
      ],
    },
    { headers: { Authorization: process.env.SENDCOREX_API_KEY } }
  );

  const { id, ids, recipients } = response.data;
  console.log('Queued:', id, '| recipients:', recipients);
} catch (err) {
  if (err.response?.status === 400 && err.response.data.code === 'DANGEROUS_ATTACHMENT') {
    // Attachment blocked for security reasons. There is no quarantine record.
    console.log('Blocked:', err.response.data.riskLevel);
  } else {
    throw err;
  }
}

Response

{
  "success": true,
  "message": "Email queued successfully",
  "code": "EMAIL_QUEUED_SUCCESS",
  "id": "3f2a1b4c-8e9d-4f7a-b2c3-1a2b3c4d5e6f",
  "ids": [
    { "id": "3f2a1b4c-8e9d-4f7a-b2c3-1a2b3c4d5e6f", "recipient": "user@example.com" }
  ],
  "recipients": 1,
  "scheduledAt": null
}

My attachment was blocked

To protect our platform and the sending reputation of every customer, attachments are checked before an email is queued. When a file is considered unsafe, the request returns 400 with the code DANGEROUS_ATTACHMENT and the email is not sent.

400

Attachment blocked

{
  "error": "One or more attachments were blocked for security reasons.",
  "code": "DANGEROUS_ATTACHMENT",
  "riskLevel": "high"
}

error
A human-readable message explaining that an attachment was blocked.
code
Always DANGEROUS_ATTACHMENT for this response.
riskLevel
The risk level assigned to the blocked attachment. Include it when contacting support.

There is no quarantine record for this error. Unlike flagged emails, a blocked attachment cannot be released with /quarantine/release. This is a deliberate safeguard against spammers and abusive senders, so the email is never held for later delivery.

What should I do?

Automated checks can occasionally flag a legitimate file. If you need to send this attachment, contact our support team. Our team is aware of this behavior, and when a block turns out to be a false positive we review it and apply the necessary updates.

To help us resolve it faster, include:

The filename and file type of the attachment
The riskLevel returned by the API
What the file is used for in your product

Contact support →

Errors

All error codes →

Errors return a JSON object with error and code.

401MISSING_AUTH_HEADER
No Authorization header present.
401INVALID_API_KEY
The API key is invalid or revoked.
401ACCOUNT_BLOCKED
Account has been blocked.
401NO_CREDITS_LEFT
No email credits remaining.
401DOMAIN_NOT_VALIDATED
Sender domain not verified.
401LISTED_SPAM_HAUS
Sender domain is listed on Spamhaus.
401ISP_DOMAIN_BLOCKED
Sending from well-known domains (gmail.com, outlook.com, etc) is not allowed.
401FROM_HEADER_DOMAIN_MISMATCH
From header domain not authorized for this sender.
401USER_NOT_FOUND
User not found.
401MISSING_USER_PRIVILEGES
Missing user privileges.
401EMAIL_CREDITS_NOT_FOUND
Error fetching email credits.
429CREDENTIAL_TEMPORARILY_BLOCKED
API key temporarily blocked due to repeated policy violations.
429IP_TEMPORARILY_BLOCKED
Requesting IP temporarily blocked due to repeated policy violations.
400MISSING_FROM
The from field is missing or empty.
400INVALID_FROM_FORMAT
The from field must be a valid email address.
400MISSING_SENDERNAME
The senderName field is missing or empty.
400INVALID_SENDERNAME_FORMAT
The senderName field contains invalid characters.
400MISSING_SUBJECT
The subject field is missing or empty.
400MISSING_BODY
The body field is missing or empty.
400MISSING_TOADDRESS
The to field is missing or empty.
400MISSING_TO
The to field is missing or empty.
400INVALID_TOADDRESS
One or more recipient addresses are malformed.
400TOADDRESS_LIMIT_EXCEEDED
More than 50 recipients in the to array.
400INVALID_SCHEDULED_AT
scheduled_at is not a valid date or is in the past.
400INVALID_SENDER_FORMAT
The sender email format is invalid.
400HEADER_NOT_ALLOWED
Custom header key is not on the allowed list (List-Unsubscribe, List-Id, X-*, etc).
400INVALID_HEADER_VALUE
Header value contains invalid characters (CR/LF not allowed).
400DANGEROUS_ATTACHMENT
One or more attachments were blocked for security reasons.
403ACCOUNT_RESTRICTED
Account is temporarily restricted.
403DAILY_LIMIT
Daily email sending limit reached.
403SPAM_DETECTED
Email content flagged as spam. Response includes quarantine_id and release instructions.
403SENDER_NAME_MISMATCH
Multiple sender names detected for same address.
403FOLLOWUP_PATTERN_DETECTED
Email content flagged as repeated suspicious follow-up pattern.
403SCAM_PATTERN_DETECTED
Email content flagged as scam pattern.
403ACCOUNT_SUSPENDED_SPOOFING
Account suspended due to repeated From header spoofing attempts.
500INTERNAL_SERVER_ERROR
Unexpected server error. Try again.
500PARSE_ERROR
Failed to process email content (MIME parse failure).
500PERSIST_FAILED
Failed to queue email (database persistence failure).