Bird Email API (formerly SparkPost)

The SaaS Developer

The REST API and SMTP relay are both fully documented, with a PHP SDK named, a Laravel SMTP swap, Liquid templates with variables and conditionals, idempotency keys, a batch endpoint, scheduled sending and a sandbox that simulates deliveries, bounces and complaints before a real customer is emailed — nearly everything my password-reset pipeline needs. Inbound mail arrives parsed with SPF, DKIM and DMARC checks as an email.received webhook, and there is an official CLI and MCP server on top of the SDKs. It stops short of the top band because SMTP sends only the exact MIME your app submits and cannot render stored templates, so the two channels are not at parity, and we found no public information on an API versioning or deprecation policy. 1 2 3 5 6 14

Report an error

The Platform Engineer

A REST send endpoint, a batch endpoint for up to 100 messages, idempotency keys with replay protection, scheduled sending, a sandbox that simulates deliveries, bounces and complaints, and inbound mail parsed into a webhook are all documented, with typed SDKs for TypeScript, Python, Go and PHP plus a CLI and MCP server, and rate limits stated per plan. The SMTP relay is documented down to ports, TLS requirements, regional hosts and per-key defaults, but it passes through the exact MIME your application submits rather than rendering stored templates, so API and SMTP are not at feature parity. We found no public information on vendor-maintained framework drivers beyond SMTP swap guides for Nodemailer, Rails, Django and Laravel, or on a published API versioning and deprecation policy. 6 3 14 1 13 7 5

Report an error

The Shop Operator

My shop runs on PHP, and there is a PHP SDK alongside TypeScript, Python and Go, a CLI, and an SMTP relay on regional hosts with STARTTLS ports — I could point Shopware's mailer at it by swapping credentials. The API documents idempotency keys so a retried order confirmation cannot send twice, scheduled and batch sending, a sandbox that simulates bounces and spam complaints, inbound replies parsed into a webhook, Liquid templates with a pinned published version, and concrete limits for message size, headers and sending rate per plan. 1 3 5 6 13 14

Report an error

The Data Protection Officer

Sending is well documented for a compliance-sensitive team: an idempotency-keyed REST endpoint with a documented replay header, Liquid templates whose published versions are pinned at acceptance, batch sends validated as one unit, attachments, scheduled sending, and a sandbox that simulates deliveries, bounces and spam complaints before a real patient is contacted. Inbound mail arrives parsed to a webhook with SPF, DKIM and DMARC checks, official SDKs cover TypeScript, Python, Go and PHP alongside a CLI, and the SMTP relay documents its ports, TLS requirement and per-plan rate limits, with migration guidance from SparkPost and framework mailers. We found no public information on a versioning or deprecation policy, and SMTP sends the exact submitted MIME rather than stored templates. 2 3 5 6 7 13 14

Report an error

The Agency Lead

Sending is well covered for my stack: a documented REST endpoint and a regional SMTP relay with required TLS, official SDKs for Node, Python, Go and PHP plus a CLI and MCP server, Liquid templates with published-version pinning, batches up to 100 messages, idempotency keys on both channels, scheduled sending, a sandbox that simulates bounces and complaints, and inbound mail parsed to a webhook. Limits per plan and per message are stated plainly. It stops short of the top because we found no published API versioning or deprecation policy, and the SMTP path sends the exact MIME the application submits rather than rendering stored templates, so the channels are not at full feature parity. 1 2 3 6 7 13 14

Report an error

The Skeptic

A documented send endpoint returning a message ID, a batch endpoint validating up to 100 messages as one unit, idempotency keys with a replay header, scheduled sending, stored templates with a documented Liquid engine plus React Email, a sandbox that simulates deliveries, bounces and spam complaints, inbound mail parsed to a webhook, and an official CLI, MCP server and SDKs in four languages — with rate limits per plan and per-field limits spelled out. I stop short of the top because SMTP deliberately sends the exact MIME you submit without rendering stored templates, and we found no public information on an OpenAPI specification, framework drivers maintained by the vendor, an API versioning policy, or a migration guide from named competitors beyond a SparkPost transition page that warns a SparkPost request cannot be sent unchanged. 1 2 3 6 13 14

Report an error

The SaaS Developer

Everything I would configure on day one is covered: generated DKIM, return-path and DMARC records with SPF alignment on the return-path CNAME, DMARC required before a domain can send, daily re-checks, a DMARC policy generator and report analyzer, dedicated IPs with a roughly 30-day automated warm-up, and automatic suppression of hard bounces and spam complaints. The Inbox Insights page measures inbox versus spam placement per mailbox provider, which goes beyond the basics. It falls short of the higher band because we found no public information on feedback loops, blocklist monitoring, stated compliance with the Gmail and Yahoo sender rules, or published delivery times. 4 5 15 16

Report an error

The Platform Engineer

Authentication is handled seriously: generated DKIM, return-path and DMARC records gate sending outright, each organization gets its own DKIM selector, and dedicated IPs warm up automatically over roughly 30 days with IP pools that separate password resets from promotional blasts. Hard bounces and complaints are suppressed automatically with traffic-type-aware rules, and the dashboard measures inbox and spam placement per mailbox provider with health labels and guidance on when to investigate bounce and complaint rates. We found no public information on a stated vetting policy for shared IP pools, on feedback loops with mailbox providers or blocklist monitoring, on a statement covering the Gmail and Yahoo bulk-sender requirements, or on published delivery times. 15 16 4 5 20 7 1

Report an error

The Shop Operator

This is what I need most and the guide generates the exact DKIM, return-path and DMARC records for my domain, detects my DNS provider, formats values for it, splits over-long TXT values, requires a DMARC record before a domain may send and re-checks daily — a non-specialist can follow that. Dedicated IPs warm up automatically over about 30 days, order mail and newsletter can be split by category and IP pool, and hard bounces and spam complaints are suppressed automatically. We found no public information on feedback loops, blocklist monitoring, a vetting policy for the shared pools, or stated compliance with the Gmail and Yahoo bulk-sender rules. 1 4 5 15 16 20

Report an error

The Data Protection Officer

The chain is guided end to end: DKIM, return-path CNAME and DMARC records are generated for the domain, DMARC is required before a domain may send, a DMARC report analyzer and branded tracking domain are provided, and dedicated IPs warm up automatically over roughly 30 days with IP pools separating transactional from marketing traffic. Hard bounces and spam complaints are suppressed automatically, and Inbox Insights measures inbox versus spam placement per mailbox provider for verified domains. We found no public information on shared-pool vetting, feedback loops, blocklist monitoring, or stated compliance with the Gmail and Yahoo bulk-sender requirements. 1 4 5 15 16

Report an error

The Agency Lead

Domain set-up is rigorous enough to trust per client: Bird generates the DKIM, return-path and DMARC records, requires DMARC before a domain can send, gives each organization its own DKIM selector, and warms dedicated IPs automatically over roughly 30 days. Hard bounces and complaints are suppressed automatically, transactional and marketing traffic can be separated by category and IP pool, and the Inbox Insights page measures inbox versus spam placement per mailbox provider. We found no public information on feedback loops, blocklist monitoring, a stated vetting process for the shared pools, or published delivery times with their method. 1 4 5 15 16

Report an error

The Skeptic

The authentication story is unusually concrete: exact DKIM, return-path and DMARC records are generated for you, SPF alignment is handled on a return-path CNAME, DMARC is required before a domain may send, each organization gets its own DKIM selector, dedicated IPs ramp over roughly 30 days, transactional and marketing traffic are separated by pool, hard bounces and complaints are suppressed automatically, and an Inbox Insights page measures inbox versus spam placement per mailbox provider. We found no public information on feedback loops with mailbox providers, blocklist monitoring, a statement of compliance with the Gmail and Yahoo bulk-sender rules, published delivery times, or access to deliverability experts, so I cannot place this higher. 4 5 7 15 16

Report an error

The SaaS Developer

This is the part I care most about and it is strong: searchable message logs with a per-recipient event timeline, fourteen event types including deferred and out-of-band bounce, an events API with cursor pagination and a type filter, and webhooks signed with HMAC-SHA256, retried eight times over roughly 27.5 hours, with secret rotation and a replay endpoint — I could answer whether a user got the reset mail without opening a ticket. Metrics with breakdowns by sending domain, mailbox provider and IP pool are in the dashboard and via the stats API. It misses the higher mark because message retention is a flat 30 days on every plan, and we found no public information on alerts for bounce or complaint spikes, configurable longer retention, or a rendered-message view per send. 2 7 16 17 18

Report an error

The Platform Engineer

Per-recipient event timelines are fetchable by API across fourteen event types including deferrals and out-of-band bounces with the bounce reason, and the webhook implementation is the most honestly documented I have read in this category: Standard Webhooks signing, an eight-attempt retry schedule over roughly 27.5 hours with jitter, secret rotation with a 24-hour overlap, replay of failed deliveries, and an explicit statement that deliveries are not ordered. Message retention is 30 days on every plan with content kept at most 72 hours, and statistics break down by mailbox provider, sending domain and IP pool. We found no public information on configurable log retention, on alerts that fire when bounce or complaint rates spike as opposed to dashboard guidance on when to investigate, or on streaming events to an external log tool. 18 17 16 7 9 2

Report an error

The Shop Operator

When a customer reports a missing invoice I can pull the per-recipient event timeline for the message with acceptance, deferrals and the exact bounce reason, and events reach my systems through signed webhooks retried on a documented schedule of eight attempts over roughly 27.5 hours, with replay, test sends and secret rotation. Message logs are kept 30 days on every plan and I found no option to extend that, and while the metrics page shows delivery, bounce and complaint rates with breakdowns, we found no public information on alerts that notify me when those spike. 2 7 16 17 18

Report an error

The Data Protection Officer

Every message can be followed: a searchable log, per-recipient event timelines over fourteen event types via the events API, exact bounce reasons, a raw MIME download, and signed HMAC-SHA256 webhooks whose retry schedule of eight attempts over roughly 27.5 hours is published, with metrics broken down by mailbox provider, sending domain and IP pool. Message retention is stated at 30 days on all plans and email content at most 72 hours, which suits a sender of lab-result notices. We found no public information on configurable log retention, alerts on bounce or complaint spikes, or streaming export of events to an external tool. 2 7 9 13 16 17 18

Report an error

The Agency Lead

Fourteen event types, a per-recipient event timeline per message, searchable logs with exact bounce reasons, and webhooks under the Standard Webhooks specification with the retry schedule, at-least-once semantics, secret rotation and a replay endpoint all documented — better than most platforms I run today. Retention is stated: message logs 30 days on every plan, email content 72 hours. We found no public information on configurable log retention, alerts on bounce or complaint spikes, or export of events to a named log tool. 2 7 16 17 18

Report an error

The Skeptic

Message retention is 30 days on every plan, an API returns each message's per-recipient event timeline across 14 event types including exact bounce reasons, metrics break down by mailbox provider, sending domain and IP pool, and webhooks follow the Standard Webhooks spec with HMAC-SHA256 signatures, eight retry attempts over roughly 27.5 hours, replay and secret rotation — the retry and signing behaviour is documented better than most. But retention is a flat 30 days, and we found no public information on configurable or extended retention, alerts on bounce or complaint spikes, streaming events to an external log tool, or viewing the rendered message or raw server answer per send. 2 5 7 17 18

Report an error

The SaaS Developer

The privacy policy lists what is kept per message — email address, subject line, IP address and traffic data for six months, with content capped at 72 hours — and open and click tracking can be switched off per send or per API key, with encryption in transit and at rest, channel-scoped keys, two-factor, SAML and an immutable audit log all documented. SOC 2 Type 2 and ISO 27001 are listed in the trust center, though the captured pages give different statuses for the ISO 27001 certification, so we would verify the report before relying on it. We found no public information on customer-configurable content retention, IP allow-listing, or deletion of recipient data by API. 6 9 10 12 19 20

Report an error

The Platform Engineer

What is stored is documented precisely — message content at most 72 hours, message records 30 days, inbound parsed bodies and attachments 30 days — and open and click tracking can be switched off per message and per SMTP key. API keys are scoped per channel with read and write permissions, revoking a key cuts off its SMTP access within seconds, two-factor and SAML are supported, and an immutable audit log records key rotation, domain changes and security events without exposing secrets. The captured pages give different figures for ISO 27001 status, and we found no public information on IP allow-listing, on configurable retention periods, or on deleting a recipient's data through the API. 9 10 14 3 19 12 20

Report an error

The Shop Operator

Email content is kept at most 72 hours and messages 30 days, open and click tracking can be switched off per send or per SMTP key, delivery uses TLS, API keys are scoped per channel, and the dashboard offers two-factor authentication, SAML and an immutable audit log. ISO 27001 and SOC 2 Type 2 appear on the trust page with reports available on request; the captured pages give different accounts of the ISO 27001 status, so I would verify the current scope before relying on it. 9 10 12 19

Report an error

The Data Protection Officer

What is stored is listed with its retention — email address, subject line, IP address and traffic data for six months after transmission, email content at most 72 hours, inbound bodies and attachments 30 days — and open and click tracking default on but are switchable per API key, with TLS required on SMTP and encryption at rest stated. API keys are scoped per channel, SAML and two-factor authentication exist, an immutable audit log covers keys, domains, webhooks and security events, and a privacy dashboard supports deletion of end-user data within one month. The captured pages give different figures for the ISO 27001 status — one archived SparkPost security page shows the process beginning while the trust page and the DPA state certification — and we found no public information on IP allow-listing or configurable content retention. 9 10 12 14 19 20

Report an error

The Agency Lead

For running thirty clients the audit log is the standout: a chronological, immutable record of key, domain, webhook, team and billing changes, readable by Workspace Admins and Analysts but not Developers, alongside SAML, two-factor access and API keys scoped per channel. Email content is kept 72 hours at most and traffic data six months, a DPA is published, encryption in transit and at rest is stated, and the current trust page lists ISO/IEC 27001:2022 and SOC 2 Type 2 — though the captured pages give different figures on ISO 27001 status, as an archived SparkPost security page from 2018 describes the certification as still in process. We found no public information on IP allow-listing, enforced TLS for outbound delivery, or configurable content retention. 2 9 10 12 19 20

Report an error

The Skeptic

Retention is published per data class rather than buried — email content up to 72 hours, email metadata six months after transmission, inbound parsed bodies and attachments 30 days — alongside switchable open and click tracking, encryption in transit and at rest, per-channel scoped API keys, two-factor authentication, SAML, an immutable audit log whose read access is role-restricted, and ISO 27001 with SOC 2 Type 2 listed on the security page. The captured pages give different figures for ISO 27001 status, since a 2018 archived page describes the certification process as just beginning while current pages list it as held, and we found no public information on customer-configurable retention, IP allow-listing, or requiring TLS per domain or message. 9 10 12 13 14 19 20

Report an error

The SaaS Developer

There is a public status page showing platform components, workspaces that separate production from sandbox traffic, defined team roles (workspace admins, analysts, developers, organization owners), and a Shopify connector plus Zapier, Make and n8n routes. However, we found no public information on an uptime SLA or service credits, incident history on the status page, redundancy across data centres, queueing and retry during outages, or support response times per plan. For a platform carrying my invoices and password resets, that silence is what keeps this below the mid band. 13 19 21 22

Report an error

The Platform Engineer

A public status page shows live operational status, workspaces separate production from sandbox traffic with team roles, support is reachable by email, and there are a Shopify integration and SMTP swap guides for Nodemailer, Rails, Django and Laravel. We found no public information on an uptime SLA with service credits, on incident history or post-mortems, on queueing and retry of mail during an outage, or on support response times per plan; the only disaster-recovery statement we captured sits on an archived SparkPost page. For a one-time-code pipeline where three minutes is an outage, nothing here commits the vendor in writing to an availability or delivery-latency figure. 21 13 22 3 8 20

Report an error

The Shop Operator

There is a public status page with current component health, workspaces to keep production and sandbox apart, team roles with an audit log, and a support contact — but we found no public information on incident history, an uptime SLA or response-time commitments. The named integrations cover Shopify, Zapier, Make and n8n plus SMTP guides for Nodemailer, Rails, Django and Laravel; for my Shopware shop I found no plugin and would have to connect via SMTP or the API. 3 12 13 21 22

Report an error

The Data Protection Officer

There is a public status page with per-component status, workspaces that separate production from sandbox, and granular roles — workspace admins, analysts, developers and organization owners — plus SparkPost migration guidance, SMTP swap guides for Nodemailer, Rails, Django and Laravel, and integrations for Shopify, Zapier, Make and n8n, with a disaster-recovery plan mentioned on an archived SparkPost security page. For a health sender this is operational ground rather than contractual: we found no public information on an uptime SLA with service credits, support response times, or incident history and post-mortems on the status page. 3 5 13 19 20 21 22

Report an error

The Agency Lead

Workspaces with role-based access and API keys scoped to exact channels are the closest thing to per-client accounts I found, the audit log records every invitation and role change, a public status page shows component states, and there is migration guidance for SparkPost traffic and for existing SMTP apps (Nodemailer, Rails, Django, Laravel) plus a Shopify connector and n8n/Zapier/Make hooks. We found no public information on an uptime SLA or service credits, incident history on the status page, support response times per plan, or queueing and retry of mail during an outage. Without an SLA, and with no evidence that a workspace maps one-to-one to a client with its own limits, this is where I would push the vendor hardest. 3 5 13 19 21 22

Report an error

The Skeptic

There is a public status page showing current operational state across the site, platform and engagement components, workspaces separate production and sandbox traffic, team roles exist with differentiated permissions, and Shopify, Zapier, Make and n8n integrations are documented. What I would want before trusting a password-reset pipeline to it is missing from the captured pages: we found no public information on an uptime SLA or service credits, incident history, redundancy across data centres, queueing during outages, or support response times. 13 19 21 22

Report an error

The SaaS Developer

An EU region exists (eu1 hosts and SMTP), Bird contracts through a Dutch entity registered with the Dutch consumer and markets authority, a data processing agreement with Standard Contractual Clauses is published, and the subprocessor list is public with locations and change notifications. But the list shows the email sending infrastructure running on AWS with Ireland marked optional alongside the USA, and we found no public information on which region applies when a customer makes no selection, or on where logs and account data are stored. For a Hamburg buyer the sending chain is therefore not shown to be EU by default, even though transfer safeguards are stated. 3 9 10 11

Report an error

The Platform Engineer

Bird B.V. in Amsterdam is the contracting entity, a published data processing agreement applies the EU Standard Contractual Clauses, and the subprocessor list is unusually specific about each provider's function and location. For the email sending chain specifically, cloud email sending runs on AWS with Ireland marked optional and the USA listed without qualification, and the captured pages do not state which region applies when the customer makes no selection; regional EU API and SMTP hosts exist and keys are matched to them. We found no public information on where logs and account data are processed or on whether the EU region covers them. 11 10 6 3 9

Report an error

The Shop Operator

Bird B.V. is an Amsterdam company with a published data processing agreement and a subprocessor list that names locations, and EU API and SMTP hosts exist. For the sending chain itself the list shows AWS for email sending with Ireland marked optional and the USA listed without qualification, and I found no statement of which region applies if I make no selection — for my German and Austrian order data I would want that pinned down in writing before switching my mail over. 3 10 11

Report an error

The Data Protection Officer

Bird B.V. of Amsterdam is the contracting party, the Dutch Data Protection Authority is the named supervisory authority, Standard Contractual Clauses (modules two and three) and the EU-U.S. Data Privacy Framework cover transfers, and a dated subprocessor list with locations is published alongside regional EU hosts for both API and SMTP. For a sender of patient notices the sticking point is the email chain itself: the subprocessor list shows the cloud email sending provider as "Ireland (optional), USA" and we found no public information on which region applies when the customer makes no selection, or on where logs and account data are processed; optional support subprocessors sit in the USA and the UK. 3 6 9 10 11

Report an error

The Agency Lead

The contracting side is European and unusually transparent: a Dutch supervisory authority and ACM registration are named, SCCs cover EEA transfers, and a dated subprocessor list gives locations per platform, with ISO 27001 and SOC 2 stated. For the email sending platform specifically, that list names AWS with Ireland marked optional while the USA is listed without qualification, and nothing we captured states which region applies if the customer makes no selection — so I cannot confirm messages and logs are EU-processed by default, even though eu1 API and SMTP hosts exist. Support affiliates and payment providers span the UK and USA, covered by stated safeguards. 3 9 10 11 12

Report an error

The Skeptic

Bird B.V. of Amsterdam is the vendor, a data processing agreement is published naming the Dutch supervisory authority and the Dutch consumer authority, standard contractual clauses govern EEA transfers, and a dated subprocessor list gives locations. But the list shows the cloud email sending infrastructure with Ireland optional and the USA listed without qualification, and support tooling runs through the USA and UK, so parts of the sending chain are not evidenced as EU-resident; we found no public information confirming EU processing of messages, logs and account data end to end. 3 9 10 11

Report an error

The SaaS Developer

All four tiers are public with price and approximate volume (Free $0 with 1K emails / month, Startup $15 / month Approx. 37.5K, Growth $250 / month Approx. 555K, Scale 1,000 $1,000 / month Approx. 2.85M), the per-1,000-email rate is stated per plan, the free tier's daily and monthly caps are shown, unused balance carries forward, and fees are stated as exclusive of taxes. The wallet-plus-deposit model is a little convoluted — deposits lapse after a year and top-ups can be automatic — but the pieces are all visible. It falls short because dedicated IPs appear only as maximum counts per plan without a price, and we found no public information on SSO pricing, support plans or a minimum term. 6 7 8

Report an error

The Platform Engineer

All four plans are public with their monthly deposit and rate per thousand emails, the free tier's daily and monthly limits are stated, sending stops at the free limit, and unused balance carries forward, so the monthly cost of a known send volume is computable from the pricing page. The plan tables also state sending domains, SMTP connections, webhook endpoints and 30-day message retention per tier, and the terms state that fees exclude taxes and default to euros when no currency is specified. We found no public information on the price of a dedicated IP, on support plan or SSO pricing, or on a minimum term, and mailbox add-on pricing sits on a separate page. 7 6 8

Report an error

The Shop Operator

The tiers and rates are public: Free at $0 with 1K emails a month, Startup at $15 / month, Growth at $250 / month and Scale at $1,000 / month, per-1,000 rates of $0.40, $0.45 and $0.35, metering per recipient, a wallet whose unused balance carries forward, and message retention of 30 days on every plan. Dedicated IP add-on counts are listed per plan but their price is not, and we found no public information on a minimum term, so the plan itself is computable while some add-ons are not. 7 8

Report an error

The Data Protection Officer

The annual cost is largely computable from the pricing page alone: Free $0 with 1K emails per month and 50 per day, Startup $15 / month for approximately 37.5K emails, Growth $250 / month for approximately 555K, Scale 1,000 at $1,000 / month for approximately 2.85M, each charged from the monthly deposit at $0.40, $0.45 and $0.35 per 1,000 emails respectively, with unused balance carrying forward and fees stated as exclusive of taxes. Message retention is 30 days on every tier. Dedicated IP add-ons appear only as maximum counts per plan, and we found no public information on the price per dedicated IP, support-plan pricing or a minimum term. 7 8

Report an error

The Agency Lead

The tier table is public and granular: Free at $0 with 1K emails per month, Startup at $15 per month with approx. 37.5K emails, Growth at $250 with approx. 555K, Scale at $1,000 with approx. 2.85M, per-1,000-email rates of $0.40, $0.45 and $0.35, sends metered per recipient, usage charged from the first send from the plan's balance, unused balance carrying forward, and message retention 30 days on all plans. For writing a price per client into a maintenance contract the gaps bite: dedicated IPs appear only as maximum counts per plan without a price, and we found no public information on workspace or sub-account pricing, SSO, support plans or a minimum term. Fees are exclusive of taxes, prepaid balances are non-refundable and lapse after one year, and quotations are stated to be non-binding. 6 7 8

Report an error

The Skeptic

Every tier is public with its monthly price, approximate volume and per-1,000-email rate ($0.40, $0.45 and $0.35 across the paid tiers), a free plan with daily and monthly allowances, per-recipient metering stated plainly, and plan-level rate limits, domains and IP counts on the same page; a deposit becomes spendable balance, unused balance carries forward, and fees are exclusive of taxes. Dedicated IP add-ons appear only as maximum counts without a price, and we found no public information on what a dedicated IP, a support plan, SSO or a minimum term cost, while deposits are non-refundable and lapse after one year — enough to estimate, not enough to compute the real annual bill. 6 7 8

Report an error