Download the PHP package recado/recado-php without Composer

Recado PHP SDK

Official PHP SDK for the Recado REST API v1. It wraps the transactional send, contacts, lists, segments, tags, templates, messages, campaigns, broadcasts, waitlists, webhook endpoints, events, sending and custom domains and email verification behind typed resources and readonly DTOs, with first-class error handling and idempotency support — plus an optional, batteries-included Laravel integration.

⚠️ Read-only mirror. This repo is an automated split of the SDK from a private monorepo. Do not open pull requests here — they can't be merged (the mirror is force-pushed) and will be auto-closed. Found a bug or have a request? Open an issue (see CONTRIBUTING).

🤖 Integrating with an AI agent? Start with AGENTS.md — a terse, imperative integration playbook with the human-gate steps called out. This README is the full human reference.

Features

• Typed resources + readonly DTOs over the full Recado API v1 surface (send, contacts, imports, lists, segments, tags, templates, notification templates, messages, campaigns, broadcasts, waitlists, webhook endpoints, events, sending and custom domains, email verification, the project profile, delivery health and notification analytics).
• A precise exception hierarchy with machine code branching.
• Automatic, idempotency-safe retries with exponential backoff.
• Lazy pagination via cursor() generators (no page bookkeeping).
• Per-send idempotency keys to make retries duplicate-free.
• Optional Laravel integration (auto-discovered): a recado mail transport, a recado notification channel and a Recado facade.
• Zero required dependencies beyond Guzzle; the core works in plain PHP without any Illuminate package installed.

Requirements

• PHP >= 8.3
• guzzlehttp/guzzle ^7 (the only runtime dependency)
• Laravel ^11.0 || ^12.0 || ^13.0 — optional, only for the Laravel integration (mail transport, notification channel, facade). The core SDK runs fine without it.

Installation

The package is published on Packagist — require it directly with Composer, no repository entry or Git/SSH access needed:

Migrating from mosaiqo/mailer-php (v1.x)? v2.0.0 is the same SDK under the new brand — no functional changes, but every brand-carrying name was renamed: package mosaiqo/mailer-php → recado/recado-php, namespace Mailer\Sdk → Recado\Sdk, classes Mailer* → Recado* (client, facade, service provider, transport, channel, message, headers, exceptions), toMailer() → toRecado(), env vars MAILER_* → RECADO_*, config mailer-sdk → recado-sdk, transport/channel string mailer → recado, and message headers X-Mailer-* → X-Recado-*. See the CHANGELOG for the full matrix.

Path repository (monorepo development)

When developing inside the Recado monorepo, point Composer at the package directory with a path repository:

Quick start: integrate into a Laravel app

The full, copy-pasteable recipe to route a real Laravel app's email through a Recado instance. (Detailed behavior and options are documented further down.)

1. Require the package (published on Packagist):

2. Set the environment variables.

Where to get the API key. In Recado, open Settings → API keys for the project you want to send from and create a key (it is shown once — copy it straight into RECADO_API_TOKEN). Keys are per project, so the key also selects which project's sender, templates and contacts the sends use.

3. Add the recado mailer to config/mail.php.

4. Send. Nothing else in your mailing code changes:

Or call the API client directly — e.g. to render a stored template by slug with per-recipient variables:

That is the whole integration. The rest of this document covers the SDK's full surface and the transport's detailed behavior.

Plain PHP usage

Batch sends

No attachments in batches. /send/batch rejects messages.*.attachments with a 422 — attachments are single-send only. Call send()->email() per recipient instead (the Laravel mail transport does this fan-out for you).

Notifications (in-app & push)

Send a notification to a contact over one or more channels. Without a channels key the SDK sends in_app; pass channels to fan out (e.g. in-app and push):

Per-channel failures are data, not exceptions. Each requested channel comes back as a NotificationChannelResult, so one channel failing never aborts the others — and when no channel can be queued (the API replies 422 with the same envelope) you still get a NotificationResult (anyQueued() is false) rather than a thrown exception. A real validation error (missing title, etc.) still throws ValidationException.

Push prerequisites: the project must have a push provider configured and the contact must have at least one registered device token (see below).

Notification templates

Instead of inline title/body, pass a template slug (a notification template managed in the dashboard under Transactional → Notification templates) plus optional variables — the two content modes are mutually exclusive:

The API resolves the template's locale variants per recipient (contact locale — exact tag, then language prefix — then the project default locale, then the base content) and snapshots the resolved content on the queued message, so deleting the template never breaks in-flight sends. The template's action_url/icon act as defaults that a per-send value overrides. An unknown slug throws a ValidationException with code template_not_found (like send()->email()). Batch items accept the same template field; there an unknown slug is a per-item, per-channel outcome (status failed_precondition, errorCode template_not_found) that never aborts the batch.

Batch notifications

Send up to 100 notifications in one request (rate limited to 10 requests/min per token). Each item takes the same fields as send(), and an item without channels defaults to ['in_app']:

queued and failed count channel dispatches, not items: a two-channel item whose push failed contributes to both. Unlike send(), the batch endpoint always answers 202 — even when nothing at all could be queued — because a batch has no single meaningful outcome; the per-channel error codes are the same ones listed above (plus upgrade_required when the plan does not include push). A single malformed item rejects the whole request with a ValidationException keyed by index (e.g. messages.2.title).

Idempotency keys work at the batch level (1–255 chars, 24h replay) and live in their own namespace, so a /send/batch key with the same string is unrelated. A retry arriving while the first request is still in flight throws a RecadoException with status 409 and code idempotency_conflict; a batch that queued nothing does not consume its key.

Push device tokens

Register and remove the device tokens push notifications are delivered to. The contact is upserted with transactional semantics (no double opt-in):

The platform is the native device platform: ios or android. This endpoint registers native FCM device tokens only — web push uses a separate VAPID subscription flow, so web is not accepted here (passing it yields a 422).

Registering a token already owned by another contact in the project moves it to this contact; a contact is capped at 20 devices (the oldest is evicted past the cap). Removing a token from an unknown contact raises a NotFoundException (contact_not_found).

Idempotency

email() and batch() accept a named idempotencyKey argument, sent as the Idempotency-Key header. Re-sending with the same key returns the original result instead of creating a duplicate. While the first request is still in flight a concurrent retry with the same key gets a 409 — surfaced as a base RecadoException with code idempotency_conflict; an empty or over-long key is rejected with a 422 ValidationException (code invalid_idempotency_key).

Other resources

Paginated endpoints return a Paginated DTO exposing ->data (mapped DTOs), ->meta and ->links. The tags and webhooks listings return flat arrays.

Campaigns

The campaigns resource covers the whole newsletter lifecycle: create and edit a draft, inspect it before sending, then send, schedule, cancel, duplicate or delete it.

A/B testing

Pass ab_test and variants to the same create() / update() calls — the whole test is authored in one request, no dashboard round trip:

Every variant field (subject, preheader, from_name, from_email, content) is optional and a null one inherits the campaign's own; the variant content always uses the campaign's editor shape, since a variant never has an editor of its own. variants replaces the whole set on each write, so editing or removing one means sending the set you want; ['enabled' => false] turns the test off and clears them.

The authored test comes back as $campaign->abTest on every read and write (no include needed). Once the test group has gone out it is frozen:

Two variants are required to SEND (not to save a half-built draft) — the ab_variants readiness check reports ab_invalid_variants, or missing_subject / missing_content with the offending label in its meta. Enabling the test needs the A/B plan feature; without it the write is a 422 with ab_test_requires_plan.

Languages (locale variants)

One campaign, one audience, each recipient in their own language. locale_variants rides the same create() / update() calls, and each A/B variant may carry its own — the full matrix:

locale is required and normalized, so es_mx and ES-mx are the same language and listing both is a 422. subject, preheader and content are each optional and a null one inherits the layer below — the A/B variant, then the campaign. A translation carries no sender (who a campaign sends from is not a language decision) and no editor of its own: content follows the campaign's editor, exactly like a variant's.

Each list replaces the whole set for its scope on every write, so [] removes every translation there, and a partial update that never mentions the key leaves the stored translations untouched. Per recipient the contact's locale is tried first, then the project's default_locale, each as the exact tag (es-MX) and then as its language prefix (es); nothing matches → the campaign base, byte-identical to an untranslated campaign.

Both preview() and testSend() take a locale, rendering exactly what a recipient in that language would receive:

The authored translations come back on every read and write (no include needed) as $campaign->localeVariants, with the per-variant ones on $campaign->abTest->variants[*]->localeVariants; the listing never carries them, so a list row has empty arrays. The advisory locale_variants readiness check never blocks a send — it names in its meta the languages whose resolved subject or body would be empty.

Sending requires an explicit confirmation. send() fires real mail at a real audience and cannot be recalled once the batch is queued, so the intent has to be spelled out at the call site:

Without confirm: true the exception is thrown before any HTTP request is made — a stray or accidental send() never reaches the API, let alone the audience. (This replaces the old posture, where the resource simply had no write methods at all.) Nothing else needs confirming: schedule() only arms a future send that unschedule() or cancel() can still stop.

Reporting:

Failures keep the API's machine codes on the typed exceptions, untranslated — $e->getErrorCode() returns not_sendable, missing_subject, missing_content, no_recipients, sending_domain_not_verified, quota_exceeded, ab_invalid_variants, campaign_not_editable, campaign_not_cancellable, campaign_not_deletable, premium_monetization_disabled.

Broadcasts

A broadcast is a mass in-app and/or push notification send — the notification sibling of a campaign. Email is deliberately not a broadcast channel: mass email is what campaigns are for. The lifecycle mirrors campaigns field for field, so code that drives one drives the other.

Failures keep their machine codes: not_sendable, missing_content, no_channels, no_recipients, push_not_entitled, push_not_configured, quota_exceeded, broadcast_not_editable, broadcast_not_scheduled, broadcast_not_cancellable, recipient_blocked.

Waitlists

A waitlist is a hosted pre-launch signup page (/w/{slug}) with referral positions. The SDK covers the read side plus the one irreversible action: authoring stays in the dashboard, because creating a waitlist also creates its dedicated contact list and claims a globally unique public slug.

Launching is irreversible — there is no unlaunch, here or in the dashboard:

A second launch (and the loser of a concurrent one) throws a ValidationException with the code waitlist_already_launched; an unknown or cross-project id is a NotFoundException with waitlist_not_found.

Permissions reuse the contacts pair: contacts.view to read, contacts.manage to launch.

Sending domains

The automated-onboarding loop: add the domain, read back the DNS records to publish, pipe them into your DNS provider, poll, clean up — without anyone opening the dashboard.

state is the field worth polling, because it blends the provider's truth with Recado's own live DNS lookups:

Every representation performs live DNS lookups, so treat these calls as a status poll, not a hot path.

Refusals keep their machine codes: verification_unsupported (the active provider has no domain API — generic SMTP, or Postmark without the optional account token — so the row could never leave pending), already_added, provider_error and verification_failed (the provider could not be reached; the stored status is untouched and the call is worth retrying).

SendingDomain::$warmup mirrors the dashboard's ramp block for a warming identity. Skipping a ramp and resuming a breaker-paused identity have no API and the SDK fakes none: they are judgement calls about sending reputation and stay in the dashboard, where the trip rates sit in front of a human.

Not available in a sandbox — see Production-only endpoints below.

Custom domains

The project's own public hostname (news.customer.com). Once verified, public pages, webviews, tracking and unsubscribe links are served on it; until then (and if it later breaks) everything falls back to the platform subdomain, so links in already-sent mail keep working.

One domain per project. The collection is a collection for forward compatibility; today it holds 0 or 1 element, and current() collapses that:

Verification has two gates, both run by check(): the CNAME ownership proof (A-records deliberately do not verify — failure is cname_missing) and a TLS-live probe of https://{hostname}/up. verificationError and tlsError stay machine codes: an integration branches on them, and a localized sentence is not a contract.

Adding requires the custom_domains plan entitlement (422 custom_domains_not_entitled); checking and deleting stay ungated, so a downgraded team keeps managing the domain it already has. Other refusals: custom_domain_limit_reached, and check_throttled (one check per domain per 15 minutes, with retry_after seconds on the response body).

Not available in a sandbox — see Production-only endpoints below.

Email verification (billed)

Every contact already carries Recado's free verdict (Contact::$verificationStatus: valid, risky, invalid, unknown), computed in-process with no external provider. The API only marks, it never rejects — the one place the verdict changes behaviour is campaign audiences, where invalid contacts are excluded like suppressed ones.

On top of that, a project can connect its own ZeroBounce or Kickbox account and ask for mailbox-level verification. Those lookups are billed per address to that account and there is no refund, so the SDK keeps the cost gate first-class: run() takes the estimate object, never a bare number.

addresses is smaller than contactsInScope whenever addresses already carry an external verdict newer than the re-verify window (30 days by default): those are skipped and cost nothing, which is what makes re-running the same list cheap. Omit both arguments to scope the estimate to the whole audience; contactIds is capped at 5000.

If the audience moved between the estimate and the run, the platform refuses to spend on a figure nobody has seen — and hands you the current one:

It extends ValidationException, so code that only catches that keeps working. Other refusals: verification_not_configured (no provider, or one switched off — a disabled provider must never spend credits), 409 verification_already_running (one run per project at a time), list_not_found and verification_run_not_found. The gate applies in a sandbox too.

Production-only endpoints

Sending domains, custom domains and delivery health are refused for a sandbox credential: a sandbox never sends externally and never serves customer-facing pages, so it has no sending identities, no public hostname and no sending reputation — and its token must not reach the production project's.

Branch on the code, not the status. The platform is unifying those refusals on 404 (they used to be a mix of 404 and 422), so the SDK exposes the check on the exception base class:

$client->project()->get()->isSandbox() answers the same question up front, without provoking a refusal.

Automatic pagination

Paginated resources also expose a cursor() generator that lazily walks every page for you, fetching one page at a time and yielding each mapped DTO. You never track page numbers — just iterate:

A cursor() returns a plain \Generator (the core SDK never depends on Illuminate). In a Laravel app you can wrap it in a LazyCollection to use the collection pipeline:

Resilience (automatic retries)

When you let the SDK build its own HTTP client (the default — you do not inject a Guzzle client), it installs an automatic retry middleware with exponential backoff.

• What is retried: network/connection errors, 5xx responses, and 429 rate-limit responses.
• Idempotency safety: only requests that are safe to repeat are retried — GET/HEAD/OPTIONS/PUT/DELETE, or any request that carries an Idempotency-Key header. A POST/PATCH without an Idempotency-Key (e.g. an email()/batch() send made without idempotencyKey:) is never retried, so the transport can never duplicate a send. Pass an idempotency key to make sends retry-safe.
• Retry-After: on a 429, the Retry-After header is honored (numeric seconds or an HTTP-date); otherwise the delay is exponential (min(retry_max_delay, retry_base_delay * 2 ^ attempt), no jitter).

Tune it through the optional options argument (4th constructor parameter):

When you inject your own Guzzle client it is used as-is — add the retry middleware yourself via Recado\Sdk\Http\RetryMiddleware::make() if you want it.

Error handling

Every non-2xx response is mapped to a typed exception. All exceptions extend Recado\Sdk\Exception\RecadoException and expose:

• getErrorCode(): ?string — the machine code field
• getStatus(): ?int — the HTTP status
• getBody(): ?array — the raw decoded response envelope
• getMessage(): string — the human-facing message (standard \Exception)
• isNotAvailableInSandbox(): bool — the production-only refusal, matched on the code rather than the status (see Production-only endpoints)

Testing with the sandbox

A sandbox project lets your CI exercise the real send pipeline without touching production data or real inboxes. The API token is the routing: a sandbox token quietly captures everything it sends and unlocks the event simulator; a production token can't even see the simulator (it gets a bare 404). So the same code under test only needs a different RECADO_API_TOKEN.

The recipe is: send → read it back from messages() (the sandbox inbox) → simulate an event → assert.

Notes and safety properties:

• Webhooks fire for real, flagged "sandbox": true. Outbound webhooks triggered by simulated events carry a "sandbox": true marker so your endpoint can tell test traffic apart.
• Simulated bounces suppress only inside the sandbox. A hard_bounce / complaint you simulate adds the address to the sandbox project's suppression list — it never contaminates production suppression or the shared platform reputation.
• The simulator is invisible to production tokens. simulate() with a production token gets a bare 404 (a NotFoundException with no error code), so a mis-pointed token fails loudly instead of mutating real data.

Laravel integration

The package is auto-discovered (no manual provider/alias registration). It registers a container-bound RecadoClient singleton, a Recado facade, a recado mail transport and a recado notification channel — all driven by the same recado-sdk config.

Configuration

Publish the config file:

Then set the env vars (every key below maps to config/recado-sdk.php):

Resolve the client from the container:

The resilience knobs (RECADO_TIMEOUT, RECADO_RETRIES, RECADO_RETRY_BASE_DELAY, RECADO_RETRY_MAX_DELAY) are wired into the container-bound client automatically.

Connection config. RECADO_API_TOKEN is required — an empty token throws a Recado\Sdk\Exception\RecadoConfigurationException at construction. RECADO_BASE_URL is optional: it defaults to the canonical hosted API (https://api.recado.dev/v1; the legacy apex path https://recado.dev/api/v1 remains valid), so hosted users only set the token; self-hosted users override it. An explicitly empty base URL, the old placeholder base URL still throws, instead of silently sending to a dead host.

Mail transport (MAIL_MAILER=recado)

The package registers a recado mail driver, so you can route Laravel's Mail facade (and notifications, queued mailers, etc.) through the platform /send API without changing any mailing code.

Add a mailer entry to config/mail.php:

and select it:

Now every send flows through the API:

The transport maps the message to a single /send call (one recipient) or a /send/batch call (multiple recipients), reading the subject, HTML body and text body off the message.

Sending with a stored template

To render a platform template by slug instead of inline HTML, set the template headers on the underlying Symfony message from your Mailable. The transport then sends a template payload ({to, template, variables}) and ignores the inline subject/body:

Attachments

Attachments on a Mailable / Symfony message are mapped onto the /send attachments field and delivered by the platform. The behavior is driven by recado-sdk.mail.attachments (env RECADO_MAIL_ATTACHMENTS):

Platform limits (validated server-side, one guard duplicated client-side):

• Max 10 files per send, 10 MB decoded per file and ~10 MB decoded total per send. The SDK checks the total before uploading and throws a local Recado\Sdk\Exception\AttachmentsTooLargeException (error code attachments_too_large — the same code the server's 422 carries), so an oversized send fails fast instead of uploading megabytes of base64 first. Per-file size, filename and content-type validation stay server-side.
• Executable filename extensions are rejected by the API with a 422 field error (.exe, .bat, .cmd, .com, .cpl, .dll, .jar, .js, .jse, .lnk, .msi, .pif, .scr, .vbs, .vbe, .wsf, .wsh, .ps1, .msc, .hta, .reg), as are filenames with path separators or control characters.
• Batch sends: the /send/batch endpoint rejects attachments (single-send only), so a multi-recipient message carrying attachments is automatically fanned out as per-recipient single /send calls. Each fan-out send gets its own per-recipient idempotency key (attachments hash into the content key), so a requeued job still dedupes; an explicit X-Recado-Idempotency-Key is derived per recipient ({key}:{sha1(recipient) prefix}) for the same reason. Expect N API calls (and N ratelimit slots) instead of one batch call.

Behavior & limitations

The platform /send API is intentionally narrow; the transport adapts to it with explicit, documented behavior rather than silent surprises.

• From / Reply-To are forwarded. A message that sets its own sender (->from('[email protected]', 'Alex'), ->replyTo(...)) is sent with that address: the transport maps it onto the /send from, from_name and reply_to fields, on single sends and on batch items alike. A message that sets neither is unchanged — the project's configured sender (default_from_email/default_from_name) applies as before. The API takes one address per field, so extra From/Reply-To addresses are dropped with a debug log. The from domain must be a verified sending domain of the project: the platform rejects anything else with 422 sending_domain_not_verified, which the transport re-throws as a TransportException naming the refused address and domain and how to fix it:

  Recado rejected the sender "[email protected]": the domain "example.com" is not a verified sending domain of this project. Verify it under Settings → Sending domains, or remove the From override (set RECADO_MAIL_FORWARD_FROM=false to fall back to the project default sender).

  Add and verify each sender's domain under Sending domains in the dashboard. Set recado-sdk.mail.forward_from to false (env RECADO_MAIL_FORWARD_FROM=false) to restore the old behavior and always send as the project's configured sender.

• The recipient's display name is forwarded. ->to(new Address('[email protected]', 'Ada Lovelace')) sends name: "Ada Lovelace" on the /send payload, so the platform fills the first/last name of the contact it creates or updates. The name is resolved per recipient (the To/Cc/Bcc address matching that recipient), on single sends and batch items alike — a batch never labels everyone with the first To's name. A recipient without a display name adds nothing to the payload, and the name only joins the content idempotency key when it is actually present, so sends without display names keep the exact key they had before.
• Attachments are sent by default. They are mapped onto the /send attachments field (see Attachments above for modes, limits, the filename blocklist and the batch fan-out). Consumers who relied on the old fail-loud behavior must set recado-sdk.mail.attachments = 'fail' explicitly; 'ignore' still drops them with a warning — never silently.
• Suppressed recipients are not failures. When the platform rejects an address as suppressed (recipient_suppressed), the transport does not throw: it logs a warning and dispatches a Recado\Sdk\Laravel\Events\MessageSuppressed event (carrying the recipient email and reason). In a batch send, each suppressed recipient gets its own event while the rest are delivered. Listen for the event to prune your lists.
• Quota / sending-domain rejections are failures. quota_exceeded and sending_domain_not_verified (and any other unexpected API error) are re-thrown as a Symfony\Component\Mailer\Exception\TransportException with the SDK exception kept as previous, so Laravel's mailer/queue treats the send as failed and can retry per your own policy. A batch send throws if any recipient hard-fails, summarizing the failed recipients.
• Multiple recipients become a batch. To + Cc + Bcc are merged into the delivery list; each recipient is sent its own copy via /send/batch (the message content is shared, the to differs per item). Exception: a message carrying attachments fans out as per-recipient single /send calls, because the batch endpoint rejects attachments (see Attachments above).
• Idempotency is automatic and retry-safe. Per send the transport sets an Idempotency-Key derived from recado-sdk.mail.idempotency (env RECADO_MAIL_IDEMPOTENCY):
  • content (default): a deterministic hash of the message content, so a requeued job never duplicates the send. Two genuinely identical messages sent within the platform's idempotency window dedup — switch to random if that is not what you want.
  • random: a fresh UUID per send attempt (no dedup).
  • off: no key. Override per message with the X-Recado-Idempotency-Key (RecadoHeaders::IDEMPOTENCY_KEY) header.

Notification channel

The SDK also registers a recado notification channel, so a Notification can deliver through the platform /send API by returning ['recado'] from via() and defining toRecado($notifiable).

toRecado() returns a Recado\Sdk\Laravel\Mail\RecadoMessage for full control. Inline mode uses subject()/html()/text():

Template mode renders a stored template with per-recipient variables:

Recipient routing precedence: an explicit RecadoMessage::to() wins, then routeNotificationFor('recado'), then routeNotificationFor('mail'), then a public $email property on the notifiable.

Other return types are accepted too: a plain /send payload array is used directly (its to/idempotency_key keys are honored, and an attachments key passes through to the API — see Attachments above for shape and limits), and an Illuminate\Contracts\Mail\Mailable is rendered to its subject + HTML only (its attachments are NOT carried over) — return a RecadoMessage for templates, a text part or an explicit idempotency key, or the array form for attachments.

The outcome semantics mirror the transport: a suppressed recipient is not a failure — a Recado\Sdk\Laravel\Events\MessageSuppressed event is dispatched and the send is skipped — while quota / sending-domain / any other API error is rethrown so Laravel marks the notification failed and retries per your queue policy.

A complete notification:

Facade

The package registers a Recado facade (auto-registered via package discovery) that proxies the same container-bound RecadoClient singleton — no separate configuration is needed:

Contributing / Development

Tests run entirely against a Guzzle MockHandler — no network access required.

Both commands run in CI (.github/workflows/sdk.yml in the source monorepo) on PHP 8.4 and 8.5 for every push and pull request, so a change that breaks the suite or the code style cannot land.

For how this package is split out of the monorepo into its own repository, tagged with SemVer and published to Packagist, see PUBLISHING.md.