SendGrid package v1.0.0

A Twilio SendGrid v3 API key, held in the client's own secret manager. The key is created in the Twilio SendGrid App; according to the reviewed API Keys documentation a key may be Full Access, Custom Access (scoped to a limited set of actions) or Billing Access. The stored material must be the complete Authorization header value (scheme included): 'Bearer ' followed by the API key — SendGrid no longer accepts HTTP Basic authentication for the v3 API, according to the reviewed getting-started guide.

There is no token-issuance exchange: the key IS the bearer material, so the custody job stores it once and the executor injects it verbatim; renewal means issuing a new key in the app and updating the reference.

Expiry and revocation: SendGrid documents no automatic expiry for API keys — treat a key as valid until revoked; a key can be revoked at any time in the app without changing the account's username and password, and a revoked key fails closed. Note that revoking issuance (not creating new keys) does nothing to already-issued keys: each issued key stays valid until that key itself is revoked.

Least privilege: issue a Custom Access key with only the scopes these capabilities need (mail send; suppression read and delete) and nothing more — a Full Access key also reaches API-key management, sender authentication and account administration, which this pack deliberately does not register.

Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

The endpoint host 'sendgrid-api.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the SendGrid API host for the account — api.sendgrid.com, or api.eu.sendgrid.com for EU regional subusers, according to the reviewed reference pages — before enabling, in every endpoint, in the resource locators and in every egress allowlist entry. The allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step.

The API key is created in the Twilio SendGrid App (the retrieved API Keys documentation: Full Access, Custom Access or Billing Access types) and a parent account may act for subusers with the on-behalf-of header — this pack registers no subuser impersonation and the deployment should review whether the stored key is a parent key.

Approval classification: mail.send delivers email to end recipients, so although the vendor operation is a POST-create it is registered as create and send at the minimum R3 tier — send is one of the designated actions requiring human approval — and the request body is unrestricted (up to 1000 personalizations per call, according to the reviewed mail-send reference), so intended limits need a separate enforceable control.

Suppression deletions are registered as delete at the minimum R3 tier: SendGrid's own documentation warns that removing a suppression means email will once again be sent to the previously suppressed address and should be avoided unless the recipient has asked to receive email again, so the effect overrides a recipient's expressed unsubscribe and the tier follows the effect.

Documented exclusions — this pack does not register: API key management (creating or deleting API keys creates or destroys credentials themselves); adding addresses to the global suppression list (a write that changes what a recipient receives, registered neither here nor elsewhere in this pack); unsubscribe-group administration (creating, updating or deleting suppression groups — deleting a group moves one-click unsubscribers to the global list, per SendGrid's documentation); sender authentication, domain and link-branding configuration (changes what recipients trust as 'from' the customer); scheduled-send cancellation (a separate surface with batch semantics); contacts and marketing-campaigns surfaces; IP pool, warmup and access-management administration; and the Recipients' Data Erasure API — each is a different registration requiring its own review, and none is approximated here.