sendgrid v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-sendgrid-api-key

Custody

customer_vault

Injection

header (Authorization)

A Twilio SendGrid v3 API key, held in the client's own secret manager. The key is created in the Twilio SendGrid App; per the retrieved API Keys documentation a key may be Full Access, Custom Access (scoped to a limited set of actions) or Billing Access. The stored material must be the complete Authorization header value (scheme included): 'Bearer ' followed by the API key — SendGrid no longer accepts HTTP Basic authentication for the v3 API, per the retrieved getting-started guide. There is no token-issuance exchange: the key IS the bearer material, so the custody job stores it once and the executor injects it verbatim; renewal means issuing a new key in the app and updating the reference. Expiry and revocation: SendGrid documents no automatic expiry for API keys — treat a key as valid until revoked; a key can be revoked at any time in the app without changing the account's username and password, and a revoked key fails closed. Note that revoking issuance (not creating new keys) does nothing to already-issued keys: each issued key stays valid until that key itself is revoked. Least privilege: issue a Custom Access key with only the scopes these capabilities need (mail send; suppression read and delete) and nothing more — a Full Access key also reaches API-key management, sender authentication and account administration, which this pack deliberately does not register. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• sendgrid-mail (api, pii): https://sendgrid-api.invalid/v3/mail
• sendgrid-suppressions (api, pii): https://sendgrid-api.invalid/v3/suppression

The endpoint host 'sendgrid-api.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the SendGrid API host for the account — api.sendgrid.com, or api.eu.sendgrid.com for EU regional subusers, per the retrieved reference pages — before enabling, in every endpoint, in the resource locators and in every egress allowlist entry. The allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. The API key is created in the Twilio SendGrid App (the retrieved API Keys documentation: Full Access, Custom Access or Billing Access types) and a parent account may act for subusers with the on-behalf-of header — this pack registers no subuser impersonation and the deployment should review whether the stored key is a parent key. Tiering rationale: mail.send delivers email to end recipients, so although the vendor operation is a POST-create it is registered as create and send at the R3 floor — send is one of the IRREVERSIBLE ACTIONS (delete, send, pay, deploy, approve, share and transfer) — and the request body is unrestricted (up to 1000 personalizations per call, per the retrieved mail-send reference), so an installer's intention is not a restriction. Suppression deletions are registered as delete at the R3 floor: SendGrid's own documentation warns that removing a suppression means email will once again be sent to the previously suppressed address and should be avoided unless the recipient has asked to receive email again, so the effect overrides a recipient's expressed unsubscribe and the tier follows the effect. Documented exclusions — this pack does not register: API key management (creating or deleting API keys creates or destroys credentials themselves); adding addresses to the global suppression list (a write that changes what a recipient receives, registered neither here nor elsewhere in this pack); unsubscribe-group administration (creating, updating or deleting suppression groups — deleting a group moves one-click unsubscribers to the global list, per SendGrid's documentation); sender authentication, domain and link-branding configuration (changes what recipients trust as 'from' the customer); scheduled-send cancellation (a separate surface with batch semantics); contacts and marketing-campaigns surfaces; IP pool, warmup and access-management administration; and the Recipients' Data Erasure API — each is a different registration requiring its own review, and none is approximated here.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://www.twilio.com/docs/sendgrid/api-reference/mail-send/mail-send (retrieved 2026-09-21)
• https://www.twilio.com/docs/sendgrid/for-developers/sending-email/api-getting-started (retrieved 2026-09-21)
• https://www.twilio.com/docs/sendgrid/api-reference/api-keys (retrieved 2026-09-21)
• https://www.twilio.com/docs/sendgrid/api-reference/suppressions-suppressions/retrieve-all-suppressions (retrieved 2026-09-21)
• https://www.twilio.com/docs/sendgrid/api-reference/suppressions-global-suppressions/retrieve-all-global-suppressions (retrieved 2026-09-21)
• https://www.twilio.com/docs/sendgrid/api-reference/suppressions-suppressions/delete-a-suppression-from-a-suppression-group (retrieved 2026-09-21)
• https://www.twilio.com/docs/sendgrid/api-reference/suppressions-global-suppressions/delete-a-global-suppression (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.