Frequently asked questions

This page answers common integration and troubleshooting questions. Refer to the linked guides for complete protocols instead of duplicating every parameter table.

Before you begin

Collect the full Message ID, request time, HTTP status, and response code. For Webhook issues, also collect eventId. Never include actual secrets in support tickets or logs.

Integration and authentication

Where do I get AppID and AppSecret?

Manage API credentials under Console > Developers in the main platform console. AppID is the full API Key. AppSecret computes CheckSum and is also the SMTP password. Store it only on your server and rotate it immediately if disclosed. See Getting started.

What should I check for HTTP 401 or signature failure?

• Whether AppID and API Secret match and the credential is still active;
• Whether Nonce is newly generated for every HTTP attempt;
• Whether CurTime is the current Unix timestamp in seconds and within the allowed window;
• Whether CheckSum is the 40-character uppercase hexadecimal SHA1(AppSecret + Nonce + CurTime);
• Whether Bearer and signature parameters were mixed, causing the other authentication mode to take precedence;
• Whether the egress IP satisfies the API Key's allowlist.

For authentication errors, check 020001, 020002, 020008, and 020009. See send API errors.

Should Nonce and the idempotency key change on retry?

With CheckSum, generate new Nonce, CurTime, and CheckSum for every HTTP attempt, but preserve X-Idempotency-Key and the request body. Idempotency results are retained for 24 hours by default, subject to the environment. An expired key is not long-term duplicate protection.

Sending and outcomes

Why did a successful API response not produce a delivered email?

Success means acceptance: HTTP 202 with code=000000. Later failures can include unavailable templates, unauthorized domains, suppression, channel rejection, or bounces.

Search Send Records by the full Message ID. Delivered means the receiving server accepted the message, not necessarily the inbox; also check spam and recipient-side policies. See Send records and statuses.

Do some bad addresses affect the whole batch?

There are two stages:

1. Before acceptance: if any message object fails request or business validation, the entire batch is rejected and no item is accepted.
2. After acceptance: every message is processed independently and can have a different final outcome.

For transactional messages, some malformed addresses can appear in invalidRecipients as a precheck. This is not the final failure list. See Single and batch sending.

Can a submitted campaign be recalled?

Submission for review is not the same as sending. Unexecuted pending-review or scheduled campaigns can be cancelled where offered by the page. A campaign already in the sending flow cannot be recalled. Test first and start with a small audience. See Console operations.

Why is a batch below 100 items still rate-limited?

100 is the item limit per batch, not the account rate. Each item consumes API Key TPS window and daily quota capacity, and insufficient capacity rejects the whole batch. Daily quota changes at UTC 00:00 (08:00 Beijing time).

Domains and unsubscribe

How long does domain verification or review take?

DNS propagation depends on TTLs and caches, and manual review requires platform processing. There is no universal fixed duration. Configure the actual records in the detail page and refresh.

Wait for domain verification to complete. If the detail page requires review, submit it and wait for the platform decision. DMARC suggestions can be optional, so do not treat “SPF, DKIM, and DMARC all verified” as a universal submission prerequisite. See Sending domains and identity verification.

Can a deleted suppression reappear?

Yes. Later hard-bounce or similar events can create another stop-delivery record. Resolve address errors, complaints, or recipient-side blocking before deleting a record; deletion is not a way to bypass opt-outs or complaints. See Marketing email and unsubscribe.

How do I change automatic unsubscribe, Webhook, or quota settings?

These are API Key or tenant-level settings managed by platform operators. Customers can customize branding and three-language copy in Unsubscribe Page Settings, but that does not enable the API Key's automatic unsubscribe switch or change Webhook and quota settings.

Webhooks

Why am I not receiving configured events?

Check whether:

• The callback is publicly accessible HTTPS with a valid certificate;
• DNS resolves to a rejected private or reserved address;
• The actual event type is subscribed;
• The endpoint returns 2xx within 10 seconds;
• Signature mode, timestamp units, raw body, and signature encoding are correct;
• Open and click tracking is supported by the current channel.

The platform does not automatically retry or guarantee replay after failure. Reconcile with send records and contact platform operators with the Message ID and eventId. See Event Webhooks.

What if I receive the same event more than once?

Persist and deduplicate by the body's eventId; one Message ID can legitimately have multiple event types. Do not rely on the old “CB- and CBRT- pairs” explanation or expect non-2xx responses to trigger automatic retries.

Other capabilities

Are SMTP, inbound email, and forwarding supported?

SMTP sending is supported. The console shows smtp.innomails.com:587 with STARTTLS. The username is the API Key and the password is its API Secret; there is no separate SMTP password.

Inbound email, IMAP/POP3 mailboxes, and forwarding are not currently provided. IMAP and POP3 retrieve mail from an existing mailbox; they are not Email product sending interfaces.

Are attachment upload and delivery supported?

There is no usable attachment upload or content-store capability. An attachment reference in the request model does not mean an attachment will be delivered; omit attachments. See Templates and variables for body and template capabilities.

Related resources