List newsletter subscribers

A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.

Filter by consent state. Omit it to receive all three. An unrecognised value is a 400 rather than an empty page: a client filtering on "active" would otherwise conclude the store has no subscribers at all. pending exists only where the store runs double opt-in and those addresses receive no broadcasts, so counting them as reachable overstates the list.

EXACT match on one address, normalised the same way stored addresses are, so casing and surrounding whitespace do not matter. This is how you ask "is this address on the list, and what is its consent state": there is no per-address route, because a subscriber has no id and putting an address in a path would write it into every proxy and access log verbatim. A malformed address is a 400 rather than an empty page.

Subscribers touched at or after this RFC3339 instant. STATUS IS THE FIELD THAT MOVES AND IT IS A CONSENT RECORD: a row is written once at sign-up and its status is then flipped by every unsubscribe, resubscribe and bounce. On the default created_at ordering none of that is visible once you have paged past an address, so mailing from a cached list means mailing people who have withdrawn consent. THIS IS THE ONE WALK ON THIS API WHERE A MISS HAS A LEGAL CONSEQUENCE rather than only a correctness one; run it before every send. Supplying it CHANGES THE ORDER of this endpoint: the default walk descends created_at, and this one climbs updated_at, which is the only ordering in which a keyset walk over a mutable column cannot skip a row. A subscriber whose consent changes mid-walk moves forward past your position and is returned again, so the walk is AT LEAST ONCE. THE CURSOR ON THIS LIST CARRIES AN EMAIL ADDRESS in the slot that elsewhere holds an id, because a subscriber has no id: treat it as opaque, as you should every cursor. The bound is INCLUSIVE, which matters here in particular: a list-unsubscribe sweep writes many rows in ONE statement sharing a single instant, and an exclusive bound would drop every address in that batch your last page did not reach. A cursor belongs to ONE ordering and is refused by the other.

Rows per page. Out of range is a 400 rather than a silent clamp, so a client asking for more than 100 learns it did not get it.

The next_cursor from the previous page. Opaque: decode nothing from it and construct nothing by hand, since its encoding is not part of this contract. Omit it to read the first page.