Resend

Resend

Resend is Pact's first-party email transport. When you connect a Resend API key, every outbound message — sequence steps, journey sends, invites, the "Send test email" button — routes through your Resend account and your verified sending domain. Pact layers consent enforcement, suppression, and delivery instrumentation on top of the raw send.

Why bring your own key

Pact is multi-tenant, but email reputation is not something we pool. Trial tenants must configure their own Resend key — they cannot borrow Pact's shared environment key to send outbound mail. The sender checks core.trial.is_trialing and blocks with a trial_no_resend_key reason if a trial workspace has no key of its own. This keeps your deliverability tied to your domain, not a shared sender.

Connecting your account

curl -X POST https://api.pact.place/v1/integrations/resend/connect \
  -H "Authorization: Bearer $PACT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "re_xxxxxxxxxxxxxxxxxxxx"}'
# → { "status": "active", "sandbox": false, "last_error": null }

What happens on every send

The ResendSender wrapper is the opinionated path all routes use. For each message it:

1. Runs the consent + suppression gate (core.consent.consent_service.gate) keyed on the recipient email, channel email, and a purpose/lawful_basis pair. Transactional callers (invites, password resets) pass lawful_basis="contract" to bypass the marketing-grant requirement — but the suppression list always wins regardless.
2. Resolves the key: tenant DB row first, then environment fallback (sandbox/demo only).
3. Sends via the httpx-based client (POST https://api.resend.com/emails). Pact does not depend on the resend PyPI package.
4. Writes a sequence_events row for every outcome so funnel and attribution surfaces see the result:

Inbound webhooks: opens, clicks, bounces, complaints

Register Pact's Resend webhook URL in your Resend dashboard. The handler verifies the signature (Svix-style svix-signature, or Pact's own t=…,v1=… test format — both in core/integrations/resend/client.py::verify_webhook) and then, via core/integrations/resend/webhook.py, maps Resend event types onto Pact's vocabulary:

email.sent / email.delivered   → delivered
email.opened                   → opened
email.clicked                  → clicked
email.bounced                  → bounced
email.complained               → complained

On a bounce or complaint, Pact writes a permanent suppression_entries row (severity hard, source resend_webhook) so the next send to that address is gated automatically. This is idempotent — webhook replays are harmless.

Delivery health

GET /v1/integrations/resend/health returns a tenant-scoped panel computed from sequence_events plus an optional live /domains probe: domain verification status, sends in the last 24h, 7-day bounce and complaint rates, delivered count, and 24h p95 send latency. The panel stays useful even without a live key — the domain probe is simply skipped when no key is available.