> ## Documentation Index
> Fetch the complete documentation index at: https://docs.automate.ax/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Automate.ax automations are TypeScript programs.
> Use Bun for installation and command examples.
> Use Automate.ax for the product name and automate.ax for the package, CLI, and domain.
> Treat documented public APIs as current; do not invent transitional or deprecated names.

# Connect Resend and receive verified events

> Choose send-only or full-access Resend credentials, call uncovered REST endpoints, and avoid mutating Automate.ax-managed webhooks.

Automate.ax connects Resend through OAuth 2.1 or a Resend API key. OAuth is preferred, while API keys remain available for accounts that don't use an OAuth application connection.

## Choose Resend access

Resend defines two OAuth scopes: `emails:send` and `full_access`. Email and batch-send actions accept either scope. Sending an existing broadcast also accepts either OAuth scope, but Resend API keys require `full_access` for that action. Every other packaged action and all managed triggers require `full_access` because they access account resources or create provider webhooks.

Resend API keys may likewise be restricted to sending access or granted full access. Automate.ax represents a send-only key as `emails:send`, so the same action requirements apply to both connection methods. SMTP credentials aren't supported because they cover only sending and can't satisfy the wider automation surface.

Automate.ax resolves the OAuth token or API key only inside account-backed actions and never places it in action inputs or outputs.

## Call an uncovered endpoint

Use `getResendApi` inside a custom Resend-account-backed action when a public provider endpoint doesn't have a packaged action. Supply a Zod schema for every successful response:

```ts automations/list-resend-domains-raw.automation.ts theme={null}
import {
  automation,
  defineAction,
  markSignificant,
  onDashboardRun,
} from "automate.ax"
import { getResendApi } from "automate.ax/resend"
import { z } from "zod"

const listDomainsRaw = defineAction("List Resend domains with raw API")
  .account("resend", "full_access")
  .input(z.object({ limit: z.number().int().min(1).max(100) }))
  .output(z.object({ id: z.string(), name: z.string() }).array())
  .handler(async ({ account, input }) => {
    const response = await getResendApi(account).call("domains", {
      query: { limit: input.limit },
      responseSchema: z.object({
        data: z.object({ id: z.string(), name: z.string() }).array(),
        has_more: z.boolean(),
        object: z.literal("list"),
      }),
    })
    return response.data
  })

export default automation("Inspect Resend domains", () => {
  onDashboardRun({ title: "Inspect Resend domains" })
  const domains = listDomainsRaw({ limit: 50 })
  markSignificant(domains)
})
```

Paths are relative to `https://api.resend.com/`; the helper rejects another origin and adds `Authorization`, `Accept`, and `User-Agent` headers. Query arrays become repeated parameters. Plain request bodies are encoded as JSON; pass `FormData` for multipart requests without setting its `Content-Type` boundary yourself.

Successful responses are validated with `responseSchema`, including empty responses when the schema is `z.undefined()`. Failures throw `ResendApiError` with the path, HTTP status, provider error name and status code when present, `Retry-After`, rate-limit values, and available daily or monthly quota metadata.

Don't use the raw helper to update or delete an Automate.ax-managed webhook. Managed triggers persist the webhook ID and one-time signing secret, so changing that webhook outside the trigger lifecycle can stop delivery or make otherwise valid callbacks fail signature verification.

### Know what remains unsupported

The packaged surface excludes provider credential administration (API-key CRUD and OAuth grant revocation), public webhook CRUD, Resend-native automation graphs, deprecated Audiences and `audience_id` workflows, private-beta metrics or inspection endpoints, and generic segment-filter operations. Use the raw helper for a current public endpoint only when it doesn't mutate an Automate.ax-managed webhook or another platform-owned resource. SMTP is intentionally unsupported.

## Receive verified Resend events

Triggers create and remove account webhooks automatically. Automate.ax verifies the exact raw request body with Resend's webhook signing secret and the `svix-id`, `svix-timestamp`, and `svix-signature` headers. Requests outside the five-minute timestamp tolerance or with an invalid signature are rejected before event classification.

Resend webhooks are at-least-once and aren't guaranteed to arrive in order. Automate.ax uses the `svix-id` as delivery evidence so provider retries don't create duplicate events for the same subscription. A valid callback is acknowledged with an exact `200` response; the webhook delivery remains an ordinary root context and is joined to related automation work through correlation when applicable.

## Confirm Resend behavior

* [OAuth introduction](https://resend.com/docs/dashboard/oauth/introduction)
* [API keys](https://resend.com/docs/dashboard/api-keys/introduction)
* [API reference](https://resend.com/docs/api-reference/introduction)
* [Webhook introduction](https://resend.com/docs/dashboard/webhooks/introduction)
* [Verify webhook requests](https://resend.com/docs/dashboard/webhooks/verify-webhooks-requests)
* [Webhook event types](https://resend.com/docs/dashboard/webhooks/event-types)