Base URL
https://app.dmu.email/api/v1
Authentication
Bearer dmk_… API key
Rate limit
120 requests a minute per key

Update a draft

PATCH/drafts/{id}

Changes a draft’s recipients, subject or body. What you leave out stays as it is.

Needs the permissiondrafts:update

A list you send replaces the one there, and bodyHtml replaces the whole body, signature and quote included.

If somebody has the draft open in DMU Mail, you get 409 draft_locked: what they’re typing isn’t overwritten.

Path parameters

idstringrequired
The draft.

Body

tolist of stringsoptional
With cc and bcc: new recipients.
subjectstringoptional
A new subject.
bodyHtmlstringoptional
A new body.

Returns

idstring
The draft.
tolist of strings
With cc and bcc: its recipients.
subjectstring
Its subject.
bodyHtmlstring
Its body, sanitised.
updatedAtstring
When it last changed.

Errors

401invalid_key
The key is wrong, expired or revoked. With no Authorization header at all, the code is missing_credentials.
403missing_scope
The key doesn’t have drafts:update. The X-Required-Scope header names what’s missing.
404not_found
There’s no such draft, or the key’s owner can’t see it.
409draft_locked
Somebody has the draft open in DMU Mail, or it has been sent.
429rate_limited
More than 120 requests a minute from this key. Wait for Retry-After seconds.
curl https://app.dmu.email/api/v1/drafts/8c1e2f4a \
  -X PATCH \
  -H "Authorization: Bearer dmk_7f3a9c2e1b4d_Xq8v…" \
  -H "Content-Type: application/json" \
  -d '{ "subject": "Your delivery is booked for Tuesday" }'

Response

200 OK

{
  "data": {
    "id": "8c1e2f4a",
    "to": ["maria@example.com"],
    "cc": [],
    "bcc": [],
    "subject": "Your delivery is booked for Tuesday",
    "bodyHtml": "<p>Your delivery is booked for Tuesday.</p><p>Aegean Freight</p>",
    "updatedAt": "2026-09-27T09:16:40.000Z"
  }
}

Every response wraps its result in data. A page of threads adds nextCursor, which is null on the last page.