# Apply a sendops.json bundle, dry run by default

`POST /v1/import`

- Authentication: required (Bearer token)

Applies a bundle — the same shape `GET /v1/export` produces — through
the ordinary authoring services. Every object goes through the method
the dashboard and MCP call, so optimistic concurrency, version snapshots
with actor identity, save-time segment evaluation and inline SES deploy
all apply.

**`dry_run` defaults to `true`.** A call that omits it returns the plan
and writes nothing. That default is deliberate: this route is reached by
pipelines, and a misconfigured job should print a plan rather than
rewrite an organization.

**`prune` defaults to `false`.** With `prune=true`, objects the org has
and the bundle omits are archived (segments, lists, topics, workflows)
or deleted (attributes, activity properties) — and an attribute a
remaining segment or workflow still references is `skip`ped with
`referenced_by` naming what blocked it, never deleted. Pruning applies
only to sections the bundle actually declares: a templates-only push
never archives an audience. Images are never pruned, because mail
already delivered renders from the URLs they back.

**Applicable or nothing.** If any object fails validation the response
carries the full plan with `applicable: false` and every diagnostic
positioned by line and column, and NOTHING is written — not even the
objects that passed.

**Idempotent.** Applying the same bundle twice yields an all-`unchanged`
plan and writes nothing on the second run.

**Apply order**, which is also the order the plan lists objects in:
attributes → activity properties → lists → segments → topics → images →
templates → workflows. Each step's validation needs the previous step's
rows; images precede templates because a template deploys with its image
URLs embedded. A workflow created by an import lands as a **draft**; an
existing active workflow updated by one stays active.

**Partial results are reported honestly.** The services open their own
transactions, so a failure part-way leaves the earlier kinds written.
`applied_until` names the last kind that completed and `error` says what
stopped it.

**Body.** Either a zip archive (`Content-Type: application/zip`, or any
body starting with the zip magic number) or the JSON form. The JSON form
may also carry `dry_run` and `prune` as top-level fields, for clients
building one document; the query parameter wins when both are given.

**Scopes.** Each kind the bundle CONTAINS needs that kind's `.manage`
scope (`api.templates.manage`, `api.segments.manage`,
`api.lists.manage`, `api.topics.manage`, `api.attributes.manage`,
`api.activities.manage`, `api.workflows.manage`, `api.assets.manage`).
A bundle of templates alone needs only `api.templates.manage`; a missing
scope is a `403` that names it.

## Query parameters

- `dry_run` (boolean, optional) — Plan only, writing nothing. Defaults to true — an unparseable value is a 422 rather than a silent fallback.
- `prune` (boolean, optional) — Archive or delete objects the org has and the bundle omits, within the sections the bundle declares.

## Request body

Content type: `application/json`

```json
{
  "manifest": {},
  "files": {},
  "images": {},
  "dry_run": true,
  "prune": true
}
```

## Example request

```bash
curl -X POST 'https://api.sendops.dev/v1/import' \
  -H "Authorization: Bearer $SENDOPS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"manifest":{},"files":{},"images":{},"dry_run":true,"prune":true}'
```

## Responses

### 200 — The plan, and on an apply the per-object results. `200` even when
`applicable` is false: the plan is the answer to the request, and a
bundle that does not apply is a result to read, not a malformed
call.

Content type: `application/json`

```json
{
  "dry_run": true,
  "plan": {
    "applicable": true,
    "prune": true,
    "objects": [
      {
        "kind": "template",
        "key": "welcome",
        "path": "templates/welcome.html",
        "action": "create",
        "reason": "string",
        "referenced_by": [
          "segment high-value",
          "workflow onboarding"
        ],
        "diagnostics": [
          {
            "path": "audience/workflows/onboarding.flow",
            "line": 12,
            "column": 3,
            "message": "unknown template \"welcom\""
          }
        ]
      }
    ],
    "totals": {
      "create": 12,
      "unchanged": 40
    },
    "diagnostics": [
      {
        "path": "audience/workflows/onboarding.flow",
        "line": 12,
        "column": 3,
        "message": "unknown template \"welcom\""
      }
    ]
  },
  "applied": true,
  "objects": [
    {
      "kind": "string",
      "key": "string",
      "action": "string",
      "reason": "string",
      "referenced_by": [
        "string"
      ],
      "deploy_state": "pending",
      "member_count": 0,
      "requires": [
        {
          "kind": "template",
          "key": "string",
          "status": "ok",
          "detail": "string",
          "fix": "string"
        }
      ],
      "error": "string"
    }
  ],
  "applied_until": "lists",
  "error": "string"
}
```

### 401 — Missing, malformed, or unknown API key

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 403 — Either the credential lacks the required scope (`code: invalid_scope`), or it is bound to the `test` environment and this operation is irreversible (`code: test_environment_forbidden`). Branch on `code`: the first is fixed by granting the scope, the second only by using a live credential. See the "Live and test credentials" section of the API description.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 413 — A query parameter, path value or body field failed validation.

The body is a `validation_failed` Problem. When the refusal is about a
reference — a segment key, template slug, topic or attribute name the
organization does not have — it additionally carries `validation_code`,
`field`, `line`/`column`, `missing`, `candidates` and `next_step`, so a
client can correct the call without a second round of guessing. See
`ValidationProblem`.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ],
  "validation_code": "invalid_syntax",
  "field": "string",
  "line": 0,
  "column": 0,
  "missing": [
    {
      "kind": "segment",
      "key": "string"
    }
  ],
  "candidates": {},
  "next_step": "string"
}
```

### 422 — A query parameter, path value or body field failed validation.

The body is a `validation_failed` Problem. When the refusal is about a
reference — a segment key, template slug, topic or attribute name the
organization does not have — it additionally carries `validation_code`,
`field`, `line`/`column`, `missing`, `candidates` and `next_step`, so a
client can correct the call without a second round of guessing. See
`ValidationProblem`.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ],
  "validation_code": "invalid_syntax",
  "field": "string",
  "line": 0,
  "column": 0,
  "missing": [
    {
      "kind": "segment",
      "key": "string"
    }
  ],
  "candidates": {},
  "next_step": "string"
}
```

### 429 — Per-org rate limit exceeded

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 500 — Unexpected server-side failure. The `code` is `internal_error`. The
`request_id` field can be quoted to SendOps support to investigate.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```