Topolo Docs Topolo Platform
Open workspace

Verify sender profile

Check the chosen profile through app_topolo_nexus.email.profiles.list, as the caller: it must exist, be active, use a provider that reports bounces and complaints (resend or ses), be on a domain Nexus verified, and send from a subdomain (e.g. news.example.com) so marketing reputation stays off the root domain. Saves verified or failed with the problems.

Outcome

Check the chosen profile through app_topolo_nexus.email.profiles.list, as the caller: it must exist, be active, use a provider that reports bounces and complaints (resend or ses), be on a domain Nexus verified, and send from a subdomain (e.g. news.example.com) so marketing reputation stays off the root domain. Saves verified or failed with the problems.

Before you start

  • Verify identity and pin the intended organization and environment before discovering the action.
  • Discover a granted Nurture workspace. The application permission is workspace:write; required workspace access is admin. A permission alone does not supply a workspace grant.
  • Organization and workspace come from verified context. Select resourceType/resourceId separately from action input; body fields cannot grant a different organization or workspace. The first authorized product action can initialize an identity-only workspace mirror.
  • Obtain authorization for the documented effect or personal-data export before supplying CLI --confirm or MCP confirm:true.

Discover the target

topolo whoami --json
topolo actions get app_topolo_nurture.sending_settings.verify --detail --json
topolo resources topolo-nurture --json
topolo workspaces list topolo-nurture --json

Request

POST /api/sending-settings/verify

Save action input as payload.json. The reviewed plan separates path identifiers, query fields and HTTP body. Set NURTURE_WORKSPACE_ID from granted resource discovery; it is separate from action input.

Inspect and test this action in the signed action console. A test response still requires the verification below.

Input fields

Use an empty JSON object; verified credential and resource context are separate.

Exact input schema:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

Effects

  • Reads Nexus profiles and stores the verification outcome; sends use the sender only while it is verified.

Interpret the response

The returned identifier path is $.sending.profileId for sending_settings. Empty lists do not discover a target.

Confirm $.sending.verificationStatus is verified and $.sending.problems is empty.

Exact success schema:

{
  "type": "object",
  "required": [
    "sending"
  ],
  "properties": {
    "sending": {
      "type": "object",
      "required": [
        "configured",
        "profileId",
        "verificationStatus",
        "problems",
        "queued",
        "backgroundSending"
      ],
      "properties": {
        "configured": {
          "type": "boolean"
        },
        "profileId": {
          "type": [
            "string",
            "null"
          ]
        },
        "verificationStatus": {
          "type": [
            "string",
            "null"
          ],
          "enum": [
            "unverified",
            "verified",
            "failed",
            null
          ]
        },
        "problems": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "profile_not_found",
              "profile_inactive",
              "feedback_provider_required",
              "domain_unverified",
              "marketing_subdomain_required"
            ]
          }
        },
        "sender": {
          "type": [
            "object",
            "null"
          ],
          "properties": {
            "fromEmail": {
              "type": [
                "string",
                "null"
              ]
            },
            "fromName": {
              "type": [
                "string",
                "null"
              ]
            },
            "provider": {
              "type": [
                "string",
                "null"
              ]
            },
            "sendingDomain": {
              "type": [
                "string",
                "null"
              ]
            }
          }
        },
        "verifiedAt": {
          "type": [
            "string",
            "null"
          ]
        },
        "updatedAt": {
          "type": [
            "string",
            "null"
          ]
        },
        "updatedBy": {
          "type": [
            "string",
            "null"
          ]
        },
        "queued": {
          "type": "object",
          "additionalProperties": {
            "type": "integer"
          }
        },
        "backgroundSending": {
          "type": "object",
          "properties": {
            "available": {
              "type": "boolean"
            },
            "detail": {
              "type": "string"
            }
          }
        },
        "deliveryEvents": {
          "type": "object",
          "required": [
            "mode",
            "connected",
            "missing"
          ],
          "properties": {
            "mode": {
              "type": "string",
              "enum": [
                "events",
                "polling"
              ]
            },
            "connected": {
              "type": "array",
              "items": {
                "type": "string"
              }
            },
            "missing": {
              "type": "array",
              "items": {
                "type": "string"
              }
            }
          }
        }
      }
    },
    "checkedWith": {
      "type": "string"
    }
  }
}

Worked examples

Actual dispatcher and migration-created SQLite or Worker handlers; identity/workspace and external service dependencies are simulated. Fixture identifiers and timestamps are synthetic. These responses establish no live authorization, paid generation, credential provisioning or message delivery. Replace synthetic identifiers using credential-scoped discovery. A local success is not evidence of a deployed effect, configured provider or delivered message.

Successful request

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_nurture.sending_settings.verify --data @payload.json --json
topolo actions plan app_topolo_nurture.sending_settings.verify --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_nurture.sending_settings.verify --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_nurture.sending_settings.verify",
    "input": {},
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "sending": {
    "configured": true,
    "profileId": "prf_news",
    "verificationStatus": "verified",
    "problems": [],
    "sender": {
      "fromEmail": "hello@news.example.com",
      "fromName": "Example",
      "provider": "resend",
      "sendingDomain": "news.example.com"
    },
    "verifiedAt": "2026-10-01T09:00:00.000Z",
    "updatedAt": "2026-10-01T09:00:00.000Z",
    "updatedBy": "u1",
    "queued": {},
    "backgroundSending": {
      "available": false,
      "detail": "No published app service credential for Nexus (Auth item item_1790858079922_tuvijcbi0): background sends stay queued."
    },
    "deliveryEvents": {
      "mode": "polling",
      "connected": [],
      "missing": [
        "nexus.email.delivered",
        "nexus.email.bounced.hard",
        "nexus.email.bounced.soft",
        "nexus.email.complained",
        "nexus.email.replied",
        "nexus.email.auto_reply",
        "nexus.email.unsubscribed"
      ]
    }
  },
  "checkedWith": "app_topolo_nexus.email.profiles.list"
}

HTTP 200. Confirm $.sending.verificationStatus is verified and $.sending.problems is empty.

Another supported request

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_nurture.sending_settings.verify --data @payload.json --json
topolo actions plan app_topolo_nurture.sending_settings.verify --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_nurture.sending_settings.verify --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --confirm --json

MCP tool and arguments:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_nurture.sending_settings.verify",
    "input": {},
    "resourceType": "workspace",
    "resourceId": "<identifier returned by resource discovery>",
    "confirm": true
  }
}

Captured local response · HTTP 200:

{
  "sending": {
    "configured": true,
    "profileId": "prf_unknown",
    "verificationStatus": "failed",
    "problems": [
      "profile_not_found"
    ],
    "sender": null,
    "verifiedAt": null,
    "updatedAt": "2026-10-01T09:00:00.000Z",
    "updatedBy": "u1",
    "queued": {},
    "backgroundSending": {
      "available": false,
      "detail": "No published app service credential for Nexus (Auth item item_1790858079922_tuvijcbi0): background sends stay queued."
    },
    "deliveryEvents": {
      "mode": "polling",
      "connected": [],
      "missing": [
        "nexus.email.delivered",
        "nexus.email.bounced.hard",
        "nexus.email.bounced.soft",
        "nexus.email.complained",
        "nexus.email.replied",
        "nexus.email.auto_reply",
        "nexus.email.unsubscribed"
      ]
    }
  },
  "checkedWith": "app_topolo_nexus.email.profiles.list"
}

HTTP 200. Confirm $.sending.verificationStatus is verified and $.sending.problems is empty.

Refused request · permission_denied

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_nurture.sending_settings.verify --data @payload.json --json
topolo actions plan app_topolo_nurture.sending_settings.verify --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 403:

{
  "error": {
    "code": "permission_denied",
    "message": "The credential lacks workspace:write.",
    "details": {
      "requiredPermission": "workspace:write"
    }
  }
}

HTTP 403. Preserve the refusal details and do not claim success.

Refused request · sending_not_configured

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_nurture.sending_settings.verify --data @payload.json --json
topolo actions plan app_topolo_nurture.sending_settings.verify --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 409:

{
  "error": {
    "code": "sending_not_configured",
    "message": "Choose a Nexus sender profile with sending_settings.update first."
  }
}

HTTP 409. Preserve the refusal details and do not claim success.

Refused request · nexus_unavailable

Actual dispatcher and migration-created SQLite; verified identity/workspace and external CRM, Engage, Notify, Consent, Nexus, Brand, Generator, Voice and delivery dependencies are simulated. No live authorization, paid generation or external delivery is established.

Input · payload.json:

{}

CLI:

topolo actions validate app_topolo_nurture.sending_settings.verify --data @payload.json --json
topolo actions plan app_topolo_nurture.sending_settings.verify --resource-type workspace --resource-id "$NURTURE_WORKSPACE_ID" --data @payload.json --json

Captured local response · HTTP 503:

{
  "error": {
    "code": "nexus_unavailable",
    "message": "Nexus email is not configured for Nurture, or the request carried no credential to call it with."
  }
}

HTTP 503. Preserve the refusal details and do not claim success.

Verify the result

  • Confirm $.sending.verificationStatus is verified and $.sending.problems is empty.

Errors and recovery

  • organization_required (HTTP 403): Select an organization available to the verified caller before choosing a Nurture workspace.
  • permission_denied (HTTP 403): Grant the credential the required Nurture workspace permission.
  • workspace_required (HTTP 409): Create a Nurture workspace, or pass the workspace resource context.
  • invalid_input (HTTP 422): Correct the fields named in error.details using inputSchema, then retry.
  • sending_not_configured (HTTP 409): Choose a profile with app_topolo_nurture.sending_settings.update first.
  • nexus_unavailable (HTTP 503): Call again with a user credential; interactive calls reach Nexus as the caller.
  • nexus_error (HTTP 502): Read error.details.code: grant the caller app_topolo_nexus email:read, or retry later if Nexus was unavailable.

Auth or gateway failures may precede this handler. Preserve the exact response shape, error string/code, request id and credential context; no synthetic fixture establishes live credential access.

Recovery boundary

Fix the profile in Nexus (or choose another) and verify again.

  • Get sending settings: Read this workspace's Nexus sender profile, whether it is verified as a marketing-class sender (problems lists why not), the sender, queued sends per reason, and whether delivery outcomes come from Nexus events or polling. With no sender configured Nurture only records sends (nothing is emailed). Marketing attests the latest double opt-in, repermission or consent-decision record for the topic as Nexus consent; without one (import attestation only) it skips with no_consent_evidence. Background sends (journeys, broadcasts, confirmations from hosted pages) use the Nurture app service credential; only when it is missing do they wait in the outbox (queued.blocked_no_service_credential), and they are never dropped. deliveryEvents.mode is events once all seven nexus.email.* types are connected through event_sources.connect (sourceAppId app_topolo_nexus), else polling (deliveries.reconcile). Events cover background sends too: Nexus addresses a send with no person behind it to app:<app_id>.
  • Choose sender profile: Choose the Nexus email profile (an id from app_topolo_nexus.email.profiles.list) that this workspace sends as, or null to stop sending through Nexus (sends are then recorded only). A new profile starts unverified and nothing is emailed until sending_settings.verify passes.

Evidence

Actual dispatcher and migration-created SQLite or Worker handlers; identity/workspace and external service dependencies are simulated. Fixture identifiers and timestamps are synthetic. These responses establish no live authorization, paid generation, credential provisioning or message delivery. Test scenario and capture digests are retained with each fixture.