Sandbox sends to unconfirmed recipients are now refused

October 13, 2026

A real POST /v1/send from a developer sandbox to a recipient that is not on the allowlist is now refused with 403 and code: "sandbox_outbound_locked" (a locked sandbox, the default) or "sandbox_recipient_denied" (after an explicit unlock), exactly as SMTP already does. Previously the message was silently redirected to your own account address.

What the response contains

denied: the recipients that are not allowed.
allowlist: the recipients that are.
A nextAction telling you how to allow the recipient.

A list that mixes allowed and denied recipients is refused as a whole; nothing is delivered. The monthly sandbox limit is unchanged and still returns 429 with code: "sandbox_monthly_limit".

How to allow a recipient. Request confirmation for the address (the motorical_sandbox_allowlist_request and motorical_sandbox_allowlist_confirm tools, or POST /api/developer/sandbox/allowlist/request and /confirm), then send again.

Deprecation. The sandboxRedirect field in the /v1/send response is deprecated and is no longer returned. If your code reads it, handle the 403 refusal instead.