Tenant Reputation (Cloud)

AWS SES Virtual Deliverability Manager (VDM) reputation tracking per-workspace. Each cloud workspace maps to a dedicated SES Tenant in each region, isolating reputation between customers.

On the cloud edition, each workspace is provisioned a dedicated AWS SES Tenant per region (named ph-{first 12 chars of workspace UUID}). This isolates the workspace's sending reputation from every other workspace — a high bounce rate from one customer can't sink another's deliverability.

How it works:

On first domain add to a region, Posthawk calls PutAccountVdmAttributes (idempotent) to enable VDM, then creates an SES Tenant + Configuration Set named ph-{uuid12}
Every send via API or SMTP includes TenantName + ConfigurationSetName so SES routes the metrics to the workspace's tenant
AWS SES tracks bounce/complaint/delivery rates per-tenant and surfaces "findings" (warnings, recommendations) when reputation drifts
When the last domain in a region is deleted, the tenant + config set are torn down

Tenant status:

ENABLED — sending allowed (green)
PAUSED — AWS paused the tenant due to reputation issues (red)
ENFORCED — same as paused, customer must take action (red)
DISABLED — never enabled / cleaned up (yellow)

Cost: VDM adds $0.07 per 1,000 emails on top of the standard SES rate.

GET/tenants/status

Get the tenant status for every region this workspace has domains in. Used by the dashboard domain cards to show the reputation badge.

Authorizations

Authorizationstring · headerrequired

Bearer authentication header of the form Bearer <token>, where <token> is your JWT.

GET /tenants/status

curl https://api.posthawk.dev/tenants/status \
  -H "Authorization: Bearer your_jwt_token"

Response

{
  "success": true,
  "data": [
    {
      "ses_region": "us-east-1",
      "tenant_name": "ph-1f3a8c2d6f4b",
      "configuration_set_name": "ph-1f3a8c2d6f4b",
      "sending_status": "ENABLED",
      "domain_count": 3,
      "last_checked_at": "2026-04-28T10:00:00Z"
    },
    {
      "ses_region": "eu-north-1",
      "tenant_name": "ph-1f3a8c2d6f4b",
      "sending_status": "ENABLED",
      "domain_count": 1,
      "last_checked_at": "2026-04-28T10:00:00Z"
    }
  ]
}

GET/tenants/:region/findings

Get the active VDM findings (warnings, recommendations) for a workspace tenant in a specific region. AWS SES surfaces these when bounce/complaint rates trend toward thresholds.

Authorizations

Authorizationstring · headerrequired

Bearer authentication header of the form Bearer <token>, where <token> is your JWT.

Path Parameters

regionstringrequired

AWS SES region (us-east-1 | eu-north-1)

GET /tenants/:region/findings

curl https://api.posthawk.dev/tenants/{region}/findings \
  -H "Authorization: Bearer your_jwt_token"

Response

{
  "success": true,
  "data": [
    {
      "finding_type": "BOUNCE_RATE",
      "severity": "WARNING",
      "rate": 0.038,
      "threshold": 0.05,
      "message": "Bounce rate is approaching 5% (SES auto-pause threshold).",
      "detected_at": "2026-04-27T22:00:00Z"
    }
  ]
}

POST/tenants/backfill-event-destinations

Admin/maintenance endpoint. Re-applies the SNS event destination on every workspace tenant's configuration set. Used after changing the SNS topic or recovering from a partial provisioning failure. Idempotent.

Authorizations

Authorizationstring · headerrequired

Bearer authentication header of the form Bearer <token>, where <token> is your JWT.

POST /tenants/backfill-event-destinations

curl -X POST https://api.posthawk.dev/tenants/backfill-event-destinations \
  -H "Authorization: Bearer your_jwt_token"

Response

{
  "success": true,
  "data": { "tenants_updated": 12, "errors": 0 }
}

Deliverability & Warm-up

Domains