---
title: "Get"
method: GET
path: "/api/v1/settings/email-provider"
tags: ["Tenant Email Provider"]
---

# Get

`GET /api/v1/settings/email-provider`

Get retrieves the current tenant email provider configuration.

## Response `200`

Successful response

- C1ApiSettingsV1GetTenantEmailProviderResponse — The GetTenantEmailProviderResponse message.
  - `emailProvider` C1ApiSettingsV1TenantEmailProvider — TenantEmailProvider is the API representation of the tenant's email provider. This message contains a oneof named provider. Only a single field of the following list may be set at a time: - c1Builtin - awsSes - sendgrid - microsoftGraph - googleWorkspace
    - `awsSes` C1ApiSettingsV1AWSSESProviderConfig, nullable — AWSSESProviderConfig configures sending via a customer's AWS SES account.
      - `configurationSetName` string — Optional SES configuration set name for tracking/metrics.
      - `region` string — AWS region where SES identities are verified (e.g., "us-east-1").
      - `roleArn` string — IAM role ARN for sts:AssumeRole. The trust policy should require the tenant's AWS External ID (GET /api/v1/settings/aws-external-id).
    - `c1Builtin` C1ApiSettingsV1C1BuiltInProviderConfig, nullable — C1BuiltInProviderConfig selects the ConductorOne built-in email provider. Emails are sent from no-reply@conductorone.com via the platform SendGrid account. Only supports sending to C1 users — external email addresses are not supported. No configuration fields required.
    - `createdAt` string, date-time
    - `fromAddress` string — Sender email address. Must be verified with the provider. Ignored when using the C1 built-in provider (uses no-reply@conductorone.com).
    - `fromName` string — Sender display name shown in the recipient's inbox (e.g., "Acme Corp IT"). Used as the RFC 5322 display-name: "Acme Corp IT" <no-reply@acme.com>. Ignored when using the C1 built-in provider.
    - `googleWorkspace` C1ApiSettingsV1GoogleWorkspaceProviderConfig, nullable — GoogleWorkspaceProviderConfig configures sending via Google Workspace Gmail API using domain-wide delegation with a service account. Requires: customer Workspace super admin grants DWD to the service account's OAuth client ID for the gmail.send scope.
      - `delegatedUser` string — The Workspace user email to impersonate via domain-wide delegation. Typically a dedicated sender like noreply@customer.com.
      - `serviceAccountJson` string — Service account JSON credentials. Write-only: accepted on create/update, never returned in Get. Empty on update means "keep existing credentials".
    - `microsoftGraph` C1ApiSettingsV1MicrosoftGraphProviderConfig, nullable — MicrosoftGraphProviderConfig configures sending via Microsoft Graph sendMail API. Requires an Azure AD app registration with Mail.Send application permission (admin-consented).
      - `azureTenantId` string — Customer's Azure AD tenant ID (directory ID).
      - `clientId` string — App registration client ID with Mail.Send application permission.
      - `clientSecret` string — Client secret. Write-only: accepted on create/update, never returned in Get. Empty on update means "keep existing secret".
    - `replyToAddress` string — Optional reply-to address.
    - `sendgrid` C1ApiSettingsV1SendGridProviderConfig, nullable — SendGridProviderConfig configures sending via a customer's SendGrid account.
      - `apiKey` string — Customer's SendGrid API key. Write-only: accepted on create/update, never returned in Get. Empty on update means "keep existing key".
    - `updatedAt` string, date-time

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/d391405a35d3/schema)