> ## Documentation Index > Fetch the complete documentation index at: https://support.configview.com/llms.txt > Use this file to discover all available pages before exploring further. # Mailgun setup ConfigView reads your Mailgun account through the Mailgun API, using a single **API key** that a Mailgun admin creates. The key is sent as HTTP Basic auth (user `api`, the key as the password). You will end up with **1 required secret** (`MAILGUN_API_KEY`) and **1 optional secret** (`MAILGUN_REGION`, only for EU accounts) in ConfigView when setup is complete. > **Scope of this integration today.** ConfigView answers "who can send and receive email through our Mailgun account": team members and their roles, API keys (kind, role, creator, expiry), sending domains and whether their SPF and DKIM records are verified, SMTP logins per domain, webhooks (where Mailgun posts events), inbound routes and forward rules (where mail is sent), subaccounts and the API IP allowlist. It never reads message content, mailing lists, templates, logs or suppression lists, and never stores a key value or SMTP password. ConfigView only reads. It never creates, changes or deletes anything in Mailgun. *** ## What you need * A Mailgun account and a user who can create API keys (an Admin) * To know whether your account is in the **US** or the **EU** region. The EU region uses a different API host and a key from one region is rejected by the other *** ## Step 1: Open the Mailgun page in ConfigView Open ConfigView in a second browser tab and leave it open: `https://{companyname}.configview.com/admin/integrations/mailgun` *** ## Step 2: Create an API key 1. Sign in to Mailgun and open **Settings → API Keys** 2. Click **Add API key**, name it `ConfigView` and choose a **role** (see the table below). If your plan does not offer role-based keys, the button is not there: you can only use the primary account API key, which has full access 3. Copy the key straight away. Mailgun shows it once 4. Switch to the ConfigView tab, paste it into `MAILGUN_API_KEY` under **Credentials** and click the save icon. Paste only the key, without `api:` in front 5. **EU accounts only:** enter `EU` in `MAILGUN_REGION`. Leave it empty for the US region ### Which role to give the key No single read-only role reads everything in Mailgun, so you choose how much ConfigView can see. ConfigView only ever sends read requests, whichever role you pick. | Role | What ConfigView can collect | Can the key change things? | | - | - | - | | **Analyst** (read-only, recommended to start) | Domains and their DNS verification state, tracking settings, webhooks, routes, forward rules, subaccounts, API IP allowlist | No | | **Developer** | Everything above plus **API keys** and **SMTP credentials** | Yes. The role can write to domains, routes and more | | **Admin** | Everything, including the **user list** (only Admin can list users) | Yes. Full control of the account | Roles cannot be changed after a key is created. To widen access, create a new key and revoke the old one. Mailgun's role-based keys are only available on some plans. Give ConfigView its own key rather than sharing one with a script or a sending application. Then you can see exactly what it can do and revoke it without breaking anything else. *** ## Step 3: Connect and verify 1. Back on `https://{companyname}.configview.com/admin/integrations/mailgun`, confirm the credentials show as saved 2. Click **Connect**. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don't want under **Collectors**: | Script | Notes | | - | - | | **Users** | Seats on the account with role, owner flag, activated or disabled, two-factor status and password age. Needs an Admin key. | | **API Keys** | Keys with kind, role, domain, creator, created and expiry dates, disabled state. Needs a Developer or Admin key. Key values are never returned. | | **Domains** | Each sending domain (subaccounts included) with state, spam action, TLS and DNS record state for SPF, DKIM, MX and the tracking CNAME. Makes one extra request per domain. | | **Domain Tracking Settings** | Open, click and unsubscribe tracking per domain. One request per domain. | | **SMTP Credentials** | SMTP login names and creation dates per domain. Needs a Developer or Admin key. One request per domain. | | **Webhooks** | Where Mailgun posts events: host and scheme only, per domain and account level. | | **Routes** | Inbound routing rules with their recipient pattern and forward, store and stop actions, flagging destinations outside your own domains. | | **Forward Rules** | The newer forward rules per domain, with the same outside-destination flag. | | **Subaccounts** | Subaccounts with status and enabled features. | | **API IP Allowlist** | The addresses allowed to call the API. | 3. Click **Verify now**. The health check reads the secrets, calls `/v4/domains` (every role can read it), and then tries one request to each of the other areas. If a check fails: * **Mailgun API fails with 401.** The key is wrong, was revoked, or belongs to the other region. If your account is in the EU, set `MAILGUN_REGION` to `EU`. * **MAILGUN\_REGION is not recognised.** Use `US` or `EU`, or leave it empty. * **Users, API keys or SMTP credentials show as skipped.** The key's role cannot read them (see the role table). Create a key with a wider role if you want that area; otherwise there is nothing to fix. * **Forward rules or account webhooks show as skipped.** The feature is not on your account. *** ## Data Tables Once the scripts run, these tables are created in your database. Each table has a `run_at` column and a `raw_json` column, which holds the record as Mailgun returned it, minus anything listed under *What isn't collected*. Each table keeps only the newest run. | Table | Source | Key Columns | | - | - | - | | `mailgun_users` | `GET /v5/users` | user\_id, name, email, role, is\_account\_owner, is\_activated, is\_disabled, tfa\_enabled, password\_updated\_at | | `mailgun_api_keys` | `GET /v1/keys` | key\_id, description, key\_kind, role, domain\_name, requestor, created\_at, expires\_at, has\_expiry, is\_disabled | | `mailgun_domains` | `GET /v4/domains` and `/v4/domains/{name}` | domain\_name, domain\_state, spam\_action, require\_tls, spf\_state, dkim\_state, tracking\_cname\_state, invalid\_records, subaccount\_id | | `mailgun_domain_tracking` | `GET /v3/domains/{name}/tracking` | domain\_name, open\_tracking, click\_tracking, unsubscribe\_tracking, web\_scheme | | `mailgun_smtp_credentials` | `GET /v3/domains/{name}/credentials` | domain\_name, login, is\_postmaster, created\_at | | `mailgun_webhooks` | `GET /v3/domains/{name}/webhooks` and `/v1/webhooks` | webhook\_scope, domain\_name, event\_name, url\_host, is\_https | | `mailgun_routes` | `GET /v3/routes` | route\_id, priority, recipient\_pattern, forward\_emails, forward\_url\_hosts, external\_email\_count, has\_store, has\_stop | | `mailgun_forwards` | `GET /v3/forwards` | forward\_id, domain\_name, match\_pattern, recipients, external\_recipient\_count, url\_hosts | | `mailgun_subaccounts` | `GET /v5/accounts/subaccounts` | subaccount\_id, name, account\_status, enabled\_features | | `mailgun_ip_allowlist` | `GET /v2/ip_whitelist` | ip\_address, description | *** ## Things worth knowing **Check the role before you read the results.** A table that is empty because the key's role cannot read it looks the same as one with no records. The health check says which areas were skipped. **There is no DMARC in the Mailgun API.** Mailgun reports the state of the SPF, DKIM, MX and tracking CNAME records it asks you to publish. DMARC is a record you publish on your own DNS and Mailgun does not track it, so ConfigView cannot tell you whether a Mailgun domain has a DMARC policy. **Domain state and DNS state.** A domain is `active` once Mailgun has verified it. The per-record states (`valid`, `invalid`, `unknown`) are what Mailgun last saw; a record that was valid can turn invalid when DNS changes. `invalid_records` lists which ones. **Routes are where inbound mail goes.** A `forward(...)` action sends a copy of matching inbound mail to an address or a URL. ConfigView flags destinations that are not on a domain you send from (for example a personal mailbox). "Own" is judged by the last two labels of your Mailgun domains, so it can be wrong for suffixes such as `.co.uk`. **SMTP credentials are names only.** Mailgun returns the login, mailbox and creation date. Passwords cannot be read back. **No usage or audit history.** The API reports no last-used time for keys, no sign-in time for users and no audit log, so ConfigView cannot flag keys by last use or users by inactivity. **Rate limit.** Mailgun allows 500 requests every 10 seconds for the whole account, shared with your own sending integrations. Each ConfigView collector paces itself at 300 requests a minute and waits when Mailgun answers 429. Domains, tracking settings, SMTP credentials and webhooks make a request per domain. ## What isn't collected * API key values, SMTP passwords and the HTTP webhook signing key. The domain list returns each domain's `smtp_password`; it is dropped before anything is stored * The full URL of a webhook, route or forward destination. Only its host is stored, because a path or query string can carry a secret * DNS record values (for example the DKIM public key), the unsubscribe footer text, each user's last sign-in IP and preferences * Messages, logs, events, suppressions, mailing lists, templates, validations and metrics This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.