SYGNEX GUARD / API

API documentation

The PHP connector makes a server-to-server request. Never put keys in JavaScript or the browser.

Before production: configure config/local.php, import install_guard.sql, create the administrator and test email delivery.

1. Installation

Create guard.sygnexproduction.com, enable HTTPS, and point its document root directly to the Guard files.
Import install_guard.sql into the central database that already contains the utilisateurs table.
Configure config/local.php and set a random installation token of at least 40 characters.
Open /admin/setup.php to create the first administrator, then sign in at /admin/index.php.
Create a site in the dashboard, copy its API key and secret once, and define its allowed recipients.
Install the PHP connector on the source site server. Never call the API from browser JavaScript.

2. PHP example

The connector is self-contained and uses native PHP HTTPS capabilities without a third-party library. It receives a JSON response. The form must submit fields from the server.

<?php
require_once __DIR__ . '/client-sdk/sygnex-guard-connector.php';
$guard = new SygnexGuardConnector(
    'YOUR_API_KEY',
    'YOUR_API_SECRET',
    'https://guard.sygnexproduction.com/api/intercept.php',
    'www.your-site.example'
);
$result = $guard->submit([
    'nom_expediteur' => $_POST['nom'] ?? '',
    'email_expediteur' => $_POST['email'] ?? '',
    'email_destinataire' => 'contact@your-site.example',
    'sujet' => $_POST['sujet'] ?? 'Website message',
    'corps_message' => $_POST['message'] ?? '',
    'langue' => 'fr',
    'website' => $_POST['website'] ?? '', // honeypot: keep empty
]);
if (!$result['ok']) {
    // Handle service or quota errors; never expose API secrets.
}

The website field must be hidden and remain empty when completed by a person.

3. API fields

Field	Required	Description
`api_key`	Yes	API identifier assigned to the site.
`api_secret`	Yes	Secret sent only server-to-server over HTTPS.
`site_domain`	Yes	Domain registered in the dashboard.
`nom_expediteur`	Yes	Sender name (maximum 150 characters).
`email_expediteur`	Yes	Valid reply email address.
`email_destinataire`	Yes	Must exactly match an address allowed for this site.
`sujet`	Yes	Maximum 255 characters.
`corps_message`	Yes	Message text (maximum 60,000 bytes).
`langue`	No	fr, en, de, it, zh or vi.
`website`	No	Honeypot field; must remain empty.
`pieces_jointes`	No	JSON array of name, mime and content_base64; formats and size are limited.

4. Common responses

200 sent — Sender already authorized; message delivered.
202 verification_required — Human verification required; a verification email is sent.
202 received — Intentionally neutral response for some anti-spam blocks.
401 unauthorized — Incorrect API key or secret.
403 recipient_not_allowed — Recipient is not authorized for this site.
429 rate_limited / monthly_quota_exceeded — Rate limit or monthly quota reached.
503 service_unavailable — Configuration, database or email sending unavailable.

5. Important operational limits

The application uses PHP native mail(). A successful function return does not guarantee inbox delivery. Check your hosting provider’s sending policies and configure SPF, DKIM and DMARC. MX/SPF/DMARC checks are indicative and do not cryptographically prove domain identity. The math challenge helps reduce automated spam but is not an infallible protection.

Attachments are base64-encoded and must follow the limits in config/local.php. Explicitly configure allowed recipients for each site; Guard rejects undeclared recipients.

6. Quotas and usage tracking

Initial reference limits are 100 protected messages per month for the Free plan and 1,000 for Premium. Enterprise uses a manually defined custom quota. Administrators can adjust quotas. The internal plan ignores the commercial message cap while remaining subject to technical safeguards and hosting resource limits.

Guard tracks protected messages separately from outbound emails actually accepted by mail(). Alerts are configured at 70%, 90% and 100%. Once the monthly quota is reached, new submissions for that plan are rejected until the month renews or the quota is changed. Verify actual sending capacity with the hosting provider before offering high-volume plans.