The Equity Release Guide — Master Suppression List

Integration guide for email partners. Version 1.1.

What this is. Smarter Clicks Marketing Ltd maintains one master list of every person who has opted out of The Equity Release Guide marketing, across every partner. Two obligations apply to every partner mailing our offers:

Before every send, apply the current master suppression list to your file.
When anyone unsubscribes from you, tell us immediately via the API below.

1. Apply the master list before every send

You will be sent a private feed URL and an API key. Both are required — the URL alone will return "Not found". Send the key as an Authorization: Bearer header:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://suppression.theequityreleaseguide.co.uk/feed/YOUR_FEED_KEY/md5.txt"

If your platform cannot set headers on a scheduled fetch, append ?api_key=YOUR_API_KEY instead.

The feed is hashed by default. You receive MD5 or SHA-256 hashes rather than readable addresses. To apply it: lowercase and trim each address in your file, hash it with the same algorithm, and suppress any that appear in the list. This protects the people on it if a feed URL is ever mishandled — and it costs you nothing, because suppression is a matching operation either way.

URL ending	Contents	Availability
`/md5.txt`	MD5 hashes of the lowercased address, one per line	Always
`/sha256.txt`	SHA-256 hashes, one per line	Always
`/latest.json`	Hashes plus a sync cursor	Always
`/emails.txt`	Plaintext addresses, one per line	On request
`/emails.csv`	`email,md5,sha256,suppressed_at`	On request

If your platform genuinely cannot accept a hashed suppression list, contact us and we will enable plaintext for your account.

Incremental pulls

Every response carries an X-ERG-Cursor header. Pass it back as ?since= to fetch only what has been added since:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://suppression.theequityreleaseguide.co.uk/feed/YOUR_FEED_KEY/md5.txt?since=48210"

Pull at least once every 24 hours, and always immediately before a send. Every download is logged.

Treat your feed URL and API key as confidential. They identify your account, every download against them is attributed to you, and either can be revoked and reissued on request. Do not paste them into shared channels or ticketing systems.

2. Send us every new unsubscribe

The moment someone opts out of your list — via your unsubscribe link, the list-unsubscribe header, or a spam complaint — POST it here.

POST https://suppression.theequityreleaseguide.co.uk/api/v1/unsubscribe
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{"email": "person@example.com"}

Batch

{"emails": ["one@example.com", "two@example.com"]}

Response

{"ok": true, "received": 1, "added": 1, "duplicate": 0, "invalid": 0}

Point your ESP webhook straight at it

You do not need to reformat anything. The endpoint reads the common payload shapes from SendGrid, Klaviyo, Mailchimp, Iterable, Ongage and Maropost, and it ignores non-opt-out events (opens, clicks, deliveries) automatically. If your platform cannot set an Authorization header on a webhook, append ?api_key=YOUR_API_KEY to the URL instead.

Do not batch these up weekly. Gmail and Yahoo require opt-outs to be honoured within 48 hours, and UK PECR requires opt-outs to be actioned promptly. Real time is expected.

3. Alternative — send us your list instead

If you would rather not hold a copy of our suppression list at all, do it the other way round: send us your file and we return only the addresses that are safe to mail. Nothing of ours leaves our server.

POST https://suppression.theequityreleaseguide.co.uk/api/v1/check
Authorization: Bearer YOUR_API_KEY

{"emails": ["a@x.com", "b@y.com"]}

{"ok": true, "checked": 2, "suppressed": ["a@x.com"], "safe_to_send": ["b@y.com"]}

Up to 5000 addresses per request. You can also check a single address:

GET https://suppression.theequityreleaseguide.co.uk/api/v1/check?email=person@example.com
Authorization: Bearer YOUR_API_KEY

{"ok": true, "suppressed": false, "safe_to_send": true}

Hashes work here too — pass {"hashes": ["<md5>", ...]} and no readable address crosses the wire in either direction.

4. Confirm your integration works

curl -s https://suppression.theequityreleaseguide.co.uk/api/v1/status -H "Authorization: Bearer YOUR_API_KEY"

Returns your agency name, the current list size and your feed URLs. If that responds, you are live.

Errors

Code	Meaning
`404`	Feed URL and API key do not match, or one is missing — both are required
`403`	Plaintext not enabled for your account (use the hashed feed), or your IP is not allowlisted
`401`	Missing or wrong API key
`400`	No valid email address found in the payload
`413`	Batch over 5000 addresses — split it
`429`	Rate limited — batch your submissions
`5xx`	Our side. Retry with backoff; do not drop the opt-out.

Data protection

Addresses submitted here are used solely to suppress future marketing, never for sending. The feed exists so that a person who opts out once is not contacted again by any partner.

Because this list identifies real people who have asked not to be contacted, access is deliberately narrow: two factors are required for every download, hashed formats are the default, downloads can be restricted to your sending IPs on request, and every access is logged and attributed. We ask that you apply the same care at your end — restrict who can see the credentials, do not merge the list with any other data, do not use it for appending or profiling, and delete it when our arrangement ends.