The loop, and where it stops being fine
For a handful of personalised messages, the honest answer is a loop: one POST per recipient, each with its own message ID and its own delivery events. Clean, trackable, done.
for user in users: requests.post( "https://api.nitrosend.com/v1/my/messages", headers={"Authorization": "Bearer $NITROSEND_API_KEY"}, json={"from": "[email protected]", "to": user["email"], "subject": f"Welcome, {user['name']}", "html": user["body"]}, )
Bulk on the transactional path is a trap
Here is the line I hold: a bulk send should not be built on the transactional messages path. That is a deliverability and compliance trap. Transactional infrastructure is tuned and trusted for one-to-one, event-triggered mail; push a thousand marketing messages through it and you burn the reputation your receipts depend on, with no unsubscribe handling to keep you legal.
Real lists go through campaigns: import the contacts, define the segment, send once, and let the platform handle suppression, unsubscribes, and per-recipient events.
Under the hood, a campaign resolves its recipients into a durable outbox in 5,000-row batches before anything fires, so the send phase reads from a prepared queue instead of segmenting mid-flight. Rate limits bracket the same design: the free plan caps at 200 emails an hour, while a warmed, trusted domain at the other end clears 500,000 messages in about an hour and a half. The platform is built so the wire is the bottleneck, never the queue.
I hold this line because I've watched it get tested. A spammer once bought a paid plan specifically to shove bulk mail through our transactional path, because that path is documented to skip warmup, CAN-SPAM footers, and List-Unsubscribe. That is exactly the loophole your own bulk loop exploits, against your own domain.
Full parameters and responses live in the REST API docs and the API reference.
Go deeper
Cleaning the list first matters more than the loop: read the email validation API guide, because every bad address in that loop is a bounce against your domain.