Outbound fax - API - HIPAA-grade

The fax API
developers actually like.

Outbound fax for B2B SaaS - with HIPAA-grade compliance from day one of self-serve. The primitives modern teams expect: signed webhooks, idempotency keys, magic test numbers, and an error catalog that actually explains itself.

$0.04/page Free BAA, every paid tier OpenAPI 3.1
POST /v1/faxes
# send a fax. idempotent. signed.
curl "https://api.mintfax.com/v1/faxes" \
  -X POST \
  -H "Authorization: Bearer mfx_live_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "+15551234567",
    "from_number": "fnum_8KQRm2",
    "document_url": "https://files.example.com/coversheet.pdf",
    "metadata": { "patient_id": "p_19a8c" },
    "webhook_url": "https://app.example.com/webhooks/fax"
  }'
202 fax_2KQrm9hC created - idempotency-key matched - ETA ~24s just now
200 webhook - fax.delivered - sig=ok - 2 pages - 23.4s +24s
Built for teams shipping
regulated workloads
- healthtech -
- ehr platform -
- claims saas -
- legal ops -
- logistics -
01 - Primitives

The plumbing
shouldn't surprise you.

Modern SaaS teams already have opinions about how a third-party API should behave. We share them. Everything below ships on day one of self-serve - not behind an enterprise quote.

P / 01

HMAC-SHA256
signed webhooks

Every webhook carries a versioned signature header and a replay-protected timestamp. Rotate secrets without downtime; verify in three lines.

X-Mintfax-Signature: t=..., v1=...
P / 02

Idempotency keys,
not idempotency vibes

Send the same key twice, get the same fax back - never two. Keys are valid for 24h and stored alongside the canonical request hash.

Idempotency-Key: ik_b8c4...
P / 03

Built-in retries
with backoff you can read

Retry policy is part of the response, not folklore. Inspect attempt count, next-attempt-at, and the carrier-side reason that triggered the retry.

retry_policy: { max: 5, backoff: "exp(2,30s)" }
P / 04

A sandbox with
magic test numbers

+1-555-MFX-BUSY is always busy. -NACK rejects on the first ring. -SLOW takes 90 seconds. Reproduce every failure path locally.

+1 555 MFX-BUSY - MFX-NACK - MFX-SLOW
P / 05

OpenAPI 3.1, written
by humans first

The spec is the source of truth. Codegen your client, mock locally, diff schema changes in CI. Every endpoint has at least one example that round-trips.

openapi: 3.1.0 - spectral-clean
P / 06

An error catalog
that explains itself

Every error has a stable code, a one-line summary, a "what to try next," and a permalink. Nothing reads "internal_error: see logs."

err fax.recipient.unreachable - 12 docs
02 - Compliance

HIPAA-grade
from
day one of self-serve.

No enterprise plan. No procurement cycle. No "talk to sales to access encryption." Sign up, sign the BAA in-app, ship.

01 Free BAA, every paid tierSelf-serve, in-app, countersigned automatically. HIPAA
02 AES-256 at restDocuments encrypted before they touch disk; per-workspace keys. FIPS 140-2
03 TLS 1.2+ in transit1.3 by default. Pinned suites. HSTS preloaded. Modern
04 Per-workspace immutable audit logAppend-only, tamper-evident, exportable as JSONL. Day 1
05 SOC 2 Type IIAnnual audit; latest report on request. Q3
03 - Compare

Built for B2B SaaS,
not for resellers.

Most fax APIs were built for the channel - for resellers, hospital billing departments, MSPs. We're building for the engineer integrating fax into a product they didn't choose to build.

FeaturemintfaxLegacy fax APICloud telco platform
HIPAA BAA on self-serveFree, every paid tierEnterprise plan onlyAdd-on, $299/mo
HMAC-signed webhooksDay 1, versionedOptional, IP allowlistDay 1
Idempotency keysFirst-class, 24hBest-effort dedupeNot supported
Sandbox with failure simulationMagic numbers - freeTrial credits onlyTest mode only
OpenAPI 3.1 specSource of truthPDF reference3.0 partial
Pricing modelPer-page, no minimumsSeats + minimumsAnnual contract
Per-workspace audit logImmutable JSONLCSV on request90 days, console
Currently building toward launch

Built for developers
who'd rather not be
working on fax.

Drop your email. We'll send one note when the sandbox opens to the public, and one when GA ships. Nothing else.

per-page from$0.04
sandboxfree
BAAincluded
seatsunlimited
minimumsnone