Claim messages from the work queue

{ limit?, lease_seconds?, consumer?, wait?, enriched?, analysis?, include_unscreened?, include_held?, since?, type?, channel? } → { data: [{ lease_id, lease_until, delivery_count, message }], paused }. Oldest first. limit 1–50 (default 10), lease_seconds 30–3600 (default 300), wait long-polls 0–30 s (default 0), consumer is a name stored with the lease (up to 100 characters). When the workspace screens agent mail (the default for new workspaces), only screened and released mail is claimable; include_unscreened: true adds mail whose check hasn’t finished, include_held: true adds held mail (needs messages:release); both together = everything. enriched: true only returns messages whose AI categorisation is done, skipped or failed (or that a person released), so the injection score is there before you act; a check that never finishes keeps the message back until someone releases it. analysis: "completed" is stricter: only messages whose injection and phishing check completed; skipped and failed ones are never returned to this claim (422 analysis_unavailable when the workspace doesn’t check mail). Needs messages:write and messages:read.

Permission: messages:write.