---
title: "Edit a draft"
method: PATCH
path: "/api/v1/rest/email/outbox/{id}"
tags: ["Email & PEC"]
---

# Edit a draft

`PATCH /api/v1/rest/email/outbox/{id}`

## Request

- Base URL: `https://api.custodo.ai`
- URL: `https://api.custodo.ai/api/v1/rest/email/outbox/{id}`
- Auth: HTTP bearer

Changes an existing draft — or a failed send, to correct and retry it. Every field REPLACES what was there; `attachments` is the complete list the draft should carry afterwards, not one to add to. Only a `draft` or `failed` row can be edited — a queued, sending or sent message refuses with EMAIL_OUTBOX_NOT_DRAFT. Stage a file first with email_attach (email_draft itself does not take attachments), then pass what it returns in `attachments` here; to forward, pass an attachment listed by email_get on a message you can read. Any other sha256 is refused with EMAIL_ATTACHMENT_NOT_FOUND. Attachments already on the draft are kept as they are.

## Path parameters

- `id` string, uuid, required

## Headers

- `X-Tenant-Id` string, uuid

## Request body

- object
  - `account_id` string, uuid: Move the draft to a different mailbox.
  - `reply_to_message_id` string, uuid, nullable
  - `to` object[]
    - `address` string, email, required
    - `name` string, nullable
  - `cc` object[]
    - `address` string, email, required
    - `name` string, nullable
  - `bcc` object[]
    - `address` string, email, required
    - `name` string, nullable
  - `subject` string
  - `body_text` string, nullable
  - `body_html` string, nullable
  - `attachments` object[]: The COMPLETE list this draft should carry afterwards. From email_attach, or an attachment of a message you can read (email_get).
    - `sha256` string, required
    - `filename` string, required
    - `contentType` string, required
    - `sizeBytes` integer, required
    - `contentId` string, nullable

## Response `200`

Done. `data` is the tool’s own answer.

- RestResult
  - `ok` true, required
  - `data` unknown, required

## Other responses

- `400`: The arguments did not validate: `error.message` names the field, what it expects and what arrived.
- `401`: No API key, or one that is malformed, unknown, revoked or expired.
- `403`: The call never ran: the module is off for this organisation, the credential lacks the permission or the module, the tier does not cover it, or the tool is destructive and the key was not minted for that.
- `404`: Nothing with that id in this organisation.
- `409`: The record is in a state that does not allow it — under legal hold, already sent, already closed. `error.code` says which.
- `422`: The tool ran and refused, in a sentence of its own (`TOOL_REFUSED`): the message says what to change. Retrying the same call will not help.
- `429`: The API key has spent its minute, or its day. Every request a key makes counts. See `Retry-After`.

---

[API](https://skmtc.dev/custodo/apis/custodo-integrazioni.md) · [All operations](https://skmtc.dev/custodo/apis/custodo-integrazioni/llms.txt) · [OpenAPI document](https://skmtc.dev/custodo/apis/custodo-integrazioni/revisions/16d336d3ec2a?raw)