---
title: "PUT /v1/mailboxes/{mailboxId}/drafts/{draftId}"
method: PUT
path: "/v1/mailboxes/{mailboxId}/drafts/{draftId}"
---

# PUT /v1/mailboxes/{mailboxId}/drafts/{draftId}

`PUT /v1/mailboxes/{mailboxId}/drafts/{draftId}`

## Request

- The document declares no server URL.
- Auth: one of:
  - OAuth 2 (authorization code, authorization URL `/authorize`, token URL `/oauth/token`, scopes: `email.write`)
  - HTTP bearer

Save a draft, creating or replacing it. Idempotent.

## Path parameters

- `mailboxId` string, required
- `draftId` string, required

## Request body

- DraftInput: A message being written, as the writer left it (INBOX-EVALUATION §13). Saved as it is typed, so the address lines are what was typed — `a@x.com, b@` is a draft's normal state — and nothing is validated until it is sent. Bounded like the send it may become, and to fit the mailbox's row.
  - `threadId` string: The conversation this answers, when it is a reply — that thread's reply draft.
  - `inReplyTo` string: A threading header value that still fits one RFC 5322 §2.1.1 line.
  - `from` string: The address it will go from, as chosen.
  - `to` string: The To line as typed.
  - `cc` string
  - `bcc` string
  - `subject` string: RFC 5322 caps a subject line at 998 characters.
  - `text` string: The words so far. 200,000 characters fit the mailbox's 2 MB row however they encode.
  - `attachments` DraftPartReference[]: Files it carries by reference — a forward's — with what to show for each. Files uploaded into the draft are not listed here: they are its `files`, added and removed by their own requests, so a save can never drop one it did not know about.
    - `emailId` string, required: The message's `id`, as a thread read shows it.
    - `attachmentId` string, required
    - `filename` string, required: Bounds mirroring `domain/email/message-part.ts` — every one of these arrives in a stranger's MIME headers, so the cap is the contract, not tidiness.
    - `contentType` string, required
    - `size` integer, required: Decoded octets, as shown.

## Response `200`

The request has succeeded.

- Draft
  - `id` string, required: Chosen by the writer's client — a UUID — so saving is a PUT and a retried save is harmless.
  - `threadId` string: The conversation this answers, when it is a reply — that thread's reply draft.
  - `inReplyTo` string: A threading header value that still fits one RFC 5322 §2.1.1 line.
  - `from` string: The address it will go from, as chosen.
  - `to` string: The To line as typed.
  - `cc` string
  - `bcc` string
  - `subject` string: RFC 5322 caps a subject line at 998 characters.
  - `text` string: The words so far. 200,000 characters fit the mailbox's 2 MB row however they encode.
  - `attachments` DraftPartReference[]: Files it carries by reference — a forward's — with what to show for each. Files uploaded into the draft are not listed here: they are its `files`, added and removed by their own requests, so a save can never drop one it did not know about.
    - `emailId` string, required: The message's `id`, as a thread read shows it.
    - `attachmentId` string, required
    - `filename` string, required: Bounds mirroring `domain/email/message-part.ts` — every one of these arrives in a stranger's MIME headers, so the cap is the contract, not tidiness.
    - `contentType` string, required
    - `size` integer, required: Decoded octets, as shown.
  - `files` DraftFile[], required: Files uploaded into it, in the order they were added.
    - `fileId` string, required: Name it to a send as `{ fileId }`, or to `removeDraftFile`.
    - `filename` string, required: Bounds mirroring `domain/email/message-part.ts` — every one of these arrives in a stranger's MIME headers, so the cap is the contract, not tidiness.
    - `contentType` string, required
    - `size` integer, required: Octets.
  - `updatedAt` string, date-time, required

## Other responses

- `400`: The server could not understand the request due to invalid syntax.
- `401`: Access is unauthorized.
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `422`: Client error
- `default`: An unexpected error response.

---

[API](https://skmtc.dev/foundermail/apis/mailbox.md) - [All operations](https://skmtc.dev/foundermail/apis/mailbox/llms.txt) - [OpenAPI document](https://skmtc.dev/foundermail/apis/mailbox/revisions/6a50628a86ed?raw)