---
title: "GET /v1/mailboxes/{mailboxId}/drafts"
method: GET
path: "/v1/mailboxes/{mailboxId}/drafts"
---

# GET /v1/mailboxes/{mailboxId}/drafts

`GET /v1/mailboxes/{mailboxId}/drafts`

## Request

- The document declares no server URL.
- Auth: one of:
  - OAuth 2 (authorization code, authorization URL `/authorize`, token URL `/oauth/token`, scopes: `email.read`)
  - HTTP bearer

List a mailbox's drafts, most recently saved first.

## Path parameters

- `mailboxId` string, required

## Query parameters

- `limit` integer
- `cursor` string

## Response `200`

The request has succeeded.

- object: `{ data, nextCursor }` — the one envelope every paged collection answers with. The cursor is opaque and ours to change; a caller must never construct one. **`nextCursor` is non-null exactly when the page came back full** — so a full final page hands out a cursor whose next page is empty, which is correct and cheaper than over-fetching by one row to find out. A cursor the server cannot read answers 400 rather than silently restarting: a client looping "fetch, follow nextCursor" against a cursor that quietly reset would loop over page one forever.
  - `data` Draft[], required
    - `id` string, required: Chosen by the writer's client — a UUID — so saving is a PUT and a retried save is harmless.
    - `threadId` string: The conversation this answers, when it is a reply — that thread's reply draft.
    - `inReplyTo` string: A threading header value that still fits one RFC 5322 §2.1.1 line.
    - `from` string: The address it will go from, as chosen.
    - `to` string: The To line as typed.
    - `cc` string
    - `bcc` string
    - `subject` string: RFC 5322 caps a subject line at 998 characters.
    - `text` string: The words so far. 200,000 characters fit the mailbox's 2 MB row however they encode.
    - `attachments` DraftPartReference[]: Files it carries by reference — a forward's — with what to show for each. Files uploaded into the draft are not listed here: they are its `files`, added and removed by their own requests, so a save can never drop one it did not know about.
      - `emailId` string, required: The message's `id`, as a thread read shows it.
      - `attachmentId` string, required
      - `filename` string, required: Bounds mirroring `domain/email/message-part.ts` — every one of these arrives in a stranger's MIME headers, so the cap is the contract, not tidiness.
      - `contentType` string, required
      - `size` integer, required: Decoded octets, as shown.
    - `files` DraftFile[], required: Files uploaded into it, in the order they were added.
      - `fileId` string, required: Name it to a send as `{ fileId }`, or to `removeDraftFile`.
      - `filename` string, required: Bounds mirroring `domain/email/message-part.ts` — every one of these arrives in a stranger's MIME headers, so the cap is the contract, not tidiness.
      - `contentType` string, required
      - `size` integer, required: Octets.
    - `updatedAt` string, date-time, required
  - `nextCursor` string, nullable, required: Opaque. Non-null exactly when this page was full; `null` otherwise.

## Other responses

- `400`: The server could not understand the request due to invalid syntax.
- `401`: Access is unauthorized.
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `default`: An unexpected error response.

---

[API](https://skmtc.dev/foundermail/apis/mailbox.md) - [All operations](https://skmtc.dev/foundermail/apis/mailbox/llms.txt) - [OpenAPI document](https://skmtc.dev/foundermail/apis/mailbox/revisions/6a50628a86ed?raw)