---
title: "GET /v1/mailboxes/{mailboxId}/messages/{messageId}/content"
method: GET
path: "/v1/mailboxes/{mailboxId}/messages/{messageId}/content"
---

# GET /v1/mailboxes/{mailboxId}/messages/{messageId}/content

`GET /v1/mailboxes/{mailboxId}/messages/{messageId}/content`

## Request

- The document declares no server URL.
- Auth: one of:
  - OAuth 2 (authorization code, authorization URL `/authorize`, token URL `/oauth/token`, scopes: `email.read`)
  - HTTP bearer

Short-lived URLs for one message's HTML body and attachment bytes.

## Path parameters

- `mailboxId` string, required
- `messageId` string, required

## Response `200`

The request has succeeded.

- MessageContent: Where to fetch a message's rendered HTML and its attachment bytes. ⛔ **These URLs are credentials with a short life, which is why they are minted by a call and never carried on `Message`.** They point at a separate origin that serves nothing but user content: an `<iframe src>` and an `<img src>` cannot send an `Authorization` header, so the grant has to ride in the URL, and untrusted bytes have no business sharing an origin with an authenticated API. ⚠️ **The raw MIME is never served to a browser.** Every URL here addresses one decoded part.
  - `htmlUrl` string, uri, nullable, required: Where the sandboxed renderer should point, or null when the message has no HTML body.
  - `attachments` AttachmentContent[], required: One entry per attachment, in `Message.attachments` order.
    - `id` string, required: Matches `Attachment.id` on the same message.
    - `url` string, uri, required: Renders in place — an `<img>` source, or a preview pane. Served with a `Content-Disposition` of `inline` and a response CSP that neutralises anything executable.
    - `downloadUrl` string, uri, required: The same bytes, served to be saved: `Content-Disposition: attachment` with the filename.
  - `expiresAt` string, date-time, required: When these URLs stop working. Re-call for fresh ones; nothing is invalidated by doing so.

## Other responses

- `401`: Access is unauthorized.
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `default`: An unexpected error response.

---

[API](https://skmtc.dev/foundermail/apis/mailbox.md) - [All operations](https://skmtc.dev/foundermail/apis/mailbox/llms.txt) - [OpenAPI document](https://skmtc.dev/foundermail/apis/mailbox/revisions/6a50628a86ed?raw)