---
title: "List Mailboxes"
method: GET
path: "/mailboxes"
tags: ["GTM Context"]
---

# List Mailboxes

`GET /mailboxes`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/mailboxes`
- Auth: HTTP bearer

List sending mailboxes the authenticated user can access in this org.

Backs the MCP "pick a mailbox before launching a campaign" flow.

Sources from the canonical ``mailboxes`` table (NOT the
``ai_inbox_email_cron_jobs`` table the FE picker previously used — that
table is the AI-inbox sync state, not the source of truth for which
mailboxes exist). See ``.claude/agent-context/mailbox-picker-sources-cron-table.md``.

Tenant scope: ``mailboxes`` lives in the per-org schema (NOT public —
the earlier version of this comment was wrong; see
``select to_regclass('public.mailboxes')`` returning null vs. the
per-org row count). Binding the session to ``schema=<org>`` IS the
tenant boundary; no further org-filter predicate is needed.

Per-row RBAC (``ENFORCE_MAILBOX_PERMISSIONS`` soak flag) is NOT enforced
here yet — Phase 3b on issue #7180 — keeping symmetry with the FE
picker. When that flag flips on, this endpoint will adopt the scope
filter alongside the cdp/mailboxes/fetch surface.

Historical bug (fixed 2026-05-22): the previous implementation appended
``(t.org_id = :org_id OR m.created_by = :user_id)`` to the WHERE. Both
halves silently matched zero rows in prod — ``mailboxes.team_id`` is
NULL on every row (no team pinning) and ``mailboxes.created_by`` stores
email strings, not propelauth UUIDs. Result: the endpoint returned an
empty list for every caller. Dropping the predicate restores the
correct per-org listing; tenant isolation comes from the schema bind.

## Query parameters

- `limit` integer
- `include_archived` boolean: Include archived mailboxes
- `connection_status` string, nullable: Filter by connection_status (active|paused|disconnected|expired|...)

## Headers

- `Authorization` string, nullable
- `X-Target-Org-Id` string, nullable

## Response `200`

Successful Response

- ApiResponseListDict
  - `data` object[], required
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)