---
title: "Send a reply to the ORIGINAL SENDER of a stored message."
method: POST
path: "/v1/messages/{id}/reply"
tags: ["Messages"]
---

# Send a reply to the ORIGINAL SENDER of a stored message.

`POST /v1/messages/{id}/reply`

## Request

- Base URL: `https://api.inboxy.net`
- URL: `https://api.inboxy.net/v1/messages/{id}/reply`
- Auth: HTTP bearer

Requires `send` scope. Recipient is locked server-side to `messages.from_email`; the From header is `<alias>@inboxy.net` (alias the original was delivered to). Body cap: 2000 chars. Refused on spam-classified messages, messages older than 30 days, or when the per-user reply rate cap is hit (5/hour, 20/day, 1 per 60s). Every reply writes an `audit_log` row with the SHA-256 of the recipient. Optional `attachment_ids[]` references prior `POST /v1/outbox-attachments` uploads (up to 5 files, 20 MB each, 20 MB total).

## Path parameters

- `id` string, uuid, required

## Request body

- ReplyRequest: Reply body. The server appends a `--` separator + quoted-original block; callers cannot suppress it.
  - `body_text` string, required: Plain-text body. Capped at 2000 chars.
  - `body_html` string: Optional HTML body. Visible-text length capped server-side at 2000 chars.
  - `attachment_ids` string[]: Ids returned by `POST /v1/outbox-attachments`. Each may be used at most once. Per-file cap 20 MB, total cap 20 MB.

## Response `200`

Reply queued.

- ReplyResult
  - `id` string, uuid, required
  - `replied` boolean, required
  - `to` string, email, required
  - `from` string, email, required
  - `subject` string, required
  - `idempotency_key` string, required
  - `attachments` object[]
    - `r2_key` string
    - `filename` string, nullable
    - `content_type` string
    - `size_bytes` integer

## Other responses

- `400`: Validation failure (spam_blocked, stale_message, body_too_long, …).
- `403`: Token lacks the required scope.
- `404`: No matching resource owned by the caller.
- `410`: Alias for this message no longer exists.
- `429`: Rate limit hit. Body includes `scope` + `retry_after_sec`.

---

[API](https://skmtc.dev/inboxy/apis/inboxy-api.md) · [All operations](https://skmtc.dev/inboxy/apis/inboxy-api/llms.txt) · [OpenAPI document](https://skmtc.dev/inboxy/apis/inboxy-api/revisions/25155a8dec0f?raw)