---
title: "List recent messages in a mailbox, optionally since a cursor"
method: GET
path: "/v1/mailboxes/{mailbox_id}/messages/new"
tags: ["threads"]
---

# List recent messages in a mailbox, optionally since a cursor

`GET /v1/mailboxes/{mailbox_id}/messages/new`

## Request

- Base URL: `https://mbag.ai/api`
- URL: `https://mbag.ai/api/v1/mailboxes/{mailbox_id}/messages/new`
- Auth: HTTP bearer

## Path parameters

- `mailbox_id` integer, required

## Query parameters

- `since` string
- `limit` integer

## Response `200`

Messages, newest first.

- EmailMessage[]
  - `from` string, nullable, required
  - `id` string, required
  - `preview` string, nullable, required
  - `received_at` string, nullable, required
  - `subject` string, nullable, required
  - `thread_id` string, nullable, required
  - `to` string[], nullable, required

## Other responses

- `401`: Missing or invalid credential, raised by the `ApiKeyAuth` extractor (`backend/src/api_keys.rs`) before the handler runs: no `Authorization` header, a non-`Bearer` scheme, a key that doesn't hash-match any row, or a key whose status isn't `active`. A header that isn't valid UTF-8, has no scheme token, or has `Bearer` with no key value returns 400 with this same JSON shape instead of 401.
- `404`: Mailbox not found (or not owned by the caller).
- `409`: Mailbox has no JMAP credentials provisioned yet.
- `500`: Database error reading mailbox JMAP credentials.
- `502`: Failed to reach or parse the upstream JMAP `/session` response, or the session had no primary mail account.
- `default`: Any other status is Stalwart's own JMAP method-call response passed through verbatim (its status code and JSON body, or `{"error":"Invalid JSON from upstream"}` if the body didn't parse as JSON).

---

[API](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api.md) · [All operations](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mailbuttons/apis/mailbuttons-agent-mail-api/revisions/fe2761823978?raw)