---
title: "Get a draft"
method: GET
path: "/api/v1/drafts/{id}"
tags: ["drafts"]
---

# Get a draft

`GET /api/v1/drafts/{id}`

## Request

- Base URL: `https://postfleet.ai`
- URL: `https://postfleet.ai/api/v1/drafts/{id}`
- Auth: HTTP bearer

Returns a draft's public shape. Requires `can_read`. Missing, cross-account, cross-mailbox (for a bound key), and tombstoned (sent/rejected/deleted) drafts all collapse to a byte-identical `404` (anti-enumeration).

## Path parameters

- `id` string, required

## Response `200`

Draft.

- Draft
  - `id` string, required
  - `mailbox_id` string, required
  - `status` 'draft' | 'pending_approval' | 'sending' | 'sent' | 'rejected', required
  - `to` string, nullable
  - `subject` string, required
  - `text` string, required
  - `reply_to_message_id` string, nullable
  - `requires_human` boolean, required
  - `thread_id` string, required
  - `created_at` string, required
  - `updated_at` string, required
  - `attachments` object[]: Metadata only — file bytes are not returned.
    - `filename` string, required
    - `content_type` string, required
    - `size_bytes` integer, required
    - `url` string: Present when the draft stored a URL-backed attachment. Bytes are never returned.

## Other responses

- `401`: Missing or invalid bearer token, or a key whose scope is not permitted for this endpoint.
- `403`: Key cannot read drafts (`code:key_scope`).
- `404`: Draft not found (missing, cross-account, cross-mailbox for a bound key, or tombstoned). Byte-identical for every case (anti-enumeration).

---

[API](https://skmtc.dev/postfleet/apis/postfleet-api.md) · [All operations](https://skmtc.dev/postfleet/apis/postfleet-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postfleet/apis/postfleet-api/revisions/bae1dabfa89e?raw)