---
title: "Get a message"
method: GET
path: "/api/v1/messages/{id}"
tags: ["messages"]
---

# Get a message

`GET /api/v1/messages/{id}`

## Request

- Base URL: `https://postfleet.ai`
- URL: `https://postfleet.ai/api/v1/messages/{id}`
- Auth: HTTP bearer

Returns a single message with body, comprehension, and attachments. Requires `can_read`. A message in another mailbox (for a mailbox-bound key) or another account is reported as `404` (anti-enumeration).

## Path parameters

- `id` string, required

## Response `200`

Message.

- MessageDetail
  - `id` string, required
  - `mailbox_id` string, required
  - `direction` 'in' | 'out', required
  - `provider_message_id` string, nullable
  - `rfc_message_id` string, nullable
  - `thread_id` string, required
  - `in_reply_to` string, nullable
  - `from_addr` string, required
  - `to_addr` string, required
  - `subject` string, required: The sanitized subject (invisible/bidi characters stripped) — the value every delivery surface serves.
  - `subject_raw` string, nullable: Pre-sanitization subject original. Purged on the same TTL as body_raw; null on messages that predate subject sanitization. Stripped from MCP reads, like body_raw.
  - `body_raw` string, nullable
  - `body_clean` string, nullable
  - `truncated` boolean
  - `created_at` string, required
  - `comprehension` object, nullable
  - `attachments` object[]
  - `auth_results` object, nullable, required: SPF/DKIM/DMARC verdicts from the inbound Authentication-Results header; null if none was forwarded.
    - `spf` 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror', required
    - `dkim` 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror', required
    - `dmarc` 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror', required
  - `spam_risk` 'low' | 'high' | 'error', nullable, required: The layered spam verdict: 'high' from either the free SES x-ses-spam-verdict gate or the Haiku classifier reaching the same conclusion on SES-pass mail; 'low' cleared both; 'error' means the classifier failed and the message proceeded un-quarantined (availability over false quarantine). null when spam scoring never ran for this message.
  - `virus_risk` 'low' | 'high', nullable, required: The SES virus verdict from the free x-ses-virus-verdict gate: 'high' means SES flagged the message as malware — it is stored but never delivered (no deliver-toggle exists for malware); 'low' means SES cleared it; null when no verdict was forwarded.

## Other responses

- `401`: Missing or invalid bearer token, or a key whose scope is not permitted for this endpoint.
- `403`: Key cannot read messages (`code:key_scope`).
- `404`: Message not found (missing, cross-account, or cross-mailbox for a bound key).

---

[API](https://skmtc.dev/postfleet/apis/postfleet-api.md) · [All operations](https://skmtc.dev/postfleet/apis/postfleet-api/llms.txt) · [OpenAPI document](https://skmtc.dev/postfleet/apis/postfleet-api/revisions/bae1dabfa89e?raw)