---
title: "Forward with attachments"
method: POST
path: "/inbound/{id}/forward"
tags: ["Inbound emails"]
---

# Forward with attachments

`POST /inbound/{id}/forward`

## Request

- Base URL: `https://api.poststack.dev`
- URL: `https://api.poststack.dev/inbound/{id}/forward`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Authorization code: `https://poststack.dev/oauth/authorize`
    - Token URL: `https://poststack.dev/oauth/token`
- TypeScript: <https://skmtc.dev/poststack/apis/poststack-api/docs/inbound/:id/forward/post.ts> (a function with typed inputs; its response is checked against the schema)

Forwards the message (with its attachments) to `to`, plus optional `cc` / `bcc` (max 50 each, like `POST /emails`). Sent through the normal send pipeline under the calling API key, so suppressed recipients are dropped and the same 403/422/429 conditions apply. Needs `mailboxes:manage` as well as `email:send`, since it reads the inbound message and its attachments.

## Path parameters

- `id` integer, required

## Request body

- ForwardInboundInput
  - `from` string, required
  - `to` string[], required
  - `cc` string[]
  - `bcc` string[]
  - `message` string

## Response `202`

Queued.

- SendEmailResponse
  - `id` string, required: Public email id (`em_…`). Every email endpoint is addressed by this id.
  - `replayed` boolean: Present and `true` when `idempotency_key` (or the `Idempotency-Key` header) matched an earlier send: `id` is that email and nothing was sent. The response also carries `X-Idempotent-Replay: true`.
  - `test_mode` true: Present only when authenticated with an `sk_test_` key: the email was recorded and marked delivered but never handed to a mail server.
  - `spam_score` number: rspamd score of the rendered message (omitted when the spam check was skipped).
  - `spam_warnings` SpamSymbol[]
    - `name` string, required
    - `score` number, required
    - `description` string

## Other responses

- `400`: Validation failed — `error` names each offending field (`field: message`).
- `401`: Missing, malformed or unknown credentials (`WWW-Authenticate: Bearer …` is set).
- `403`: Missing `mailboxes:manage` or `email:send` scope, team suspended or sending paused, or the API key is restricted to a different domain.
- `404`: No such resource on this team.
- `422`: From-domain not verified or recipients suppressed.
- `429`: Branch on `code`. `rate_limit_exceeded`: request rate limited (60 req/min per key; halved on the free plan) — retry after `Retry-After`. Not retryable: `monthly_limit_exceeded` (monthly plan limit reached), `daily_limit_exceeded` (rolling 24h cap on external recipients for new/free accounts), `send_limit_exceeded` (sending from new accounts paused platform-wide).

## Changes

- **2026-11-12** `0d3971e3a670`: 4 warning
  - the `bcc/items/` request property's maxLength was set to `320`
  - the `cc/items/` request property's maxLength was set to `320`
  - the `from` request property's maxLength was set to `998`
  - the `to/items/` request property's maxLength was set to `320`
- **2026-09-30** `4dc1e20989c8`: 18 warning, 2 info
  - added the new `daily_limit_exceeded` enum value to the `anyOf[#/components/schemas/Error]/code` response property for the response status `403`
  - added the new `daily_limit_exceeded` enum value to the `code` response property for the response status `400`
  - added the new `daily_limit_exceeded` enum value to the `code` response property for the response status `401`
  - added the new `daily_limit_exceeded` enum value to the `code` response property for the response status `404`
  - …16 more
- **2026-09-29** `ef5b22b98333`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/poststack/apis/poststack-api/changes/inbound/:id/forward/post.md)

---

[API](https://skmtc.dev/poststack/apis/poststack-api.md) - [All operations](https://skmtc.dev/poststack/apis/poststack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/poststack/apis/poststack-api/revisions/0d3971e3a670?raw)