---
title: "Get a draft"
method: GET
path: "/v1/drafts/{id}"
tags: ["drafts"]
---

# Get a draft

`GET /v1/drafts/{id}`

## Request

- Base URL: `https://api.replylayer.ai`
- URL: `https://api.replylayer.ai/v1/drafts/{id}`
- Auth: HTTP bearer

## Path parameters

- `id` string, required

## Query parameters

- `body_format` 'text' | 'html'
- `body_page` string
- `view` 'summary' | 'verbose'

## Response `200`

Success

- object
  - `agent_safety_context` object, nullable
    - `guidance` string, required
    - `instruction_trust` object
      - `match` 'address', required
      - `provenance` 'managed', required
      - `verdict` 'verified_aligned', required
      - `verified_domain` string, nullable, required
      - `version` 'v1', required
    - `untrusted_content` boolean, required
  - `attachments` object[]
    - `content_type` string, required
    - `filename` string, required
    - `policy_action` string
    - `size` number, required
    - `upload_id` string, nullable
  - `body` object, required
    - `char_count` integer, required
    - `content` string, nullable, required
    - `format` 'text' | 'html', required
    - `returned_char_count` integer, required
    - `truncated` boolean, required
  - `compose_held_at` string, date-time, nullable
  - `compose_held_decision` 'quarantine' | 'block' | 'require_human_approval' | 'null', nullable
  - `created_at` string, date-time, required
  - `editor` union: Present only for authenticated dashboard session callers when the reloaded row remains a draft. Omitted for agent keys, admin keys and OAuth bearer callers. Bearer callers continue to receive the capped reading/delivery `body`. Editable only for text-only drafts on passthrough-PII mailboxes: `status:"editable"` carries the complete original plain-text source (never capped, normalized, redacted or HTML-converted); `status:"read_only"` carries a reason (`pii_redacted`, `html_body`, `missing_source`, `body_too_large`) and never any body. Declaring this field in the schema does not grant access.
    - object
      - `body` object, required
        - `char_count` integer, required
        - `content` string, required
        - `format` 'text', required
        - `returned_char_count` integer, required
        - `truncated` false, required
      - `status` 'editable', required
    - object
      - `reason` 'pii_redacted' | 'html_body' | 'missing_source' | 'body_too_large', required
      - `status` 'read_only', required
  - `id` string, required
  - `in_reply_to` string, nullable
  - `last_dispatch_attempt_at` string, date-time, nullable
  - `last_dispatch_error_code` string, nullable
  - `mailbox_id` string, required
  - `mailbox_name` string, nullable
  - `original_send_at` string, date-time, nullable
  - `recipient` string, required
  - `releasable` boolean
  - `scan` object, nullable, required
    - `categories` object[], required
      - `category` string, required
      - `decision` 'allow' | 'allow_with_warning' | 'quarantine' | 'require_human_approval' | 'block', required
    - `findings` object[], required
      - `agent_instructions` string[]
      - `attachment_filename` string
      - `attachment_index` integer
      - `attachment_policy_action` 'quarantine_message' | 'metadata_only_after_rewrite' | 'derived_text_finding'
      - `category` string, required
      - `decision` 'allow' | 'allow_with_warning' | 'quarantine' | 'require_human_approval' | 'block', required
      - `expires_at` string, date-time
      - `failure_class` 'inference_error' | 'model_judgment'
      - `pii_type` 'ssn' | 'credit_card' | 'phone_number'
      - `reason` string, nullable, required
      - `retryable` boolean
      - `subtype` string
      - `warning` object
        - `affected_urls` string[], required
        - `attribution_text` string, required
        - `attribution_url` string, required
        - `learn_more` object[], required
          - `threat_type` 'MALWARE' | 'SOCIAL_ENGINEERING' | 'UNWANTED_SOFTWARE' | 'SOCIAL_ENGINEERING_EXTENDED_COVERAGE', required
          - `url` string, required
        - `qualified_wording` string, required
    - `verdict` 'clean' | 'warning' | 'review_required' | 'blocked' | 'quarantined', required
  - `send_at` string, date-time, nullable
  - `send_attempts` integer, required
  - `sender` string, required
  - `state` 'draft' | 'available' | 'deleted', required
  - `subaddress_instance_id` string, nullable
  - `subaddress_mode` 'reply_to' | 'from' | 'none' | 'null', nullable
  - `subject` string, required
  - `thread_id` string, nullable
  - `updated_at` string, date-time, required
  - `worst_decision` 'allow' | 'allow_with_warning' | 'quarantine' | 'require_human_approval' | 'block', required

## Other responses

- `400`: Validation error
- `401`: Missing or invalid API key (code: UNAUTHORIZED)
- `404`: Not found
- `429`: Rate limited (code: RATE_LIMITED)
- `500`: Internal error (code: INTERNAL_ERROR)

---

[API](https://skmtc.dev/replylayer/apis/replylayer-api.md) · [All operations](https://skmtc.dev/replylayer/apis/replylayer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/replylayer/apis/replylayer-api/revisions/2cae6fbd127e?raw)