---
title: "Search received messages"
method: POST
path: "/v1/inbound/search"
tags: ["Inbound"]
---

# Search received messages

`POST /v1/inbound/search`

## Request

- Base URL: `https://api.sendora.se`
- URL: `https://api.sendora.se/v1/inbound/search`
- Auth: HTTP bearer

The messages the server has received, newest first, one page at a time. A POST so that an address travels in the body and never in a URL. The sender is matched by keyed hash, so the search itself stores no address. Messages older than 13 months are gone.

## Request body

- object: Every filter is optional; the page is newest first.
  - `streamId` string, uuid: Messages received on this inbound stream of the server.
  - `from` string, email: Messages from this address, in the envelope or the From header.
  - `recipient` string, email: Messages sent to this address of yours, the envelope recipient.
  - `mailboxHash` string: Messages whose address carried this text after the plus sign.
  - `receivedFrom` string, date-time: Accepted at or after this time.
  - `receivedTo` string, date-time: Accepted before this time.
  - `limit` integer: Page size, 1 to 100.
  - `after` string, uuid: The `next` value of the previous page.

## Response `200`

A page of the received messages that match, newest first.

- object: A page of the received messages that match, newest first.
  - `messages` object[], required
    - `inboundMessageId` string, uuid, required
    - `streamId` string, uuid, required: The inbound stream that received it.
    - `receivedAt` string, date-time, required: When the message was accepted from the sending server.
    - `envelopeRecipient` string, required: The address of yours the message was sent to.
    - `mailboxHash` string, nullable, required: The text after the plus sign in that address, when the sender used one.
    - `sizeBytes` integer, required
    - `attachmentCount` integer, required
    - `hasText` boolean, required
    - `hasHtml` boolean, required
    - `parseIssue` string, nullable, required: What the parser met; null when the message parsed clean. A hard issue empties the parsed parts, and the raw message stays: `no_headers`, `header_block_too_large`, `too_many_headers`, `too_many_parts`, `nesting_too_deep`, `missing_boundary`, `decoded_too_large`, `parse_timeout`, `parser_error`. A soft issue keeps them and says what was changed or dropped: `truncated_multipart`, `too_many_attachments`, `unknown_transfer_encoding`, `undecodable_container`, `filename_sanitised`, `control_chars_stripped`, `multiple_from`, `duplicate_header`, `malformed_header_dropped`, `address_list_truncated`, `header_value_truncated`. A message with several names the hard one, or the first soft one in this order.
    - `authentication` object, required: What Sendora found when it checked the message; unchecked until the checks have run.
      - `spf` 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror' | 'unchecked', required: SPF for the address in MAIL FROM.
      - `spfHelo` 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror' | 'unchecked', required: SPF for the name the sending server gave in HELO.
      - `dkim` 'pass' | 'fail' | 'none' | 'temperror' | 'permerror' | 'unchecked', required
      - `dmarc` 'pass' | 'fail' | 'none' | 'temperror' | 'permerror' | 'unchecked', required
      - `dmarcPolicy` 'none' | 'quarantine' | 'reject', nullable, required: What the sender’s domain asks for; told only when DMARC failed.
      - `arc` 'none' | 'pass' | 'fail' | 'unchecked', required
      - `checkedAt` string, date-time, nullable, required: When the checks ran; null until they have.
    - `contentAvailable` boolean, required: False once the stream’s content window has passed; only the reference remains.
    - `contentExpiresAt` string, date-time, required: When the content goes.
    - `from` object, nullable, required: The From header; null without it or once the content is gone.
      - `address` string, required
      - `name` string, nullable, required
    - `subject` string, nullable, required
    - `date` string, date-time, nullable, required: The sender’s Date header as ISO 8601, when it was a real moment.
  - `next` string, uuid, nullable, required: Pass as `after` for the next page; null on the last.

## Other responses

- `400`: The body, the query or a header does not match what the route takes.
- `401`: The key is missing, malformed or revoked.
- `403`: The key is of the other kind, or a connected app may not do this here: it is not for connections, the connection may only read here, or it is for test servers only.
- `422`: The streamId names no stream of this server.

---

[API](https://skmtc.dev/sendora/apis/sendora-api.md) · [All operations](https://skmtc.dev/sendora/apis/sendora-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendora/apis/sendora-api/revisions/72efbbb34b64?raw)