---
title: "Inject a sandbox inbound message"
method: POST
path: "/mailboxes/{id}/sandbox/inbound"
tags: ["Mailboxes", "Messages"]
---

# Inject a sandbox inbound message

`POST /mailboxes/{id}/sandbox/inbound`

## Request

- Base URL: `https://shipmail.to/api/v1`
- URL: `https://shipmail.to/api/v1/mailboxes/{id}/sandbox/inbound`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://shipmail.to/api/auth/oauth2/authorize`, token URL `https://shipmail.to/api/auth/oauth2/token`)

Create a fake inbound message in isolated sandbox storage. This endpoint requires a test API key. It runs the normal inbound threading, rule, and webhook pipeline without delivering mail to any supplied address.

## Headers

- `Idempotency-Key` string
- `X-Shipmail-Organization` string

## Request body

- InjectSandboxInboundRequest
  - `from` union, required: Email recipient. Either an object with address and optional name, or a string.
    - object
      - `address` string, email, required: Email address.
      - `name` string, nullable: Display name (optional).
    - string: Email address as a string. Accepts plain address ("user@example.com") or display name format ("Jane Doe <user@example.com>").
  - `to` Recipient[]
    - union: Email recipient. Either an object with address and optional name, or a string.
      - object
        - `address` string, email, required: Email address.
        - `name` string, nullable: Display name (optional).
      - string: Email address as a string. Accepts plain address ("user@example.com") or display name format ("Jane Doe <user@example.com>").
  - `cc` Recipient[]
    - union: Email recipient. Either an object with address and optional name, or a string.
      - object
        - `address` string, email, required: Email address.
        - `name` string, nullable: Display name (optional).
      - string: Email address as a string. Accepts plain address ("user@example.com") or display name format ("Jane Doe <user@example.com>").
  - `subject` string, required
  - `text` string: Plain text body. At least one of text or html is required.
  - `html` string: HTML body. At least one of text or html is required.
  - `message_id` string
  - `in_reply_to` string
  - `references` string[]
  - `received_at` string, date-time
  - `headers` OutboundHeader[]: Safe outbound headers. Shipmail, SES, routing, and identity headers are rejected. RFC 8058 requires List-Unsubscribe-Post: List-Unsubscribe=One-Click and an HTTPS List-Unsubscribe URL.
    - `name` string, required: List-Unsubscribe, List-Unsubscribe-Post, or a non-reserved X-* header.
    - `value` string, required

## Response `201`

Sandbox inbound message created.

- Message
  - `object` 'message', required
  - `id` string, required
  - `mailbox_id` string, required
  - `thread_id` string, nullable, required: Deprecated and not stable: a legacy thread ID that changes when the mail server re-threads its IDs or a relayed send's placeholder key is replaced. It remains supported in thread paths; store conversation_id instead.
  - `conversation_id` string, nullable, required: Stable Shipmail conversation identifier (thd_...). Store this: it survives thread merges and mail-server re-threading, which thread_id does not.
  - `source_rfc_message_id` string, nullable, required: Source RFC Message-ID supplied by the caller or observed before relay.
  - `delivered_rfc_message_id` string, nullable, required: Exact provider-assigned delivered RFC Message-ID after Shipmail observes it in a recipient reply. Null before an observation and never reconstructed from the SES provider ID.
  - `client_reference` string, nullable, required: Caller-defined organization-scoped reference.
  - `metadata` MessageMetadata, required: Up to 20 scalar values and 8 KB of JSON. Nested objects and arrays are rejected.
  - `headers` OutboundHeader[], required: Safe outbound headers. Shipmail, SES, routing, and identity headers are rejected. RFC 8058 requires List-Unsubscribe-Post: List-Unsubscribe=One-Click and an HTTPS List-Unsubscribe URL.
    - `name` string, required: List-Unsubscribe, List-Unsubscribe-Post, or a non-reserved X-* header.
    - `value` string, required
  - `subject` string, nullable, required
  - `from_address` string, nullable, required
  - `to_addresses` Recipient[], nullable, required
    - union: Email recipient. Either an object with address and optional name, or a string.
      - object
        - `address` string, email, required: Email address.
        - `name` string, nullable: Display name (optional).
      - string: Email address as a string. Accepts plain address ("user@example.com") or display name format ("Jane Doe <user@example.com>").
  - `cc_addresses` Recipient[], nullable, required
    - union: Email recipient. Either an object with address and optional name, or a string.
      - object
        - `address` string, email, required: Email address.
        - `name` string, nullable: Display name (optional).
      - string: Email address as a string. Accepts plain address ("user@example.com") or display name format ("Jane Doe <user@example.com>").
  - `bcc_addresses` Recipient[], nullable, required
    - union: Email recipient. Either an object with address and optional name, or a string.
      - object
        - `address` string, email, required: Email address.
        - `name` string, nullable: Display name (optional).
      - string: Email address as a string. Accepts plain address ("user@example.com") or display name format ("Jane Doe <user@example.com>").
  - `attachments` AttachmentMetadata[], nullable, required: Attachment metadata (filename, size, content_type). Null if no attachments.
    - `filename` string, required
    - `size` integer, required: Size in bytes.
    - `content_type` string, required
  - `source` 'api' | 'dashboard' | 'newsletter' | 'inbound' | 'smtp' | 'assistant', required
  - `mode` 'live' | 'test', required: The API-key data plane that owns this resource. Test resources are isolated from live delivery, quota, suppression, and reputation.
  - `status` 'scheduled' | 'queued' | 'sent' | 'delivered' | 'bounced' | 'complained' | 'failed' | 'suppressed' | 'cancelled', required
  - `rule_disposition` object, nullable, required: Inbox rule evaluation recorded when this inbound tracked message was delivered. Null for outbound messages, messages ingested before rule disposition was recorded, or messages delivered while rule evaluation was unavailable.
    - `matched_rule_ids` string[], required: IDs of the inbox rules that matched this message, in evaluation order.
    - `stop_rule_id` string, nullable, required: ID of the matching inbox rule whose stop setting ended further rule processing, or null if processing was not stopped.
  - `scheduled_at` string, date-time, nullable, required: UTC ISO 8601 time when a scheduled message should be sent. Null for immediate messages.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `403`: Insufficient permissions.
- `404`: Resource not found.
- `409`: Resource conflict.
- `422`: Validation failed.
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/shipmail/apis/shipmail-api.md) · [All operations](https://skmtc.dev/shipmail/apis/shipmail-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shipmail/apis/shipmail-api/revisions/2c23e59d7e30?raw)