---
title: "Get a message"
method: GET
path: "/api/v1/messages/{id}"
tags: ["Messages"]
---

# Get a message

`GET /api/v1/messages/{id}`

## Request

- Base URL: `https://supermailos.com`
- URL: `https://supermailos.com/api/v1/messages/{id}`
- Auth: HTTP bearer

One message by id — the `emailId` in webhook payloads.

## Path parameters

- `id` string, required

## Query parameters

- `html` boolean

## Response `200`

The message.

- object
  - `message` Message, required
    - `id` string, required: Internal message id (webhooks: `emailId`).
    - `threadId` string, required
    - `mailboxId` string, required
    - `direction` 'inbound' | 'outbound', required
    - `messageId` string: RFC 5322 Message-ID header, e.g. `<abc@acme.com>`.
    - `from` EmailAddress, required
      - `email` string, email, required
      - `name` string
    - `to` EmailAddress[], required
      - `email` string, email, required
      - `name` string
    - `cc` EmailAddress[], required
      - `email` string, email, required
      - `name` string
    - `bcc` EmailAddress[]: Present only when the key's user sent the message or was Bcc'd on it.
      - `email` string, email, required
      - `name` string
    - `replyTo` EmailAddress[]: Received mail's Reply-To, when it named one: where its author asked replies to go. Replying through the API uses it instead of `from`.
      - `email` string, email, required
      - `name` string
    - `subject` string, required
    - `date` string, date-time, required
    - `read` boolean, required
    - `text` string, required: Plain-text body.
    - `html` string: HTML body with scripts and event handlers removed (omitted with `?html=false`).
    - `attachments` Attachment[], required
      - `id` string, required
      - `filename` string, required
      - `contentType` string, required
      - `size` integer, required: Bytes.
      - `inline` boolean, required: Embedded in the HTML body via `cid:` rather than attached as a file.
      - `contentId` string: Matches `cid:` references in the HTML body.
      - `url` string, required: Download path (`GET`, same bearer key).
    - `auth` object: Present only when we verified the sender ourselves: mail someone in the workspace sent from their own mailbox (all three `pass`). Absent on other received mail: the mail server doesn't give the app an SPF / DKIM / DMARC verdict, so none is claimed.
      - `spf` string
      - `dkim` string
      - `dmarc` string
    - `deliveredAt` string, date-time: When the recipient's server accepted an outbound message.
    - `trust` object: Agent keys only. `sender`: our own SPF/DKIM/DMARC verdict (`verified`, `unverified`, `failed`; `self` for mail this inbox sent). `hiddenContent`: the email carried text a person wouldn't see — `text`/`html` are the visible part only.
      - `sender` 'verified' | 'unverified' | 'failed' | 'self', required
      - `hiddenContent` boolean, required
      - `signals` string[]: What was removed, e.g. `2 hidden elements`.

## Other responses

- `401`: Missing, invalid or revoked API key.
- `403`: The key lacks the scope (`missing_scope`) or the access (`forbidden`).
- `404`: Not found — or not reachable with this key.
- `429`: Too many requests.

---

[API](https://skmtc.dev/supermailos/apis/supermailos-api.md) · [All operations](https://skmtc.dev/supermailos/apis/supermailos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/supermailos/apis/supermailos-api/revisions/5bd0ce2ee269?raw)