---
title: "Get a thread"
method: GET
path: "/api/v1/threads/{id}"
tags: ["Threads"]
---

# Get a thread

`GET /api/v1/threads/{id}`

## Request

- Base URL: `https://supermailos.com`
- URL: `https://supermailos.com/api/v1/threads/{id}`
- Auth: HTTP bearer

One conversation with every message, oldest first. Does not mark it read.

## Path parameters

- `id` string, required

## Query parameters

- `html` boolean

## Response `200`

The thread.

- ThreadDetail
  - `thread` Thread, required
    - `id` string, required
    - `mailboxId` string, required
    - `mailbox` string, email, required: The mailbox's address.
    - `receivedOn` string, email, required: Where the conversation arrived (an alias, if so) or the address it was sent from.
    - `subject` string, required
    - `snippet` string, required
    - `from` EmailAddress, required
      - `email` string, email, required
      - `name` string
    - `participants` EmailAddress[], required: From/To/Cc of every message — never Bcc.
      - `email` string, email, required
      - `name` string
    - `folder` 'inbox' | 'sent' | 'drafts' | 'archive' | 'spam' | 'trash', required
    - `unread` boolean, required
    - `starred` boolean, required
    - `labels` string[], required
    - `lastMessageAt` string, date-time, required
    - `snoozedUntil` string, date-time
    - `hasAttachments` boolean, required
    - `messageCount` integer, required
  - `messages` Message[], required: Oldest first.
    - `id` string, required: Internal message id (webhooks: `emailId`).
    - `threadId` string, required
    - `mailboxId` string, required
    - `direction` 'inbound' | 'outbound', required
    - `messageId` string: RFC 5322 Message-ID header, e.g. `<abc@acme.com>`.
    - `from` EmailAddress, required
      - `email` string, email, required
      - `name` string
    - `to` EmailAddress[], required
      - `email` string, email, required
      - `name` string
    - `cc` EmailAddress[], required
      - `email` string, email, required
      - `name` string
    - `bcc` EmailAddress[]: Present only when the key's user sent the message or was Bcc'd on it.
      - `email` string, email, required
      - `name` string
    - `replyTo` EmailAddress[]: Received mail's Reply-To, when it named one: where its author asked replies to go. Replying through the API uses it instead of `from`.
      - `email` string, email, required
      - `name` string
    - `subject` string, required
    - `date` string, date-time, required
    - `read` boolean, required
    - `text` string, required: Plain-text body.
    - `html` string: HTML body with scripts and event handlers removed (omitted with `?html=false`).
    - `attachments` Attachment[], required
      - `id` string, required
      - `filename` string, required
      - `contentType` string, required
      - `size` integer, required: Bytes.
      - `inline` boolean, required: Embedded in the HTML body via `cid:` rather than attached as a file.
      - `contentId` string: Matches `cid:` references in the HTML body.
      - `url` string, required: Download path (`GET`, same bearer key).
    - `auth` object: Present only when we verified the sender ourselves: mail someone in the workspace sent from their own mailbox (all three `pass`). Absent on other received mail: the mail server doesn't give the app an SPF / DKIM / DMARC verdict, so none is claimed.
      - `spf` string
      - `dkim` string
      - `dmarc` string
    - `deliveredAt` string, date-time: When the recipient's server accepted an outbound message.
    - `trust` object: Agent keys only. `sender`: our own SPF/DKIM/DMARC verdict (`verified`, `unverified`, `failed`; `self` for mail this inbox sent). `hiddenContent`: the email carried text a person wouldn't see — `text`/`html` are the visible part only.
      - `sender` 'verified' | 'unverified' | 'failed' | 'self', required
      - `hiddenContent` boolean, required
      - `signals` string[]: What was removed, e.g. `2 hidden elements`.
  - `permissions` object, required
    - `send` boolean, required
    - `manage` boolean, required

## Other responses

- `401`: Missing, invalid or revoked API key.
- `403`: The key lacks the scope (`missing_scope`) or the access (`forbidden`).
- `404`: Not found — or not reachable with this key.
- `429`: Too many requests.

---

[API](https://skmtc.dev/supermailos/apis/supermailos-api.md) · [All operations](https://skmtc.dev/supermailos/apis/supermailos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/supermailos/apis/supermailos-api/revisions/5bd0ce2ee269?raw)