---
title: "List messages in a thread (includes attachments refs)"
method: GET
path: "/v1/threads/{id}/messages"
tags: ["Threads"]
---

# List messages in a thread (includes attachments refs)

`GET /v1/threads/{id}/messages`

## Request

- Base URL: `https://api.thrd.email`
- URL: `https://api.thrd.email/v1/threads/{id}/messages`
- Auth: HTTP bearer

## Path parameters

- `id` string, uuid, required

## Response `200`

Thread messages

- object
  - `thread` object, required
    - `id` string, uuid, required
    - `tenantId` string, required
    - `inboxId` string, required
    - `subjectNorm` string, nullable, required
    - `participantsHash` string, required
    - `lastMessageAt` string, date-time, required
    - `createdAt` string, date-time, required
  - `messages` object[], required
    - `id` string, uuid, required
    - `tenantId` string, required
    - `threadId` string, uuid, required
    - `inboxId` string, required
    - `direction` 'inbound' | 'outbound', required
    - `messageId` string, nullable, required
    - `inReplyTo` string, nullable, required
    - `references` string, nullable, required
    - `fromAddr` string, email, nullable, required
    - `toAddrsJson` string[], nullable, required
    - `ccAddrsJson` string[], nullable, required
    - `subject` string, nullable, required
    - `text` string, nullable, required
    - `html` string, nullable, required: Inbound HTML is an allowlisted sanitized projection. It is null when sanitization fails; raw inbound HTML is never returned. Outbound HTML is returned as authored.
    - `headersJson` object, nullable, required
    - `providerMessageId` string, nullable, required
    - `status` 'received' | 'pending' | 'sent' | 'failed' | 'quarantined' | 'blocked', required
    - `createdAt` string, date-time, required
    - `content_state` 'available' | 'content_expired', required
    - `unavailable_fields` string[], required
    - `body_expired_at` string, date-time, nullable, required
    - `metadata_expired_at` string, date-time, nullable, required
    - `attachments` object[], required
      - `id` string, uuid, required
      - `tenantId` string, required
      - `messageId` string, uuid, required
      - `filename` string, required
      - `mime` string, required
      - `size` integer, required
      - `storageRef` string, required: Opaque reference; attachment bytes are never embedded.
      - `createdAt` string, date-time, required
    - `message_security` object, nullable, required
      - `engine` string, required
      - `score` integer, required
      - `level` 'low' | 'medium' | 'high' | 'critical', required
      - `flags` string[], required
      - `policy` object, required
      - `created_at` string, date-time, required

---

[API](https://skmtc.dev/thrd/apis/thrd-agent-email-api.md) · [All operations](https://skmtc.dev/thrd/apis/thrd-agent-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thrd/apis/thrd-agent-email-api/revisions/d8a88129cd34?raw)