---
title: "Search an inbox"
method: GET
path: "/v1/inboxes/{inboxId}/search"
tags: ["Inboxes"]
---

# Search an inbox

`GET /v1/inboxes/{inboxId}/search`

## Request

- Base URL: `https://api.volanea.com`
- URL: `https://api.volanea.com/v1/inboxes/{inboxId}/search`
- Auth: HTTP bearer

Full-text over subject, sender and reply text, best match first. Exact words (no stemming); quote a phrase. Held mail excluded.

## Path parameters

- `inboxId` string, required

## Query parameters

- `q` string, required
- `limit` integer

## Response `200`

Matches.

- object
  - `data` InboxMessage[], required
    - `emailId` string, required
    - `inboxId` string, required
    - `threadId` string, required
    - `direction` 'inbound' | 'outbound', required
    - `from` string, required
    - `fromName` string, nullable
    - `to` string, required
    - `cc` string[]
    - `subject` string, required
    - `text` string, nullable: Plain-text part of received mail. Null on sent mail.
    - `extractedText` string, nullable: `text` without quoted history and signature — the new part of a reply.
    - `bcc` string[]: Sent mail only.
    - `security` object, nullable
      - `status` 'pending' | 'scanning' | 'clear' | 'review' | 'unavailable'
      - `reasons` string[]
    - `inReplyToEmailId` string, nullable: The campaign/workflow/transactional email this answers, when it answers one.
    - `campaignId` string, nullable
    - `html` string, nullable: Only on single-message and thread reads. Received HTML is sanitized: no scripts, iframes, or event handlers.
    - `labels` string[], required: System: `spam`, `virus` (attachments not downloadable), `unauthenticated` (neither SPF nor DKIM passed), `held`, `security-review`. Plus any you set.
    - `plusTag` string, nullable: `order42` for mail sent to `name+order42@…`.
    - `status` string
    - `attachments` object[]
      - `attachmentId` string
      - `filename` string
      - `contentType` string
      - `size` integer
      - `inline` boolean
    - `createdAt` string, date-time, required
    - `sentAt` string, date-time, nullable
  - `nextCursor` string, nullable, required: Opaque token. Pass back as `cursor` verbatim to fetch the next page; `null` when there are no more rows.

## Other responses

- `401`: Missing or invalid API key.
- `404`: Not found.
- `422`: Request validation failed (code `validation_error`, 422).

---

[API](https://skmtc.dev/volanea/apis/volanea-api.md) · [All operations](https://skmtc.dev/volanea/apis/volanea-api/llms.txt) · [OpenAPI document](https://skmtc.dev/volanea/apis/volanea-api/revisions/9e187ae84fda?raw)