List Emails
Request, response and authentication details for your Mailat instance.
/api/v1/inbox/receivedListEmails returns a paginated list of received emails GET /api/v1/inbox/received If identityId is 0 or omitted, returns emails from all user's identities (unified inbox) The built-in dmarc-reports folder holds authenticated aggregate reports; all includes those messages. Search, pagination and identity/domain filters work normally. Reading does not change unread state.
Authentication & compatibility
Use a scoped bearer API key with email:read. The key is bound to its user and organization.
SES email workflow and its stored mailbox/configuration data. Provider actions require configured AWS permissions and verified owned domains; receiving is opt-in.
Contract 2026-10-04. Your running instance's /api/v1/openapi.json is authoritative for its deployed release.
Request
Set MAILAT_BASE_URL to your instance origin (without /api/v1) and MAILAT_TOKEN to an appropriate credential. Replace path placeholders and example data before running. These examples do not execute in this page.
curl --request GET "$MAILAT_BASE_URL/api/v1/inbox/received" \
--header "Authorization: Bearer $MAILAT_TOKEN"Parameters
dateFromstringdateTostringdomainIdinteger (int64)folderstringBuilt-in folder or virtual view. all includes DMARC reports.
Allowed: "inbox" | "dmarc-reports" | "sent" | "drafts" | "outbox" | "spam" | "trash" | "starred" | "archive" | "all"
Default: "inbox"
hasAttachmentsall of · nullableVariant 1booleanidentityIdinteger (int64)isReadall of · nullableVariant 1booleanisStarredall of · nullableVariant 1booleanlabelsarrayEach itemstringpageinteger (int64)One-based page. Values below 1 use 1.
Default: 1
pageSizeinteger (int64)Values below 1 use 50; values above 100 are capped to 100.
Default: 50
searchstringsenderstringsortBystringsubject, from_email or size_bytes; other values use received_at.
Default: "receivedAt"
sortOrderstringasc selects ascending order; other values use descending order.
Default: "desc"
Responses
HTTP statuses and body shapes below come from the pinned contract. Not every shared error applies to every request. Retain the original idempotency key when retrying a send.
200 · Success
Header: X-RateLimit-RemainingintegerRemaining requests in this API key's current minute window (present for API-key authentication).
minimum: 0
application/json
responseobjectFields
codeintegerrequireddataall of · nullableVariant 1objectFields · model.InboxListResponse
emailsarrayEach itemobjectFields · model.ReceivedEmail
attachmentsarrayEach itemobjectFields · model.EmailAttachment
checksumstringcontentIdstringcontentTypestringcreatedAtstring (date-time)downloadUrlstringfilenamestringidinteger (int64)isInlinebooleanreceivedEmailIdinteger (int64)s3Bucketstrings3KeystringsizeBytesinteger (int64)uuidstringbccEmailsarrayEach itemstringccEmailsarrayEach itemstringcreatedAtstring (date-time)directionstringdkimVerdictstringdmarcVerdictstringdomainIdinteger (int64)draftVersioninteger (int64)envelopeRecipientsarrayEach itemstringfolderstringfromEmailstringfromNamestringhasAttachmentsbooleanhtmlBodystringidinteger (int64)identityColorstringidentityDisplayNamestringidentityEmailstringidentityIdinteger (int64)inReplyTostringisArchivedbooleanisReadbooleanisSpambooleanisStarredbooleanisTrashedbooleanlabelsarrayEach itemstringmessageIdstringorgIdinteger (int64)rawS3BucketstringrawS3KeystringreadAtall of · nullableVariant 1string (date-time)receivedAtstring (date-time)referencesarrayEach itemstringreplyTostringsendErrorstringsendStatusstringsentAtall of · nullableVariant 1string (date-time)sesMessageIdstringsizeBytesinteger (int64)snippetstringsnsNotificationIdstringspamScoreall of · nullableVariant 1numberspamVerdictstringspfVerdictstringsubjectstringtextBodystringthreadIdstringtoEmailsarrayEach itemstringtrashedAtall of · nullableVariant 1string (date-time)updatedAtstring (date-time)uuidstringvirusVerdictstringpageinteger (int64)pageSizeinteger (int64)totalinteger (int64)totalPagesinteger (int64)unreadinteger (int64)messagestringrequired400 · Invalid input
application/json
responseobjectFields
codeintegerrequiredmessagestringrequired401 · Missing, expired or revoked authentication
application/json
responseobjectFields
codeintegerrequiredmessagestringrequired403 · Insufficient permission
application/json
responseobjectFields
codeintegerrequiredmessagestringrequired404 · Resource not found
application/json
responseobjectFields
codeintegerrequiredmessagestringrequired409 · Conflict or changed idempotency payload
application/json
responseobjectFields
codeintegerrequiredmessagestringrequired410 · Recovery cursor expired; resynchronize
application/json
responseobjectFields
codeintegerrequiredmessagestringrequired429 · Rate limit exceeded; respect Retry-After
Header: Retry-AfterintegerSeconds until the next fixed-minute request window.
minimum: 1
application/json
responseobjectFields
codeintegerrequiredmessagestringrequired500 · Internal failure; retain the idempotency key
application/json
responseobjectFields
codeintegerrequiredmessagestringrequired