---
title: "List attachments"
description: "The parts on one message: names, types and sizes, and no bytes."
url: "https://nextmail.sh/docs/api/temp-mail/attachments"
area: "API"
category: "Disposable inboxes"
---

# List attachments

The parts on one message: names, types and sizes, and no bytes.

`GET /temp-mail/inboxes/{id}/messages/{messageId}/attachments`

## GET /temp-mail/inboxes/{id}/messages/{messageId}/attachments

The parts on one message: names, types and sizes, and no bytes.

## The inbox token

**shell**

```
export OE=https://api.nextmail.sh
export INBOX="Authorization: Bearer oe_inbox_kQ8v…"
```

Every call below carries the token `POST /temp-mail/inboxes` returned, in the same `Authorization: Bearer` header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.

> The token alone decides which inbox a call reads. The id in the path is not checked against it, so a caller juggling two inboxes has to keep each token with its own id.

## Example

Metadata only. No route on a disposable inbox serves the bytes of an attachment, and there is no per-part fetch.

**curl**

```
curl "$OE/temp-mail/inboxes/tinb_octopus-signup/messages/thr_4b81c07d2fa9418e93c6a13f/attachments" \
  -H "$INBOX"
```

**Response**

```
{
  "object": "list",
  "data": [
    {
      "object": "attachment",
      "attachmentId": "msg_7d3e4c118a0f5d729c2f41ab-0",
      "filename": "invoice.pdf",
      "mimeType": "application/pdf",
      "size": 12345,
      "body": "",
      "headers": []
    }
  ]
}
```

> `body` is always an empty string and `headers` always empty. `size` is the decoded size of the part.

> `filename` and `mimeType` are what an anonymous sender declared. Treat them as claims.

## Reference

- [`GET /temp-mail/inboxes/{id}/messages/{messageId}/attachments`](https://nextmail.sh/docs/api/reference/temp-mail#get-temp-mail-inboxes-id-messages-messageid-attachments): full reference