Extend the lease
Another hour on the expiry, up to the day a lease is capped at. No body.
Runs the real call on your workspace.
POST /temp-mail/inboxes/{id}/extend
Another hour on the expiry, up to the day a lease is capped at. No body.
The inbox token
export OE=https://api.openemail.ukexport INBOX="Authorization: Bearer oe_inbox_kQ8v…"Every call below carries the token POST /temp-mail/inboxes returned, in the same Authorization: Bearer header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.
The token alone decides which inbox a call reads. The id in the path is not checked against it, so a caller juggling two inboxes has to keep each token with its own id.
Example
The hour is added to expiresAt, not to now, so extending with time still on the clock keeps that time.
curl -X POST "$OE/temp-mail/inboxes/tinb_octopus-signup/extend" -H "$INBOX"{ "object": "temp_inbox", "id": "tinb_octopus-signup", "address": "[email protected]", "domain": "freemailaddress.com", "createdAt": "2026-09-01T10:00:00.000Z", "expiresAt": "2026-09-01T13:00:00.000Z", "extensionsLeft": 22, "messageCount": 0, "messageLimit": 50, "lastMessageAt": null, "token": "oe_inbox_Lm3w…"}The answer carries a new token with the later expiry, and the old token keeps its old one, so keep the new one. It reads no mail, so messageCount is 0 and lastMessageAt is null on it.
Twenty-three extensions, and the new expiry is also clamped to 24 hours after createdAt, so the last one may buy less than a full hour, and on a lease created at the cap every one of them buys nothing. extensionsLeft counts only the 23, so read expiresAt back rather than trusting it.
Once all 23 are spent it answers 422 validation_error / extension_limit. That is the end of it: take a new address, or a real mailbox, which does not expire.