---
title: "Retrieve a message"
description: "One message with its body. Retrieving it does not mark it seen."
url: "https://nextmail.sh/docs/api/temp-mail/message"
area: "API"
category: "Disposable inboxes"
---

# Retrieve a message

One message with its body. Retrieving it does not mark it seen.

`GET /temp-mail/inboxes/{id}/messages/{messageId}`

## GET /temp-mail/inboxes/{id}/messages/{messageId}

One message with its body. Retrieving it does not mark it seen.

## The inbox token

**shell**

```
export OE=https://api.nextmail.sh
export INBOX="Authorization: Bearer oe_inbox_kQ8v…"
```

Every call below carries the token `POST /temp-mail/inboxes` returned, in the same `Authorization: Bearer` header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.

> The token alone decides which inbox a call reads. The id in the path is not checked against it, so a caller juggling two inboxes has to keep each token with its own id.

## Example

The message is checked against the lease before anything is returned: it has to be delivered to this address, after this lease began, and not moved to the bin. Anything else is 404, because a message id is not a permission.

**curl**

```
curl "$OE/temp-mail/inboxes/tinb_octopus-signup/messages/thr_4b81c07d2fa9418e93c6a13f" \
  -H "$INBOX"
```

**Response**

```
{
  "object": "temp_message",
  "id": "thr_4b81c07d2fa9418e93c6a13f",
  "from": { "name": "Acme", "email": "no-reply@acme.com" },
  "to": "octopus-signup@freemailaddress.com",
  "subject": "Confirm your email",
  "snippet": "Your code is 481923…",
  "spam": false,
  "seen": false,
  "attachmentCount": 1,
  "sizeBytes": 8241,
  "receivedAt": "2026-09-01T10:31:04.000Z",
  "message": { "decodedBody": "<p>Your code is 481923</p>", "verificationCode": "481923", "…": "…" },
  "truncated": false
}
```

> Render `message.decodedBody`. `body` and `processedHtml` are empty strings on a locally-ingested message, which is every message that can reach a disposable inbox. Reading either of those and finding nothing is the mistake this note exists to prevent.

> `message` is the same object the real mailbox stores, passed through without projection: the shape IS the storage schema, and a hand-written field list here would be a second description of it that goes stale. It is also attacker-supplied HTML, so render it out of your own origin.

> `truncated` is always false. The body is never cut here.

> A message this lease cannot see answers 404 `resource_not_found`, and while the pool cannot be read the answer is 503 `not_configured`.

> `message.verificationCode` is the sign-in code of a verification email, as you would type it, when Nextmail is sure of it, and null otherwise. It is the quickest way to finish a sign-up without reading the body.

## Reference

- [`GET /temp-mail/inboxes/{id}/messages/{messageId}`](https://nextmail.sh/docs/api/reference/temp-mail#get-temp-mail-inboxes-id-messages-messageid): full reference