---
title: "Contacts"
description: "`contacts.list`, `get`, `create`, `save`, `update`, `setAudiences`, `delete`, `deleteMany`, `listPeople`, `setPhoto`, `removePhoto`, `block`, `unblock`, `listThreads` and `activity`."
url: "https://nextmail.sh/docs/sdk/contacts"
area: "TypeScript"
category: "Mailbox"
---

# Contacts

`contacts.list`, `get`, `create`, `save`, `update`, `setAudiences`, `delete`, `deleteMany`, `listPeople`, `setPhoto`, `removePhoto`, `block`, `unblock`, `listThreads` and `activity`.

## Every method

**usage.ts**

```
const page = await nextmail.contacts.list({ limit: 100 })
  const contact = await nextmail.contacts.get('ada@example.com')

  const saved = await nextmail.contacts.create({
    email: 'grace@example.com',
    name: 'Grace Hopper',
    notes: 'Met at the compiler workshop',
  })

  await nextmail.contacts.update(saved.email, { notes: null })
  await nextmail.contacts.setAudiences(saved.email, {
    audienceIds: ['aud_4c1b8e2a7d9f05c36b4e8a71'],
  })
  await nextmail.contacts.delete(saved.email)

  console.log(page.items.length, page.hasMore, contact.source, contact.lastSeenAt)
```

Most recently seen first, with contacts that have never been mailed last. `source` is `auto` when the row was written because a member sent that address a message from the app composer, which is a materially different claim from somebody having saved it. Mail arriving from an address writes nothing, and neither does a send through this API.

The book belongs to the workspace rather than to one person, so a contact saved by any member is the contact every member and every key sees. `create` writes `source` as `manual` and puts the contact in the default audience as it is written. Name lists of your own in `audienceIds` to join them in the same call, which also needs `audiences:write`, or add the contact later with `nextmail.audiences.addContact`. `setAudiences` says exactly which lists a contact is in, in one call.

`attributes` on a contact holds its custom fields, up to 50 text values. Pass it to `create`, `save` or `update`, where a string sets a field and `null` removes one, and read it back on every contact. Automations use a field as `attributes.<key>`.

> Addresses are stored lowercased and the client encodes the one you pass, so `A+B@example.com` reaches the right row. The address is the identity, so `update` cannot change it: moving a contact is a `delete` and a `create`.

## Parameters: contacts.list

- `limit` (number): How many contacts to return per page: an integer from 1 to 200, defaulting to 50. It is coerced, so `'100'` off a query string is fine, and a value outside the range is a 422 rather than a clamped one.
- `cursor` (string): The `nextCursor` from the previous page. Never build one yourself: a cursor naming a contact that no longer exists is a 400 `invalid_cursor`, which means your paging state is stale and the walk should restart without a cursor.
- `source` (ContactSource): `'manual'` for the contacts somebody saved on purpose, `'auto'` for the ones the app composer recorded. Leave it out for the whole book.

## Response: ContactResource

`contacts.list` resolves to a `Page<ContactResource>`, so the rows are on `page.items` and the walk follows `page.nextCursor` while `page.hasMore` is true. `get`, `create`, `update` and `setAudiences` each resolve to one `ContactDetailResource`, the same row plus `audiences`. The address book is unbounded, which is why this route pages rather than returning an array that silently stopped at 200.

- `object` ('contact'): Always the string `contact`, on the list rows as well as on `get`.
- `email` (string): The address, lowercased on write so `Bob@x.com` and `bob@x.com` are one contact, and the key every contacts method takes, since no contact id is exposed. Rows belong to the workspace rather than to the member or the key that wrote them, so every member and every key on the workspace reads and writes one address book.
- `name` (string | null): The display name. Null when no name has ever been recorded for the address. An automatic write carries one only when the header supplied something other than the address itself, and it can never overwrite a name the user typed.
- `source` ('manual' | 'auto' | (string & {})): `auto` means the row was written because the user sent mail to that address; `manual` means somebody entered it by hand, a materially different claim, and an upsert never downgrades `manual` back to `auto`. Mail arriving from an address writes no row at all, deliberately, so somebody who has only ever written to you is not in here; the union stays open because the column is free text defaulting to `manual`.
- `notes` (string | null): Free text somebody wrote about this person, in the app or through `update`, never generated. Null when nobody has written any, and an explicit null on `update` clears it.
- `lastSeenAt` (string | null): ISO-8601 UTC, bumped every time a member sends to that address from the app composer, not when mail arrives from it, which writes nothing. Null on a contact saved through `create` that has never been mailed, and those sort last in the descending `lastSeenAt` order this route returns.
- `audiences` (Array<ContactAudienceResource>): Only on `get`, `create`, `update` and `setAudiences`, never on list rows. Every audience the contact is in as `{ id, name, builtin }`, the default one included. `builtin` is `default` on the audience every contact belongs to and null on one somebody created, so branch on it rather than on the name, which anybody can change.
- `photoUrl` (string | null): Where the contact photo is served, or null when the contact has none. `setPhoto` sets it and every upload gets a new URL.

## Setting a contact's audiences

`setAudiences(email, { audienceIds })` says exactly which audiences one contact is in, in one request. The contact joins every audience listed that it is not in yet and leaves every other one, and the call resolves to the `ContactDetailResource` after the change. It needs `audiences:write`, because it writes memberships rather than the contact, and repeating it changes nothing.

> The default audience is always kept, so `{ audienceIds: [] }` leaves the contact in the default audience alone. It takes up to 100 ids. An id that names no audience in this workspace is a 404 `audience_not_found` and nothing changes, and an address that is not a contact is a 404 `contact_not_found`.

## Everyone on the Contacts page

`listPeople` lists the people the Contacts page in the app shows: the saved contacts and every address seen in mail, each with `saved`, `threads` and `lastAt`. `list` is the saved contacts alone. The addresses seen in mail come only when the key also holds `threads:read`, and `page.seen` says whether they did. `sort` is `recent`, `name` or `threads`, `q` searches names, addresses and notes, and `blocked: true` keeps the people the workspace blocklist blocks, whole-domain rules included. `blockedBy` names the rule on every row.

**people.ts**

```
const page = await nextmail.contacts.listPeople({ sort: 'threads', limit: 50 })

for (const person of page.items) {
  if (!person.saved && (person.threads ?? 0) > 5) await nextmail.contacts.save(person.email)
}

const blocked = await nextmail.contacts.listAllPeople({ blocked: true })
```

> `listAllPeople` and `iteratePeople` walk every page. The cursor is opaque, so pass `nextCursor` back as it came, with the same `sort`, `q` and `blocked`.

## Saving, deleting and photos

`save(email, { name, notes })` is Add to contacts and Keep in contacts: it saves an address that is not a contact yet, keeps one recorded from a send as saved by hand, and brings back a deleted one. `delete` is Delete: it removes the saved contact and hides the address, so the composer does not record it again, and it takes an address only ever seen in mail too. `wasSaved` says which it was. `deleteMany` deletes up to 200 in one call.

**photo.ts**

```
await nextmail.contacts.save('grace@example.com', { name: 'Grace Hopper' })

const photo = await Bun.file('grace.jpg').arrayBuffer()
const contact = await nextmail.contacts.setPhoto('grace@example.com', photo, { contentType: 'image/jpeg' })

await nextmail.contacts.removePhoto('grace@example.com')
await nextmail.contacts.deleteMany(['ada@example.com', 'offers@shop.example'])
```

> `setPhoto` sends the image bytes as they are: PNG, JPEG, WebP or GIF up to 5 MB, fitted into a 512 pixel square. Pass `contentType`, or a `Blob` that carries its own type. The address has to be a saved contact first.

## Blocking

`block(email)` puts the address on the workspace blocklist so mail from it is refused, dropping any plus tag, and `unblock(email)` takes off every rule that blocks it. Both need `settings:write`, because they change the blocklist rather than the contact, and neither needs the address to be a contact.

> When `unblock` lifts a whole-domain rule, `removed` lists it with `list` set to `blockedDomains`, and everybody at that domain is unblocked with it.

## Conversations and activity

`listThreads(email)` pages through the threads the address wrote or was written to, in every folder, and `listAllThreads` and `iterateThreads` walk them. `activity(email)` returns the numbers behind a contact's Activity tab: received and sent per bucket, threads waiting on your reply, and the median reply time each way. Both need `threads:read`.

**activity.ts**

```
const threads = await nextmail.contacts.listThreads('ada@example.com', { q: 'invoice' })

const activity = await nextmail.contacts.activity('ada@example.com', {
  minutes: 30 * 24 * 60,
  grain: 'day',
  offsetMinutes: -new Date().getTimezoneOffset(),
})

console.log(threads.items.length, activity.totals.waiting)
```