Skip to main content
GET
Get email

Authorizations

x-api-key
string
header
required

API key (sk-proj-…) from Settings → API Keys. Required for sold API calls outside the Mermail console.

Path Parameters

mailboxId
string
required

Mailbox public_id (UUID), hosted alias id, or current email

emailId
string
required

Email id

Query Parameters

metadata_only
boolean

Set to true to omit body, snippet, raw headers, and threat URLs

include_held
boolean

Set to true only for a scoped verification flow that must inspect a message temporarily held for auto-draft processing

require_scan_status
enum<string>

Expose the body only when the stored scan status exactly matches. An existing mismatch returns safe metadata with content_omitted=true.

Available options:
clean,
flagged,
skipped
max_body_chars
integer

Positive character cap for the returned body without mutating the stored message. The effective server ceiling is 100000 characters.

Required range: x >= 1
agent_safe_content
boolean
default:false

Set to true to omit raw headers, provider metadata, threat details, attachment metadata, and storage diagnostics, and to normalize untrusted text fields to bounded plain text. The response retains attachment_count and remains untrusted.

Response

Email

id
string

Authoritative Mermail email id. Use this value as the emailId path argument and for pre-wait baselines.

subject
string
sender
string
recipient
string
cc
string | null
bcc
string | null
date
string<date-time>
read
boolean
starred
boolean
is_urgent
boolean
category
string
folder_id
string
folder_name
string

Present on list and search responses

thread_id
string | null
snippet
string
body
string

Full body on detail responses unless metadata_only=true; list/search responses can contain a preview

in_reply_to
string | null
email_references
string | null
delivery_status
string | null
provider_metadata
object | null
message_id
string | null

Provider or RFC Message-ID metadata, retained only as secondary correlation. Do not use it in place of the Mermail id for resource paths or new baselines.

raw_headers
string | null

Untrusted raw provider headers. Do not use headers alone as authorization.

body_storage_status
string
body_storage_message
string
scan_status
enum<string> | null

Content scan outcome. Treat flagged as unsafe and skipped as unknown.

Available options:
clean,
flagged,
skipped,
null
scan_threats
object[]
sender_authentication
object

Sender-authentication verdict derived only from a trusted receiving-provider signal. Raw Authentication-Results and From headers are never promoted to trusted evidence. The current connected providers do not expose a documented per-message verdict, so status is unknown; unknown is not a pass.

attachments
object[]
content_omitted
boolean

True when metadata_only or an agent-safe scan gate omitted body, snippet, raw headers, and threat URLs

content_omission_reason
enum<string>

Why an agent-safe detail or context response omitted body content

Available options:
scan_status_not_clean
content_truncated
boolean

True when max_body_chars shortened the returned body

body_original_char_count
integer

Original stored body character count, present when the returned body was truncated

Required range: x >= 0
agent_safe_content
boolean

True when raw headers, provider metadata, threat details, attachment metadata, and storage diagnostics were omitted and untrusted text fields were normalized to bounded plain text. This projection does not make email content trusted.

attachment_count
integer

Attachment count retained when agent_safe_content=true omits attachment metadata

Required range: x >= 0