Extend the lease
Another hour on the expiry, up to the day a lease is capped at. No body.
Runs the real call against your workspace, with your own key.
POST /temp-mail/inboxes/{id}/extend
Another hour on the expiry, up to the day a lease is capped at. No body.
The inbox token
export OE=https://api.openemail.ukexport INBOX="Authorization: Bearer oe_inbox_kQ8v…"Every call below carries the token POST /temp-mail/inboxes returned, in the same Authorization: Bearer header an API key uses. The address itself authorises nothing, and that separation is the point of the feature rather than a formality: a disposable address is handed to the party you are keeping at arm’s length the moment it is issued.
The id in the path has to name the same inbox the token does. The token alone identifies one, so this is belt and braces, but it means a caller that muddles two inboxes gets a 404 instead of quietly reading the wrong mail.
Example
The hour is added to expiresAt, not to now, so extending with time still on the clock keeps that time.
curl -X POST "$OE/temp-mail/inboxes/tinb_9c2f41ab7d3e4c118a0f5d72/extend" -H "$INBOX"{ "object": "temp_inbox", "id": "tinb_9c2f41ab7d3e4c118a0f5d72", "address": "[email protected]", "domain": "freemailaddress.com", "createdAt": "2026-09-01T10:00:00.000Z", "expiresAt": "2026-09-01T13:00:00.000Z", "extensionsLeft": 21, "messageCount": 3, "messageLimit": 50, "lastMessageAt": "2026-09-01T10:31:04.000Z"}Twenty-three extensions, and the new expiry is also clamped to 24 hours after createdAt, so the last one may buy less than a full hour, and a lease created at the cap has none at all. extensionsLeft already counts both ceilings; read it and expiresAt back rather than counting your own calls.
At the cap it answers 409 conflict_error / extension_limit. That is the end of it: take a new address, or a real mailbox, which does not expire.